On Wednesday, I installed an old copy of Ubuntu 10.04LTS onto a pristine desktop PC that I built w/ brand new hardware--DSL modem, too--except for the CPU. Then, I downloaded Ubuntu 12.04 from Ubuntu.com, and compared hash values before erasing v10.04 & installing the new OS. The old 10.04 disk & the virgin CD onto which I burned the Ubuntu v12.04 ISO file are the only external media this PC has seen.

As a new convert to Open Source & a paranoid ex-Windows user (for good reason), I have been scanning every file I download, and randomly scanning the entire system every few hours, with ClamTk. It found trojans in

  • Ubuntu's built-in Ruby program;
  • a Photoshop file and
  • a SysInternals tool I downloaded last night; and
  • several files in the Firefox cache.

All but one malware specimen belong to the same family. When instructed to quarantine the infected files in the Firefox cache, ClamTk appeared to do so but the quarantine list was empty. As a precaution, I emptied the cache. Note: ClamTk REFUSES to quarantine the infected Ruby & Photoshop files. Is that normal?

Google provided sparse info about the trojans, except they were first noted about 10 years ago. There does seem to be a surge of inquiries about them in Google over the past 2 weeks. It's unlikely that Ruby has had a known trojan all this time, that ClamTk simply ignored till now... I doubt these malware are false-positives.

Some questions:

  1. Is anyone else finding PUA.Win32.xxxxx with ClamTk?
  2. Is Ubuntu naturally immune to malware named "Win32"?

    Actually, what compels me to post here is finding, while I was checking my Firefox Preferences, six DigiNotar entries in the list of security certificates (Advanced-->Encryption-->View Certificates). The IT security world ostracized DigiNotar last Fall, & Mozilla permanently removed DigiNotar from its list of approved certification providers (see http://blog.mozilla.org/security/2011/09/02/diginotar-removal-follow-up/).

    So, I am wondering:

  3. Did Ubuntu developers forget to remove DigiNotar from Ubuntu's version of Firefox in v12.04?
  4. Does anyone else have DigiNotar in your list of certification authorities?
  5. Are the DigiNotar certificates and the trojans I am finding related?

Thanks for any information you can provide.

  • I found this bug report that suggests all the compromised certs were removed. In addition, I can't find any of the DigiNotar cert in 12.10 Firefox beta v15. – jokerdino Aug 25 '12 at 14:08
  • ClamTk usually gives lots of false positives. Nothing to worry about here. – Cumulus007 Aug 27 '12 at 20:05
  • A script keeps trying to install itself in firefox and up to this point it has been blocked from doing so. I suspect that this script is a facebook trojan trying to get in. It screws up the system whenever it makes itself visible. Also I discovered 200 [Errno 13] "permission denied" scripts when I run Bleachbit... What am I dealing with here? I've got windows 7 installed along ubuntu 12.04 and only use ubuntu for online work. Therefore I don't think it would be a windows problem. I also use Eset Security in windows and it hasn't picked up anything inside the system. If I were to use windows to – user269135 Apr 15 '14 at 10:51
  • Any help solving the [Errno 13] permission denied issue would be graciously appreciated... – user269135 Apr 15 '14 at 10:53
  1. If anybody was able to find it successfully, it would be either because of Dual boot in other Partition, Torrents Downloads or Untrusted Third party sharing or Downloading. I never found it in my system.

  2. Ubuntu is not immune to any trojan named under win32.

    And you don't have to worry about that. DigiNotar is Not Trusted by Default. To see, select the Edit trust option under it. So it is as good as non-existent. Just make sure that the option Ask me Every time option is selected.

    Dialog image

  3. To confirm, the Security team did address this issue here under version nss (3.12.11-3) unstable; urgency=high stating it as Explicitly Distrust not Deleted, whereas current version stands at nss (3.13.1.with.ckbi.1.88-1ubuntu6.1) precise-security. So you don't have to worry at all.


  4. Actually there are two Certificates menus in Certificate Manager as Server and Authorities. DigiNotar is present in my Server section, the first listed one is Expired, need to delete it manually.


