2

I love Ubuntu. I'm shocked to find this virus which is creating a Recycler folder and many ".lnk" files the moment I insert any usb drive. Inserting the USB back to my Windows PC running BitDefender Internet Security 2015 clearly detecting these files as malware. It is hiding all the data that was in the USB.

Honestly, I didn't believe it for 15 days. We use Ubuntu PCs for Internet access in our company. All Ubuntu PCs in my building are suffering from this problem. I formatted my PC and did a fresh install of Ubuntu 12.04. The virus is re-appearing after only a few days.

I installed BitDefender on my Ubuntu PC today and did a full system scan.Eleven infected files got detected and deleted. I rescanned to make sure no infected files are there.Yet the .lnk files are being created once I reinsert the flash drive.

I've apt-get updated many times. My sources.list has Ubuntu main repos and update repos which include security updates. Please help me to eradicate this virus from my Ubuntu PC as well as other PCs in the network.

I'm running Ubuntu 12.04 Desktop on a 32-bit machine, 2 GB RAM, Intel Core 2 Duo processor.

I wrote a post on how to install BD in Linux explaining the problem. You can read here.

The sources.list has the following repos:

###### Ubuntu Main Repos
deb http://in.archive.ubuntu.com/ubuntu/ precise main restricted universe
deb-src http://in.archive.ubuntu.com/ubuntu/ precise main restricted universe

###### Ubuntu Update Repos
deb http://in.archive.ubuntu.com/ubuntu/ precise-security main restricted universe
deb http://in.archive.ubuntu.com/ubuntu/ precise-updates main restricted universe
deb-src http://in.archive.ubuntu.com/ubuntu/ precise-security main restricted universe
deb-src http://in.archive.ubuntu.com/ubuntu/ precise-updates main restricted universe

These are the files that are being created as and when the USB is inserted: Recycler folder, AUTOEXEC.BAT.lnk, boot.ini.lnk, bootfont.bin.lnk, CONFIG.SYS.lnk, IO.SYS.lnk, MSDOS.SYS.lnk, pagefile.sys.lnk

The log file /opt/BitDefender-scanner/var/log/bdscan.log has the following:

//
// BitDefender scan report
//
// Time: Mon Jan 12 11:18:56 2015
// Command line: / --action=delete --suspect-copy --follow-link --log --no-list --no-warnings
// Core: AVCORE v2.1 Linux/i386 11.0.1.12 (Aug 7, 2014)
// Engines: scan: 17, unpack: 13, archive: 51, mail: 8
// Total signatures: 6337727
//

/media/580F-A489__/RECYCLER/temp/qedit.dld      infected: Trojan.Generic.12478731
/media/580F-A489__/RECYCLER/temp/qedit.dld      deleted
/media/580F-A489__/RECYCLER/S-1-5-21-602162358-842925246-1417001333-502/tmp0211 infected: Trojan.GenericKD.2051722
/media/580F-A489__/RECYCLER/S-1-5-21-602162358-842925246-1417001333-502/tmp0211 deleted
/media/580F-A489__/RECYCLER/S-1-5-21-854245398-2077806209-0000980848-1003/tmp0211       infected: Trojan.GenericKD.2051722
/media/580F-A489__/RECYCLER/S-1-5-21-854245398-2077806209-0000980848-1003/tmp0211       deleted
/media/580F-A489_/RECYCLER/temp/qedit.dld       infected: Trojan.Generic.12478731
/media/580F-A489_/RECYCLER/temp/qedit.dld       deleted
/media/580F-A489_/RECYCLER/S-1-5-21-602162358-842925246-1417001333-502/tmp0211  infected: Trojan.GenericKD.2051722
/media/580F-A489_/RECYCLER/S-1-5-21-602162358-842925246-1417001333-502/tmp0211  deleted
/media/580F-A489_/RECYCLER/S-1-5-21-854245398-2077806209-0000980848-1003/tmp0211        infected: Trojan.GenericKD.2051722
/media/580F-A489_/RECYCLER/S-1-5-21-854245398-2077806209-0000980848-1003/tmp0211        deleted
/media/DEEPAK/RECYCLER/temp/qedit.dld   infected: Trojan.Generic.12478731
/media/DEEPAK/RECYCLER/temp/qedit.dld   deleted
/media/DEEPAK/RECYCLER/S-1-5-21-854245398-2077806209-0000980848-1003/tmp0211    infected: Trojan.GenericKD.2051722
/media/DEEPAK/RECYCLER/S-1-5-21-854245398-2077806209-0000980848-1003/tmp0211    deleted
/media/DEEPAK/RECYCLER/S-1-5-21-602162358-842925246-1417001333-502/tmp0211      infected: Trojan.GenericKD.2051722
/media/DEEPAK/RECYCLER/S-1-5-21-602162358-842925246-1417001333-502/tmp0211      deleted
/bin/.flash/.u/44.58u.tar=>(gzip)=>0000000000.nls       password protected
/bin/.flash/.u/44.58u.tar=>(gzip)=>jg.nls       password protected
/bin/.flash/bin/comlnkdll       infected: Trojan.Generic.12478731
/bin/.flash/bin/comlnkdll       deleted
/bin/.flash/bin/comhorse.dat    infected: Trojan.GenericKD.2051722
/bin/.flash/bin/comhorse.dat    deleted


