0

I recently ran a virus scan with clamtk and was pleased that not much came up except for one system folder:

/usr/lib/shim with the following files being flagged:

fallback.efi.signed
MokManager.efi.signed
shim.efi
shim.efi.signed

All of which had the same status:

PUA.Win32.Packer.PrivateExeProte-7

A quick google search into into what these files are says something about "Secure Boot chain-loading bootloader (Microsoft-signed binary)" which doesn't sound like something that should be removed. This also sounds like something I don't want to have infected.

I uploaded the files to https://www.virustotal.com/ and was informed that the files are 'probably harmless' . Is this a false positive?

Can anyone please tell me what to do here? Has my system been compromised?

3

PUA stands for potentially unwanted application. Clamtk is able to detect them -see the options. The packer stands for a code that is extracting the main code during the run.

If you are unsure about the binary file, you can upload it to virustotal.com to see what other antivirus engines are saying.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.