2

I recently installed Ubuntu 12.10. I use Clamav and have scanned my system regularly for infections. Today it picked up a potential threat /usr/lib/ruby/1.9.1/rdoc/generator/template/darkfish/js/thickbox-compressed.js. Ubuntu is my only operating system installed. Clamav was not able to delete or quarantine the file. Should i be concerned or is this a false positive? I have scanned the same file multiple times and it picks it up as a threat each time. Also i tried googling the issue before posting and found no information.

A point I forgot to mention, clamav picks it up as PUA.script.packed-1

2 Answers 2

4

That file seems to belong to package libruby1.9.1, which should be installed when you installed Ruby.

If that package comes from the default repositories I guess that warning should be nothing to you worry about. If it comes from a PPA then you should take a closer look.

To see from where the package comes you can use apt-cache. From my system:

$ apt-cache policy libruby1.9.1
libruby1.9.1:
  Installed: (none)  <-- This shows the installed version (not installed on my case)
  Candidate: 1.9.3.0-1ubuntu2.5
  Version table:
     1.9.3.0-1ubuntu2.5 0
        500 http://pt.archive.ubuntu.com/ubuntu/ precise-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu/ precise-security/main amd64 Packages
     1.9.3.0-1ubuntu1 0
        500 http://pt.archive.ubuntu.com/ubuntu/ precise/main amd64 Packages

Also consider checking that file in an online scanner like VirusTotal. If only clamav marks it as a potencially threath probably it is a false positive.

2
  • apt-cache policy libruby1.9.1 libruby1.9.1: Installed: 1.9.3.194-1ubuntu1.3 Candidate: 1.9.3.194-1ubuntu1.3 Version table: *** 1.9.3.194-1ubuntu1.3 0 500 ca.archive.ubuntu.com/ubuntu quantal-updates/main i386 Packages 500 security.ubuntu.com/ubuntu quantal-security/main i386 Packages 100 /var/lib/dpkg/status 1.9.3.194-1ubuntu1 0 500 ca.archive.ubuntu.com/ubuntu quantal/main i386 Packages forgive me for being new, i dont know what that info really means. I ran it through virustotal though and it said it was clean.
    – melissa
    Mar 11, 2013 at 19:28
  • You can ignore it then, it's everything ok.
    – Salem
    Mar 11, 2013 at 19:46
1

According to a similar post elsewhere, PUA stands for "Potentially Unwanted Application" and the script.packed "usually means it was packed using something which causes AV alerts due to the method used to package the software for install".

It goes on and says that

Hundreds of small developers get the laughable "you gave my PC a virus email" simply because they decide to use a packer to build their install.

As another answer here indicates, if you got the packages installed from repositories, probably this is also a false positive.

EDIT: For websites at least, here and here, it has been ruled out as a false positive, but you can always upload the file to a service such as VirScan.org for a check with multiple antivirus engines.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .