-1
/usr/share/doc/libusb-1.0-doc/html/jquery.js                        PUA.Html.Exploit.CVE_2014_0322-1     
/usr/lib/libreoffice/presets/basic/Standard/Module1.xba             PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/ImportWizard/Language.xba          PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/ImportWizard/Main.xba              PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/ImportWizard/FilesModul.xba        PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Template/Autotext.xba              PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Template/ModuleAgenda.xba          PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Template/Correspondence.xba        PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Template/Samples.xba               PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Gimmicks/GetTexts.xba              PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Gimmicks/ReadDir.xba               PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Gimmicks/ChangeAllChars.xba        PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tutorials/TutorialCreator.xba      PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Gimmicks/AutoText.xba              PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Gimmicks/Userfields.xba            PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/FormWizard/Layouter.xba            PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/FormWizard/tools.xba               PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/FormWizard/DBMeta.xba              PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/FormWizard/FormWizard.xba          PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/FormWizard/develop.xba             PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/FormWizard/Language.xba            PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_it.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Internet.xba                 PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tutorials/TutorialClose.xba        PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/tools.xba                    PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Depot.xba                    PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_de.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_ja.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_ko.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_zh.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/CommonLang.xba               PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_en.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Currency.xba                 PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_sv.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tutorials/Functions.xba            PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_tw.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_fr.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Depot/Lang_es.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Euro/Common.xba                    PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Euro/AutoPilotRun.xba              PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Euro/Init.xba                      PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Euro/Hard.xba                      PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Euro/Protect.xba                   PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Euro/Soft.xba                      PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Euro/Writer.xba                    PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tutorials/TutorialOpen.xba         PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Euro/ConvertRun.xba                PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tools/ModuleControls.xba           PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tools/Listbox.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tools/Strings.xba                  PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tools/UCB.xba                      PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tools/Debug.xba                    PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tools/Misc.xba                     PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tutorials/RoadMap.xba              PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/Tutorials/ShowInfoDialog.xba       PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/ImportWizard/DialogModul.xba       PUA.Doc.Tool.LibreOfficeMacro-2      
/usr/lib/libreoffice/share/basic/ImportWizard/API.xba               PUA.Doc.Tool.LibreOfficeMacro-2   

closed as unclear what you're asking by mikewhatever, David Foerster, waltinator, ravery, RobotHumans Dec 28 '17 at 14:59

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Yes. They're discovered as LibreOffice Macros. Macros may pose a security risk, as all other software, but these are distributed as part of the installation, and is vetted by the creators of LibreOffice. – vidarlo Dec 22 '17 at 19:37
  • 2
    It is not possible for us to determine, you have to investigate the files. They are probably just fine, but, we can not make a determination unless we know the files themselves are unchanged from original installation. – Panther Dec 22 '17 at 23:13
  • @Zanna if you say so... – vidarlo Dec 22 '17 at 23:47
2

You really need some sort of HIDS system to run in conjunction with clamav.

clamav is notorious for "false positives" you you can easily find many posts throughout the internet testifying that these false positives can be ignored ....

BUT ...

Clamav has a mechanism to report false positives if you believe you have a false positive - https://www.clamav.net/reports/fp

Although ignoring false positives is a common practice, I will just add a little detail / caution / suggestions ...

You need to start with a known good system, such as a fresh install. You then install and configure some sort of HIDS (OSSEC , AIDE, ...) .

See http://opensourceforu.com/2017/04/best-open-source-network-intrusion-detection-tools/ or a google search for options.

You then run clamv and investigate false positives.

You can determine if a package installed a file, on a fresh install, you sort of have to assume that such files are clean. You do not have to make such an assumption, but then you enter a deep dark hole of paranoia and if you do not trust the ubuntu repositories you are sort of in for a lot of footwork out of the gate.

You verify a file with debsums

sudo debsums -ac

See or the debsums man page https://blog.sleeplessbeastie.eu/2015/03/02/how-to-verify-installed-packages/ for further details.

You then are starting with a known good system and you know what clamav reports with a clean , fresh install.

When you run clamav you can compare it to your fresh install via debsums and HIDS .

You update HIDS and your clamav list of known false positives after every update and package installation by confirming the debsums.

If you have an alert from clamav you look at the file history in HIDS and debsums to determine if the file is (still) intact / a false positive or if there has been an unexpected change to the files.

I fully understand what I am suggesting is very cumbersome, and many people do not do all these steps, but ...

If you are not going to investigate what clamav is guiding you to investigate, why run clamav at all ?

1

Yes. They're discovered as LibreOffice Macros. Macros may pose a security risk, as all other software, but these are distributed as part of the installation, and is vetted by the creators of LibreOffice.

A good thing to do when finding a file highlighted by clamav (or any other AV) is to google for what the AV engine finds.

  • 1
    And run at least debsums .... – Panther Dec 23 '17 at 4:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.