Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I recently started using ubuntu as my main OS, but I am sort of addicted to ms office so I installed PlayOnLinux to be able to use it. I also use Ubuntu one cloud service to make back up of certain files like my assignments and other personal files. but recently I started observing some strange lnk.desktop files showing on my desktop. they appear when ever I open MS word to type my projects. They point to a folder in the /home/z3r0n/.wine/drive_c/windows/command/start.exe folder. I copied the file that they point to and uploaded it to an online virus scanner which identified the file as a cloud malware.

/home/z3r0n/.wine/drive_c/windows/command/start.exe
Win32.Malware.Heur_Generic.A.(kcloud)

3f886e0ea4eb35074c4d3341e8383273b6f245823bc1ea934f47561199206040 sha256
9620af530f0400fafcf6e0b35427d9e60b71f394 sha1
fe66b5254d369c6dffe4e8055f926578 md5

I want to know if any of you guys have experienced something similar. I made a clean install and I am now using LibreOffice instead. I am trying to stay away from UbuntuOne Cloud and installing PlayOnLinux until I find I a valid lead.

any pointers will be appreciated

share|improve this question
add comment

2 Answers 2

It is definitely not related to Ubuntu One. It sounds like you managed to install some malware along with Word.

share|improve this answer
    
ok... I made a mistake by deleting the binary. I should have kept it... any way based on your suggestion, I think I know where to look –  Acess Denied Oct 16 '12 at 18:53
add comment

here you have a copy, I found it few minutes ago and asked my self why word is installing: install.optimuminstaller.com/o/clean/abiword/abiword.exe

and here you have a virustotal raport: https://www.virustotal.com/file/1d3ac5615d33cbe5a2529b2b575343fb387e7fcdb41aeebd25e65c16da94b010/analysis/1350566753/

if You have any questions feel free to ask

cheers o/

share|improve this answer
    
I want to see a disassembled code I learnt it connects to a dns:port or something similar –  Acess Denied Oct 18 '12 at 21:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.