  5. Only the Affected Certificate authority or Security testing team can confirm.

  • I thought trojans under Win32 will only affect an Ubuntu installation if Wine is installed? – Thomas Ward Aug 25 '12 at 17:38
  • If wine is ran under sudo or root privileges , then it can cause harm in its environment and packages under it , normally i don't think there is any possibility since it is more or less a emulator. It was asked before here askubuntu.com/a/175344/63025 – atenz Aug 25 '12 at 17:41
  • Correct me if I'm wrong, but Wine isnt part of the main default installations, no? If you're running default Ubuntu, the likelihood of you running Wine (unless you upgraded, and you had Wine installed) is low, no? – Thomas Ward Aug 25 '12 at 17:43
  • You are right , Wine is never a default installation in Ubuntu, it is under Universe repo , you can confirm here , search for wine , not present though. – atenz Aug 25 '12 at 17:47
  • tijybba: Thank you for your detailed answer. I deleted the expired cert and wanted to delete the other DigiNotar certs, too. Coming from Windows, I am accustomed to removing anything that does not belong, is wrong, might be exploitable, don't need, etc. I left them as distrusted so I don't have to remember to say no, in case the question "Do you want to trust DigiNotar" comes up in the future. – nutrobion Aug 28 '12 at 0:50
  1. No, and not in anything Ruby-related either.
  2. No, the 'name' of malware doesn't matter. If you mean malware executables intended to run on Windows, then yes, those wouldn't work on Ubuntu.
  3. I don't think so, Mozilla does that and Debian/Ubuntu just packages stuff, and adds patches and configuration tweaks for their own distro's
  4. I can't find any such certificates in Firefox on 12.04
  5. I have no idea, maybe? You mention in the beginning a 'fresh' system, but then you go on saying you find trojans in a Photoshop file, and in stuff you downloaded...
  • In case I wasn't clear, I downloaded Ubuntu 12.04 .ISO from a site that purported to be Ubuntu.com, using Firefox from a fresh install of Ubuntu 10.04 that used the entire HD. It was the first and only thing I downloaded on the system before I burned the Pangolin version to disk, then used it to install my current OS. v12.04 does not consume the entire drive, but it is still the only OS on this machine. I did download Wine in Package Manager and install it, but never used it. Thanks for explaining how Firefox is adapted. Apparently, some distros have DigiNotar certs & others don't? – nutrobion Aug 28 '12 at 0:55

It seems that you have two systems here - One running Windows and the other Ubuntu - is that clear?

One - Your Windows looks like it got a Trojan, and now your Ubuntu has maybe the same Trojan...

Secondly - Trojans, is malware coming in without you knowing it is actually there, that is why you have an anti-virus to scan an pick it up.

Thirdly - The Trojan went form Windows, over to you Ubuntu installation files - infecting your Ubuntu, while most of the Trojans that comes from (actually all) Windows, won't be able to even run and do anything in Ubuntu, as they are not created for Ubuntu

Fourthly - You can scan and delete things, but with ClamTK, but remember, ClamTk isn't that good, because they don't tent to work on that anti - virus as much, because there shouldn't be viruses, so why creating a supper ClamTk and waste time developing it if they aren't going to use it actually...

You can try to install a better anti - virus like Avast, look on Google how to do that, and look what you can do... I doubt that you will have any problem - as Ubuntu is so immune to viruses, and definitely to that Photoshop files. Go into Windows and scan the disk - Hard disk and get it clean from that side, then everything should be fine....

  • Tim: The system I write about & am currently using is Ubuntu on brand spanking new hardware that has never been exposed to Windows--except that the CPU was in a Windows machine. Ubuntu 12.04 is the only OS on the drive, and before that was v10.04. I am downloading files/programs that run on Windows to use on my laptop and 2 other Windows machines that were hacked. So, any malware on this system did not come from Windows. The weird thing is the infected single file: /usr/lib/ruby/1.9.1/rdoc/generator/template/darkfish/js/thickbox-compressed.js. Is there a way to find out what pkg this came in? – nutrobion Aug 27 '12 at 1:17
  • dpkg -S /usr/lib/ruby/1.9.1/rdoc/generator/template/darkfish/js/thickbox-compressed.js – tgm4883 Aug 27 '12 at 20:05
  • Thanks, tgm4883. Did that, and learned it belongs to libruby 1.9.1 – nutrobion Aug 28 '12 at 0:07
  • Interesting Note: The last 2 ClamTk scans did not produce the trojan warning for the ruby file. Perhaps it was a false positive. Appreciate everyone's help! – nutrobion Aug 28 '12 at 0:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.