1

I scanned my machine (with the latest version of ClamAV) after looking at some images which were loaded from external sites and those sites seem to be dodgy hacking sites, and these were some of the results that I got about my Google Chrome cache:

/home/arthur-dent/.cache/google-chrome/Default/Cache/f_009bb4: PUA.JS.Xored FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_00b45d: PUA.JS.Xored FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_00afd9: PUA.JS.Xored FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_00b45e: PUA.JS.Xored FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_00afdc: PUA.JS.Xored FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_00b353: PUA.Phishing.Bank FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_00b414: PUA.Phishing.Bank FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_000e30: PUA.JS.Xored FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_0071e4: PUA.JS.Xored FOUND
/home/arthur-dent/.cache/google-chrome/Default/Cache/f_00b382: PUA.Phishing.Bank FOUND

Now, I often get the PUA.JS.Xored so I'm not really worried about them, but never before have I got the PUA.Phishing.Bank, so what are these and can they do any damage? I have cleared my cache and they seem to be gone now, but could they have done anything bad to my systems?

And yes, I have read this, but it wasn't much help for practical purposes: https://askubuntu.com/a/415146/364819

OS Information:

Description:    Ubuntu 14.10
Release:    14.10
Improve this question
3
  • Do the files contain any URLs? The best thing to do may be to clear cache in the chrome browser to remove all the stuff.
    – Wilf
    Apr 3, 2015 at 20:39
  • @Wilf: Sorry, did not check the file contents, is there anyway now that I have cleared the cache that I could still check?
    – user364819
    Apr 3, 2015 at 20:41
  • wait till another turns up again :). I have had similar problems with tracking cookies from certain sites, so as I use Firefox I use a few tracker and cookie blockers to blacklist them - though in your case it is probably not a cookie, the files contents probably could be used to track and block its origin. by the way PUA means Potentially unwanted application, so it could be some addon within chrome (PUAs aren't always malicious though)
    – Wilf
    Apr 3, 2015 at 20:55

1 Answer 1

Reset to default
1

Basically, if you didn't perform any bank payments on the computer you've downloaded these on between visiting these dodgy web sites and posting this question you're safe...

What to do if you did perform bank payments:

  • Contact the anti-fraud department of your bank immediately!
  • Keep the date/time you started the conversation with your bank in a secure place (Not your computer! A paper agenda would be perfect)
  • From this point in time, you're protected according to EU rules and regulations (verify your statutory rights if you're outside of the EU)
  • Clear your cache

Nothing more to do!

Improve this answer
1
  • 1
    Luckily no bank payments! :)
    – user364819
    Apr 3, 2015 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.