Results:
Folders            : 0
Files              : 619188
Packed             : 4029
Archives           : 15070
Infected files     : 11
Suspect files      : 0
Deleted files      : 11
Copied files       : 0
I/O errors         : 950
Files/second       : 407
Scan time          : 00:25:19

I'm not able find the exact Trojan details in BD Virus Encyclopedia. However this article says Trojan.GenericKD is a PUP(Potentially Unwanted Program) which may come from custom installers found in sites such as CNET,Softonic,Brothersoft etc. These sites are blocked by the Web Gateway in the company.

14
  • 4
    Do you use wine?
    – dadexix86
    Jan 10, 2015 at 12:45
  • A virus on Ubuntu? This would be a first. It might be that your wine installation is infected. It might help to post your sources.list. Maybe one of your ppa's is putting malware on your pc. Jan 10, 2015 at 13:03
  • No wine is not there.
    – Deepak D
    Jan 10, 2015 at 13:54
  • 2
    May I suggest to follow this theory: whatever creates the files is not really malware but rather some silly feature that wants to initialize the USB drive as a DOS system --- automatically --- for whatever reason. That the files are detected as malware then on a windows system may be just because the silly feature was installed with tainted template files. You need a way to watch the processes which try to access the drive as you insert it. One way could be to keep starting fuser in a loop. Another: htop or top with high frequency. There might be better ways.
    – Harald
    Jan 10, 2015 at 16:33
  • 1
    Actually, who is in charge of computer security an compliance in your company? This should have been the person to contact first and this person should have known what to do and not post such a topic on a public forum or Q&A site.
    – LiveWireBT
    Jan 10, 2015 at 16:48

3 Answers 3

2

Go to Disk Manager and format the pendrive.

First,understand that there is NO shortcut virus for Ubuntu. It's your Flash drive messing with itself or you use Wine.

I suggest you reinstall Wine, if you have Wine installed.

Remove Wine completely by typing : sudo apt-get remove wine

Install wine again by typing : sudo apt-get install wine

This should solve the issue.

6
  • Thank you Sachin. I formatted the drive many times. And wine is not installed in the PC.
    – Deepak D
    Jan 10, 2015 at 13:55
  • Then it was the pen drive messing up itself. Is your problem fixed now? Click the green button below the voting arrows if your issue is fixed :) Jan 10, 2015 at 13:58
  • I'm using a FAT32 Transcend Pen drive. Initially I thought like that. I used one more new pen drive(formatted), yet creating these scary .lnk files.
    – Deepak D
    Jan 10, 2015 at 14:01
  • Please note that many guys are experiencing this in my department. Only then I started suspecting Ubuntu. All the while I was blaming my windows workstation, thinking that it's infected.
    – Deepak D
    Jan 10, 2015 at 14:05
  • Woot! Something is fishy, indeed. Don't blame Ubuntu. It doesn't catch the shortcut virus. Some other program is messing up this. Try running 'ps -x | grep Windows' and check if there's any process by that name. Jan 10, 2015 at 14:09
2

