main

main@lists.alug.org.uk

10353 discussions

Re: Trojans....
by Peter Berrie 23 Oct '23

23 Oct '23

This gets even more puzzling. Running clamav now for about two days non stop (lots of timeouts) and I am getting many reports like this: LibClamAV info: Suspicious link found! LibClamAV info: Real URL: http://www.globalkap.com LibClamAV info: Display URL: https://secure.skype.com But I can't tell where its finding those links, and don't recall ever visiting them anyway. I am now going through and checking some of them, and often not finding anything odd about them except that the name of the url is different from where the link ends up. And often the Real URL seems to be in the name of a real entity, but one that does not own the domain linked to! For instance another reported suspicious link, new.egg.com, takes me to Yorkshire Building Society, and seems like the real site of YBS. This is apparently due to YBS having taken over Egg. This really was different, though legit. But globalkap, the Real URL doesn't go anywhere, the Display goes to skype login, as you would expect. And globalkap seems to be a variety of real entities, a pool vendor in Aix en Provence, or a salesforce automation outfit somewhere! Another one is equally weird: LibClamAV info: Suspicious link found! LibClamAV info: Real URL: http://smitherfamilykitchen.com LibClamAV info: Display URL: http://www.lloydstsb.com But actually the display URL doesn't go to what clamav thinks is the real one, but goes to LLoyds TSB as it should. Not that I ever recall having visited them! Then when I try to go to smitherfamilykitchen.com (either just http:// or http://www.) its showing Server Not Found. But SmitherFamilyKitchen seems to be a real place selling hot sauces, based in Texas! Though it apparently (oddly) does not have that domain, and I don't recall having ever heard of it before this. But why is it claiming that the display URL is different from the real one? It does not seem to be. The most unhelpful thing about clamav, at least run like this, is that it reports suspicion, but gives you no idea what to do about it, and if I wanted to delete these suspicious URLs I have no idea where to find them! Are they in bookmarks someplace? Or history? Who knows? Anyone have any ideas what to do? Is there any more useful AV to try? Peter On Fri, 20 Oct 2023 14:57:34 +0100 Peter Berrie <peter.northerly(a)gmail.com> wrote: > On Fri, 20 Oct 2023 12:00:02 +0100 > main-request(a)lists.alug.org.uk wrote: > > Adam, > > Thanks for replying! > > > Have you ever saved or copied a browser cache onto this stick? > > No, this is the puzzling thing. I only seem to recall having used it on Debian. I've only used it to put some files on it which I then accessed from my laptop, which is also Debian. So I cannot think where these can have come from. I am wondering if possibly they were on the stick itself when I bought it. > > They are not going to be able to do anything in Linux, are they? > > I have also checked online and found a couple of similar trojans which MS AV says it detects, so they sound like Windows trojans. > > I am thinking now of having clamav run all night on my total Debian hard drive, in recursive mode. That ought to detect them, do you think, if they are on it? Is there anything else you would do? > > My laptop is dual boot, windows and Debian, so I will boot to windows and then run the MS AV in windows. I suppose run ClamAV in Debian after that. > > What a pain. But in Windows it would probably be a lot more than just a pain. > > Peter main-owner(a)lists.alug.org.uk > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of main digest..."

2 1

Recommended Webcam?
by Steve Mynott 21 Oct '23

21 Oct '23

I've been successfully using a Asus cloudbook running "motion" from the Debian repos https://motion-project.github.io/ to detect motion, record and push video of the cat at her bowl while we've been on holiday but the internal webcam isn't that great. So I've basically solved the software problem but I'm looking at a better external USB (?) webcam Most of the commercial webcams I've seen seem to push people into expensive subscriptions which I don't care about but does anyone have recommendations for cheap, good quality webcams? It would be ideal to be being able to move it remotely and maybe start using it as a more general security cam? -- Steve Mynott <steve.mynott(a)gmail.com> rsa3072/629FBB91565E591955B5876A79CEFAA4450EBD50

2 1

installing Linux over Windows
by Bev Nicolson 20 Oct '23

20 Oct '23

I have done this before but I think I may need a little help. Finally got round to wresting the info from my old laptop. (Note that if the keyboard is stuffed, clicking on the human figure on the top right of the screen brings up an on-screen keyboard. You probably know this, but I pass it on anyway.) But to the point of this email. Stuck the usb drive in which has Mint on it and powered the laptop up. Clicked on ESC as it said that would bring the boot menu up. It did not. Not fast enough? What speed should I aim for next time? I found out how to shutdown before it got me all the way through the Windows set up so that's something. Thanks in advance. Bev.

4 8

Trojans....
by Peter 19 Oct '23

19 Oct '23

I took some files today to a local print shop on a usb stick to get them printed. They have the very sensible procedure that, when given files on a stick, they first insert the stick into a laptop which is not on their network, and scan it. The stick is a Maxell FAT32, and my systems are Debian 11. To my horror they came back and said it had trojans! There were two phishbank.ajy JSI:trojan.cryos.3892 This last had three copies installed, the first only one. I'm pretty confident these are not false positives, they get their systems and network from a very competent IT shop. I don't know what AV they use. They are a windows shop of course, so it will be one of the usual windows AV products. So I am pretty sure these trojans were the real thing. They asked what did I want to do. Leave them alone, delete them? I said delete, after making a note of what they were. At the moment I am downloading and installing clamav for my Debian installation. I did a scan of the Windows 10 VM that I have running in Virtual Box, using the MS antivirus that comes with Windows, and it came up clean. I'm also proposing to insert the stick, hopefully now disinfected, into my Debian system, copy a few files to and fro, and go back to the shop to see if it has got itself reninfected from Debian. Unlikely, but it seems like a useful precaution. Should I be worried, and what else should I do? Be grateful for any thoughts. The only other thing about my Debian machine that I've noticed lately is that on one Wordpress site I sometimes get a 429 too many requests error, in Firefox. This happens on first clicking on a link on the site or first visiting it, so there has not in fact been more than one request. Don't see how that could be related but thought it best to mention, just in case. Peter

