4

I am an idiot who has probably installed some drivers from a phishing site in order to get my printer to work.

Site in question is https://drivers-canon.net/canon-ts5053-driver.html; Yea I know I'm a moron, I didn't notice the sketchy English until I returned confused to the website.

I can't figure out where the files ended up and they definitely did not help me print anything.
I did manage to scan with synaptics to remove the installed file in question. Any way I can be sure I have removed everything?

Improve this question
6
  • 3
    Were they .tar.gz files, or .run files, or something else?
    – You'reAGitForNotUsingGit
    Commented May 2, 2017 at 1:31
  • 4
    No, you cannot be sure. Your entire system and all your data may be COMPROMISED. Take it off the network, wipe your disk, and reinstall immediately. Restore your data from backups. Anything less is foolhardy.
    – user535733
    Commented May 2, 2017 at 2:26
  • @user535733: Please write this excellent answer in the answer section so that it may be upvoted and accepted properly. Thanks!
    – Lightness Races in Orbit
    Commented May 2, 2017 at 13:31
  • Hi commenters - I'm so happy this community was so happy answering so fast. Seeing that my installation is only a few days old, I opted to reinstall Ubuntu, which I'll be doing now. For anyone that's looking for a more throughout method, look at the answer I highlighted below. I did not do this, but it's very well written, so should get the most visibility for other users stumbling upon this question.
    – UbuntuDane
    Commented May 2, 2017 at 16:00
  • so for a good source for a printer driver; for your TS5050? .. if you go to Canon Asia, you need the cnijfilter2-5.40-1-deb.tar.gz from here support-asia.canon-asia.com/contents/ASIA/EN/0100839901.html and save to your Downloads folder. Commands to install are: cd Downloads then tar -zxvf cnijfilter2-5.40-1-deb.tar.gz then cd cnijfilter2-5.40-1-deb then sudo ./install.sh
    – pdc
    Commented May 2, 2017 at 20:25

3 Answers 3

Reset to default
13

There isn't any way you can be sure that your system is secure except for reinstalling the OS because you gave the bogus printer driver root permissions when you installed it. Because it was given root permissions, the bogus printer driver could meddle with parts of your filesystem that are owned by root without you knowing about it.

Improve this answer
1
  • Seeing that my installation is only a few days old, I opted to reinstall Ubuntu, which I'll be doing now. For anyone that's looking for a more throughout method, look at the answer I highlighted below with virustotal. I did not do the things listed in that answer, but it's very well written, so it should get the most visibility for other users stumbling upon this question.
    – UbuntuDane
    Commented May 2, 2017 at 16:02
6

I don't think you got infected (might be wrong). I ran virustotal scan on the windows exe, tar.gz and .deb, and all results were clean.

Virustotal scan result Virustotal Scan Results: exe, deb, tar.gz.

But, if you are infected, unfortunately there's no other way except reinstalling to be completely sure you're clean.

If that's not an option, run a thorough virus check with ClamAV.

After that, scan your pc for rootkits, see this guide.

If you're curious, open the tar.gz, there you'll find an install.sh file, open it with gedit and try breaking it down. You'll find the paths where the installer copied the files.

Happy Hunting.

Improve this answer
2
  • In the end I decided to reinstall my system as it's only a few days old. However I still opted to highlighting the answer using virustotal since that's the most throughough. This is the solution for other users who don't want to lose their data with a much older system.
    – UbuntuDane
    Commented May 2, 2017 at 16:06
  • Good answer but why not simply add the installation path to it? There may be people wondering if they have done something stupid, not knowing where to look.
    – Jos
    Commented May 2, 2017 at 16:08
1

You can not be sure your AV found it all, but is likely it did. Do not panic yet. You ran AV scan which is the right thing. Run the AV few times. If the computer starts behave strangely than sadly you may have to reinstall. Before you reinstall OS and programs, you will want to save your data files. Now for the really bad news. Even if you reinstall the OS and all you programs, the infection may be hiding inside the data. So after reinstall you would get the same thing back. On the other hand, you may be lucky and the infection was hiding in the OS. And that means reinstalling OS will solve your problem.

Improve this answer
2
  • 4
    I fail to see the purpose of running the antivirus a few times on the same set of files. Did you mean to suggest using a different antivirus?
    – Dmitry Grigoryev
    Commented May 2, 2017 at 11:39
  • I'm choosing to reinstall the OS. Luckily I have no data whatsoever that needs salvaging since my installation is only a few days old. Anyone that sees this question and wants a fix, look to the answer refering to virustotal as that's a far longer guide to how to fix this problem.
    – UbuntuDane
    Commented May 2, 2017 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .