[SOLVED] Ubuntu Remote Access Trojan

whois1230 · 03-28-2021, 01:55 PM

Quote:

Originally Posted by uteck

I did not see any mention of the laptop model.

I know my touchpad is a bit touchy. (could not resist pun) It shows up by default as normal mouse so I cannot enable palm detection to stop the mouse from moving while typing, but when I change the drive to synapics the performance goes down and I lose some of the options. So I am getting used to typing and not resting my palms on the laptop.

I suspect it is the touchpad driver that is causing the OP problems. I also find it odd that he has Kali installed, but has not booted into it and used it to scan the offending machine. That is part of what it is for, is it not?

Lenovo-ideapad-110-17IKB
Memory: 8GB
Processor: Intel Core i3-7100U CPU @ 2.40Ghz x 4
Graphics: Intel HD Graphics 620(KBL GT2)
Graphics adapter: AMD Radeon R5 M430 - 2048 MB, Core: 955 MHz, Memory: 873 MHz, DDR3, Crimson 16.12.1, Enduro
GNOME: 3.28.2
OS type: 64-bit
Disk: 1 TB

Thank you for noticing that I have Kali but didn't use it. I will do that and post an update once I am finished

whois1230 · 03-28-2021, 02:21 PM

I tried to install ClamAV on Kali but failed. This is what happened:

Code:

	root@user:~# apt-get upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@user:~# apt-get update
Get:1 http://ftp.halifax.rwth-aachen.de/kali kali-rolling InRelease [30.5 kB]
Err:1 http://ftp.halifax.rwth-aachen.de/kali kali-rolling InRelease
  The following signatures were invalid: EXPKEYSIG ED444FF07D8D0BF6 Kali Linux Repository <devel@kali.org>
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://ftp.halifax.rwth-aachen.de/kali kali-rolling InRelease: The following signatures were invalid: EXPKEYSIG ED444FF07D8D0BF6 Kali Linux Repository <devel@kali.org>
W: Failed to fetch http://http.kali.org/kali/dists/kali-rolling/InRelease  The following signatures were invalid: EXPKEYSIG ED444FF07D8D0BF6 Kali Linux Repository <devel@kali.org>
W: Some index files failed to download. They have been ignored, or old ones used instead.
root@user:~# apt-get install clamav -y
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  clamav-base clamav-freshclam libclamav7 libtfm1
Suggested packages:
  clamav-docs libclamunrar7
The following NEW packages will be installed:
  clamav clamav-base clamav-freshclam libclamav7 libtfm1
0 upgraded, 5 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,225 kB/1,285 kB of archives.
After this operation, 3,595 kB of additional disk space will be used.
Err:1 http://http.kali.org/kali kali-rolling/main amd64 clamav-base all 0.100.2+dfsg-2
  404  Not Found [IP: 192.99.200.113 80]
Err:2 http://http.kali.org/kali kali-rolling/main amd64 libclamav7 amd64 0.100.2+dfsg-2
  404  Not Found [IP: 192.99.200.113 80]
Err:3 http://http.kali.org/kali kali-rolling/main amd64 clamav-freshclam amd64 0.100.2+dfsg-2
  404  Not Found [IP: 192.99.200.113 80]
Err:4 http://http.kali.org/kali kali-rolling/main amd64 clamav amd64 0.100.2+dfsg-2
  404  Not Found [IP: 192.99.200.113 80]
E: Failed to fetch http://http.kali.org/kali/pool/main/c/clamav/clamav-base_0.100.2+dfsg-2_all.deb  404  Not Found [IP: 192.99.200.113 80]
E: Failed to fetch http://http.kali.org/kali/pool/main/c/clamav/libclamav7_0.100.2+dfsg-2_amd64.deb  404  Not Found [IP: 192.99.200.113 80]
E: Failed to fetch http://http.kali.org/kali/pool/main/c/clamav/clamav-freshclam_0.100.2+dfsg-2_amd64.deb  404  Not Found [IP: 192.99.200.113 80]
E: Failed to fetch http://http.kali.org/kali/pool/main/c/clamav/clamav_0.100.2+dfsg-2_amd64.deb  404  Not Found [IP: 192.99.200.113 80]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
root@user:~#

Linux_Kidd · 03-28-2021, 06:58 PM

Installing?

Boot a liveCD already and be done with it.

TB0ne · 03-29-2021, 07:52 AM

Quote:

Originally Posted by whois1230

I tried to install ClamAV on Kali but failed. This is what happened:

Code:

	root@user:~# apt-get upgrade
E: Failed to fetch http://http.kali.org/kali/pool/main/c/clamav/clamav-freshclam_0.100.2+dfsg-2_amd64.deb  404  Not Found [IP: 192.99.200.113 80]
E: Failed to fetch http://http.kali.org/kali/pool/main/c/clamav/clamav_0.100.2+dfsg-2_amd64.deb  404  Not Found [IP: 192.99.200.113 80]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
root@user:~#

You are still missing the point, and don't appear to be reading/understanding what you're being told. First, the 'failure' is simple; it can't find the link to install clamav. It's a website...did you try putting that into a browser? Or running the command it gave you???

Second, you have FOUR OS'es on that system....tell us which is more likely:

You have a 'virus/malware' that (SOMEHOW) affects all your OS'es at once...in the same way...even though the separate systems don't know about each other when one is operational.
You have a flaky touchpad hardware.

whois1230 · 03-31-2021, 05:23 AM

Quote:

Originally Posted by TB0ne

You are still missing the point, and don't appear to be reading/understanding what you're being told. First, the 'failure' is simple; it can't find the link to install clamav. It's a website...did you try putting that into a browser? Or running the command it gave you???

Second, you have FOUR OS'es on that system....tell us which is more likely:

You have a 'virus/malware' that (SOMEHOW) affects all your OS'es at once...in the same way...even though the separate systems don't know about each other when one is operational.
You have a flaky touchpad hardware.

I ran Dr. Web Live Disk and it found 348 Threats including Trojans. I don't know how to access the log file, but I took some photos. It scanned for nearly 24 hours and I stopped the scan before it finished.

whois1230 · 03-31-2021, 05:25 AM

More photos

whois1230 · 03-31-2021, 05:26 AM

And some more

whois1230 · 04-05-2021, 07:07 AM

After finding multiple viruses on Ubuntu, using Dr. Web Live Disk, Kaspersky Rescue Disk and ESET Nod32 Live Disk, I wiped out all the linux distros and only left Windows 10, which I barely use these days. Kali and Fedora were not infected, but I wiped them out any way. Now I scanned with Dr. Web and Kaspersky and both came out clean. I have no idea how Ubuntu got infected. I will re-scan in 1 week to be sure. I installed Ubuntu Desktop 20.04 Focal Fossa and now have a dual boot system with Windows 10.

whois1230 · 04-14-2021, 01:20 PM

I believe I have the answer to my question. I had Kali Linux installed, even though I was told not to install it, but to run it in live mode instead. The rescue disk antivirus programs I used detected false positives, because of Kali. I downloaded Kali installer on Windows 10 from the original website and Windows Defender found 4 threats in the .iso .To confirm this, I will install Kali again and scan again.

sundialsvcs · 04-14-2021, 04:31 PM

I have utterly no use for "antivirus software." Period.

whois1230 · 04-15-2021, 12:17 PM

Ok so I installed Kali again and scanned with Kaspersky rescue disk. It found 840 "Threats". False positive confirmed. I believe I have a hardware problem and I will continue the thread here: https://www.linuxquestions.org/quest...82#post6238682 Marking this one as SOLVED.