7

I have just scanned my system and clamav has detected a few suspect files:

File: .cahe/mozilla/firefox/jqxk4r44.default/cache2/entries/750B6E2F1286....
Status: PUA.Win.Exploit.CVE_2012_1461-1

File: .cahe/mozilla/firefox/jqxk4r44.default/cache2/entries/F099C33HJ45J....
Status: PUA.Win.Exploit.CVE_2012_1461-1

File: .config/libreoffice/4/user/basic/Standard/Module1.xba
Status: PUA.Doc.Tool.LibreOfficeMacro-2

File: Downloads/nodejs/node-v8.9.4-linux-x64/lib/node_modules/imurmurhash/imurmurhash.min.js
Status: PUA.Win.Trojan.Xored-1

How likely is it that these files are real threats / trojans?

  • 3
    If it did find a virus you'd be the 1st ever person I met where clamav actually did what it is supposed to do ;-) – Rinzwind Feb 14 '18 at 20:48
  • 1
    Don't use clamav – Robert Riedl Feb 15 '18 at 7:55
  • What would you recommend? – baermathias Feb 15 '18 at 9:32
  • I recommend: good strong password for at least your admin account, no installation of software outside of the official repositories unless you can 100% guarantee the source is legit (that includes adding PPAs from launchpad), make regular backups, and checks to see if you can restore those backups. I do not recommend virus scanners on Linux unless you have Windows systems you want to protect. – Rinzwind Jul 19 '18 at 6:24
9

PUA.Win.Exploit.CVE_2012_1461-1

  • PUA means "potential unwanted application". PUA are not virusses, those are claims by clamav that there is an application they consider "unwanted" because that file or extension have been proven to be abused in Windows
  • Win as 2nd part means it is a Windows related notice.
  • clamav has an option to not scan for PUA's.

My conclusion: nothing to worry about.

That leaves ...

PUA.Doc.Tool.LibreOfficeMacro-2

.config/libreoffice/4/user/basic/Standard/Module1.xba has an extension clamav trips on. They believe xba, visual basic macro's, are considered "unwanted". See Clamtk reports these LibreOffice files as possible threats. Are they safe? for a more complete list, the answers and comments.

ClamAV is notoriously flawed software: basing you scans and warnings on Windows and then apply them to Linux does not and will never work.

When you see a notice like this, and you really believe clamav is the tool to use, the next step is to check with a 2nd source: for instance upload the file to an site like virustotal or use a 2nd virusscan software together with clamav (where when both claim the same problem you investigate and otherwise consider them false positives).

But I would ditch clamav altogether and follow a Linux based method: use debsum (link to man page) to check packages (link to a howto).

And when you are really paranoid (here's looking at you Panda) use all of the above ;)

| improve this answer | |
  • Last time I checked debsums used MD5 sums, which is kind of pointless in this situation. – user364819 Feb 14 '18 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.