2 1

Using testdisk to fix a corrupt thumb drive
by Mark Rogers 12 Oct '23

12 Oct '23

I have a thumb drive which is formatted to FAT32 but not recognized in Windows. Using "testdisk" I can find the partition OK, but testdisk reports: Disk /dev/sdc - 30 GB / 28 GiB - CHS 29327 64 32 Current partition structure: Partition Start End Size in sectors Warning: number of heads/cylinder mismatches 255 (FAT) != 64 (HD) Warning: number of sectors per track mismatches 63 (FAT) != 32 (HD) 1 * FAT32 LBA 0 1 1 29327 63 32 60063712 [DATADISC] If I select the partition and view files then i see what I expect to see, and I can manually copy off individual files from there. So from a data recovery perspective I have everything I need. However, if I try writing the partition information back using testdisk the thumb drive is still not recognised in Windows and if I reopen it in testdisk it reports the same issues. I tried changing geometry to 255/63 as testdisk suggested, but then analyse says "Bad relative sector". What do I need to do so that the disk is recognised in Windows? Mark -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0344 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

2 1

Re: Weird freezes in Firefox
by Phil Ashby 11 Sep '23

11 Sep '23

On 11/09/2023 12:00, Peter<peter.northerly(a)gmail.com> wrote: > > Any ideas what this could be? Its happened a couple of times. > > I will be doing something perfectly ordinary in Firefox, like > shopping on Amazon was the last one. All of a sudden the mouse > cursor, as I move the mouse, turns into a broad black stream, which > makes a trail a half inch or so wide, quite jagged. Stays in place as > the mouse is moved on. In and out of the browser window. Its > impossible to close the window. More clicking brings up partial > truncated small windows. Right clicks have no effect. That sounds like the display output is frozen apart from a hardware mouse cursor. You should (hopefully) have something in an Xorg.log file (after a restart!) to help identify if the X server itself has died, or if Firefox has exclusively grabbed the screen then hung. As this only occurs with Firefox, then my hunch would be the latter. > The only thing I could find to do to get out of it was reboot. You could try Ctrl-Alt-Backspace (the default X server terminate 3-key-salute). If it's Firefox that has a problem you may get your login screen back. I have also used the magic SysReq keys (https://en.wikipedia.org/wiki/Magic_SysRq_key) to sync disk blocks then reboot which might get you more useful log file contents... > This is Debian 11, fluxbox, using the Nvidia drivers for their card. > Never happened with any other app, including not with any other > browser. Doesn't happen often, maybe three or four times over > several months. Another thing to try then: the nouveau drivers, although you will likely lose some performance depending on your particular card. > I shall be upgrading to Debian 12 fairly soon, so maybe that will > make it go away. But what could it be? And what would you do, other > than upgrading? I made the switch to 12 (bookworm) a couple of months back - all ok so far running sway atop Wayland with or without Xwayland support for older X11 apps (apart from Java, but that's another story entirely*) Good luck! Phil. * https://www.ashbysoft.com/articles/swingland/

1 0

Weird freezes in Firefox
by Peter 11 Sep '23

11 Sep '23

Any ideas what this could be? Its happened a couple of times. I will be doing something perfectly ordinary in Firefox, like shopping on Amazon was the last one. All of a sudden the mouse cursor, as I move the mouse, turns into a broad black stream, which makes a trail a half inch or so wide, quite jagged. Stays in place as the mouse is moved on. In and out of the browser window. Its impossible to close the window. More clicking brings up partial truncated small windows. Right clicks have no effect. The only thing I could find to do to get out of it was reboot. This is Debian 11, fluxbox, using the Nvidia drivers for their card. Never happened with any other app, including not with any other browser. Doesn't happen often, maybe three or four times over several months. I shall be upgrading to Debian 12 fairly soon, so maybe that will make it go away. But what could it be? And what would you do, other than upgrading? Peter

1 0

Nextcloud upload and share from commandline
by Mark Rogers 11 Aug '23

11 Aug '23

Any nextcloud users here who are familiar with the API? All i want to do is have a script which uploads a file to my nextcloud server, creates a read-only share link for it, and outputs that link. So when I have a file that's too big or otherwise unsuitable for email, I can simply push it to nextcloud and paste the supplied link into my email instead. This seems like a fairly obvious use case but my attempts at Googling a solution have thus far failed me. Uploading a file from a script is easy and there are plenty of examples out there but creating a share link from that point has me (and ChatGPT, and Google Bard) stumped. Mark -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0344 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

2 2

MPC playback or file converter
by BD 26 Jun '23

26 Jun '23

Hi So I have this headless Debian machine serving miniDLNA on my network. There's good few hundred GB files in its library but I have a problematic bunch too. A very old cache of mpc files that don't want to play. Does anyone have a way to either force miniDLNA to transcode the files on the fly or to convert those file in place (preferably retaining files structure). Cheers, Bart

2 1

Viewing Quick Time videos on Linux?
by Bev Nicolson 24 Jun '23

24 Jun '23

I have two dvd's that use Quick Time. (Yes, they are rather old.) I wondered if there was any way of viewing them? Is there an alternative QT that could help here? Or would it depend solely of finding someone using Windows or Apple? Bev

4 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

main