As far as I know Ubuntu or any other Linux distro is not affected by shortcut virus. There has to be some kind of a windows process running in your system. Even If we assume if your system is affected by a Linux targeted shortcut virus what is the purpose o it to create .lnk files as those files will work on a windows system.

Do you find any .exe files or .bat files copied to your pen drive?

As Ubuntu documentation explains BitDefender identifies Windows viruses on your system.

BitDefender is a program to check for Windows viruses and malware. It can be run in the background or on demand when required. Once installed it can be found under Applications - Systems Tools. It can be used as an alternative to clamav/clamtk. Ubuntu Documentation

So if it's showing any viruses it means that there are Windows viruses are on your system. Those will not work on Ubuntu.

5
  • Thank you isuru. I agree. Running "find / -iname *.exe" echoeing some exe files in /usr/lib/python2.7/distutils/command/wininst-8.0.exe. They're legitimate right? Also I cleaned my pen drive many times, the moment I inserted into this particular machine all those scary .lnk files are appearing.
    – Deepak D
    Jan 10, 2015 at 14:38
  • More than a dozen machines in my company facing this problem. Guys here are getting scared to touch these Internet PCs. We've few Internet machines, after downloading a software we usually copy it using a pen drive to our working PCs. Today the copied software detected as infected file by BitDefender.
    – Deepak D
    Jan 10, 2015 at 14:42
  • Remove those exe files and you'll be good to go :) Make sure you format all the flash drives you have. Jan 10, 2015 at 14:52
  • 1
    @Deepak_D No rm does not "format" anything. It just removes specified files (every *.exe in the current directory), nothing more. Are you sure you can handle this situation professionally? You should probably call a local company with reputation and experience to get this problem solved.
    – LiveWireBT
    Jan 10, 2015 at 16:37
  • OMG! I did rm -vf *.exe and reformatted the pen drive. Yet those .lnk files are getting created once I inserted the pen drive back.
    – Deepak D
    Jan 12, 2015 at 7:22
1

Sorry for posting this as an answer, but I'll edit and update this answer as we go along to minimise the number of comments and keep things uncluttered. I've got clamav installed and that's just to be able to detect Windows viruses on NTFS hard disks that I hook up though my USB. (no daemon installed)

Furthermore, clamav is available in the standard Ubuntu software repositories and recommended by Canonical: https://help.ubuntu.com/community/ClamAV. Why did you even install bitdefender?

You say that .lnk files keep cropping up and that this is all over your company's network. Do you have samba installed on those machines with guest accounts enabled?

You say that you've reinstalled using 12.04. Why an end-of-life version?

If you can answer the questions above, I'm pretty sure I can help you much better by using free software.

4
  • @dadedix86 Wine or samba?
    – Fabby
    Jan 12, 2015 at 10:06
  • @LiveWireBT I agree with your assessment about compliancy.
    – Fabby
    Jan 12, 2015 at 10:10
  • Thanks Fabby for the answer. Installing BD was just a preference as I use the same in my Windows PC. Running samba --versionsays The program 'samba' is currently not installed. You can install it by typing: apt-get install samba4. Ubuntu-12.04 was the latest when we're migrating from Windows to Ubuntu. The decision to upgrade need to be taken by the Network Mgmt. team. They want to keep all the machines at the same configuration level including OS version(using puppet). What baffles me is that ALL machines are ok except few in my building!?
    – Deepak D
    Jan 12, 2015 at 10:44
  • 1
    12.04 isn't end of life, it's an LTS.
    – Seth
    Jan 13, 2015 at 1:16

Not the answer you're looking for? Browse other questions tagged .