We are running Ubuntu on several office machines, which are used to handle administrative tasks on a daily basis, e.g. to receive applications via e-mail.

We now had the situation that we received "faked" applications from e-mails of Russian origin, which contained "CVs" in .doc / .docx format. These files when executed would attempt to execute a macro. LibreOffice showed a warning that it would block any macro execution by default.

Nevertheless, is it possible to infect an Ubuntu / Debian system with Macro virus for MS Office / LibreOffice / OpenOffice?

If so, how can you identify an infection and / or remove an infection?

  • If your question is "can I write a malware that infects Linux and hid it into a macro?" then the answer is "yes". If your question is "can a malware written for damage Windows, damage also Linux?" then the answer is "mostly not, but it depends ont he specific code". The most secure way, and the power of UNIX-based systems, is to handle these files with a very restricted user, so that this code cannot have access in any way to any other parts of the system. To identify the maleficient files, scan them with an antivirus. – dadexix86 Mar 24 '16 at 12:21
  • Which antivirus scanner would you recommend? Are there any for Ubuntu? – MrNerdy Mar 24 '16 at 12:29
  • @dadexix86 Does that sort of program detect macro threats? Also, by "handle these files with a very restricted user" you mean it's not root - surely that means it could access all my files (e.g. ransom ware could encrypt it?) – Tim Mar 24 '16 at 12:29
  • @MrNerdy clamav.net - ClamAV – Tim Mar 24 '16 at 12:29
  • @Tim, I intend a more restricted user than your usual user. Your usual user can do a lot of things, like printing, sudoing, read your files... While a more restricted user will not be able to read anything outside it's own home, not be able to print, access or mount external hard drives, acquire other privileges and such. Yes, ClamAV detects also malwares hidden in macros (see for example) – dadexix86 Mar 24 '16 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.