LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 05-12-2014, 02:35 PM   #1
Mr. Alex
Senior Member
 
Registered: May 2010
Distribution: No more Linux. Done with it.
Posts: 1,238

Rep: Reputation: Disabled
Finding Windows malware on thumb drives in Linux


Hi all! If I connect some USB thumb drive to Windows machine and there is malware which copies itself to this thumb drive automatically and hides itself from Windows browsing, will I be able to see file of infection if I connect this drive to Linux machine and browse files? So that I can take a look at contents of a thumb drive in Linux and say "There are no Windows viruses for sure; safe to use in Windows".
 
Old 05-12-2014, 03:21 PM   #2
bigrigdriver
LQ Addict
 
Registered: Jul 2002
Location: East Centra Illinois, USA
Distribution: Debian stable
Posts: 5,908

Rep: Reputation: 356Reputation: 356Reputation: 356Reputation: 356
If you have antivirus installed on you Linux machine (such as clamav, avast, or others), you can plug in the thumb drive and mount it. Then run the scan app to scan the thumb drive for malware.
 
Old 05-12-2014, 06:21 PM   #3
jefro
Moderator
 
Registered: Mar 2008
Posts: 21,987

Rep: Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626Reputation: 3626
Make a folder called autorun.inf
 
Old 05-12-2014, 08:04 PM   #4
lleb
Senior Member
 
Registered: Dec 2005
Location: Florida
Distribution: CentOS/Fedora/Pop!_OS
Posts: 2,983

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
Quote:
Originally Posted by Mr. Alex View Post
Hi all! If I connect some USB thumb drive to Windows machine and there is malware which copies itself to this thumb drive automatically and hides itself from Windows browsing, will I be able to see file of infection if I connect this drive to Linux machine and browse files? So that I can take a look at contents of a thumb drive in Linux and say "There are no Windows viruses for sure; safe to use in Windows".
maybe. as good as clamAV and f-prot are for Linux, they are falling behind in detecting many of the MS junk that is out there. but if the file is hidden from MS, it should be visible with a simple
Code:
ls -laF
command.
 
Old 05-14-2014, 08:54 AM   #5
Mr. Alex
Senior Member
 
Registered: May 2010
Distribution: No more Linux. Done with it.
Posts: 1,238

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by bigrigdriver View Post
If you have antivirus installed on you Linux machine (such as clamav, avast, or others), you can plug in the thumb drive and mount it. Then run the scan app to scan the thumb drive for malware.
I wasn't talking about antivirus. Only about finding malware myself. For example if I have only mp3 files on a thumb drive, will malware be another non-mp3 file that is visible in Linux?

Quote:
Originally Posted by jefro View Post
Make a folder called autorun.inf
What for?

Quote:
Originally Posted by lleb View Post
maybe.
You're not sure? What is it that might not work?
 
Old 05-14-2014, 04:21 PM   #6
suicidaleggroll
LQ Guru
 
Registered: Nov 2010
Location: Colorado
Distribution: OpenSUSE, CentOS
Posts: 5,573

Rep: Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142
Quote:
Originally Posted by Mr. Alex View Post
I wasn't talking about antivirus. Only about finding malware myself. For example if I have only mp3 files on a thumb drive, will malware be another non-mp3 file that is visible in Linux?
99.9% of the time, malware and virii are embedded in seemingly innocent files. You can't just look at directory listing and go "yep, this one is a malware file", you actually have to scan through every single file on the drive, byte by byte, looking for hidden malware inside.
 
1 members found this post helpful.
Old 05-14-2014, 04:32 PM   #7
lleb
Senior Member
 
Registered: Dec 2005
Location: Florida
Distribution: CentOS/Fedora/Pop!_OS
Posts: 2,983

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
maybe, it all depends on the type of malware and if the Linux anti-virus is going to scan for malware. they are not the same and thus are not scanned the same way. this is why in the MS world you have to run both some type of anti-malware and anti-virus program to minimize infection of the system.
 
Old 05-14-2014, 05:01 PM   #8
linuzfreak
LQ Newbie
 
Registered: Apr 2014
Posts: 21

Rep: Reputation: Disabled
It's hard to know for sure if antivirus and malware programs can cut the mustard these days especially in a windows environment.

An interesting article from Symantec:
Symantec Says “Antivirus Software Is Dead”, But What Does That Mean For You?
 
Old 05-14-2014, 05:05 PM   #9
metaschima
Senior Member
 
Registered: Dec 2013
Distribution: Slackware
Posts: 1,982

Rep: Reputation: 492Reputation: 492Reputation: 492Reputation: 492Reputation: 492
It depends on the malware itself. In many cases you should be able to detect it either manually or with a virus scanner. Note that auto-run based viruses do exist for Linux too.

Personally, I don't use USB sticks at all. Yeah I guess I am super paranoid, but I figure there are better ways to distribute data nowadays anyway.
 
Old 05-14-2014, 05:23 PM   #10
linuzfreak
LQ Newbie
 
Registered: Apr 2014
Posts: 21

Rep: Reputation: Disabled
Quote:
Originally Posted by metaschima View Post
It depends on the malware itself. In many cases you should be able to detect it either manually or with a virus scanner. Note that auto-run based viruses do exist for Linux too.

Personally, I don't use USB sticks at all. Yeah I guess I am super paranoid, but I figure there are better ways to distribute data nowadays anyway.
If I'm not sure about a USB stick, I would connect to a test PC or junk computer and disconnect any ethernet cables on it.
 
1 members found this post helpful.
Old 05-15-2014, 12:22 PM   #11
Mr. Alex
Senior Member
 
Registered: May 2010
Distribution: No more Linux. Done with it.
Posts: 1,238

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by metaschima View Post
Note that auto-run based viruses do exist for Linux too.
What can they do to a system if run by user (not root)?

Quote:
Originally Posted by metaschima View Post
Personally, I don't use USB sticks at all. Yeah I guess I am super paranoid
It's OK to care about your security even if some people call it "too paranoid".

Quote:
Originally Posted by metaschima View Post
there are better ways to distribute data nowadays anyway.
Like what?
 
Old 05-15-2014, 12:27 PM   #12
Emerson
LQ Sage
 
Registered: Nov 2004
Location: Saint Amant, Acadiana
Distribution: Gentoo ~amd64
Posts: 7,661

Rep: Reputation: Disabled
If you read the news only 45% of Windows malware can be detected nowadays. This is the fate of an operating system that has thousands of security holes with thousands of viruses written for every hole. Cars without brakes are illegal on public highways, why are Windows computers allowed to connect to the internet?
 
Old 05-15-2014, 12:42 PM   #13
Mr. Alex
Senior Member
 
Registered: May 2010
Distribution: No more Linux. Done with it.
Posts: 1,238

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Emerson View Post
If you read the news only 45% of Windows malware can be detected nowadays. This is the fate of an operating system that has thousands of security holes with thousands of viruses written for every hole.
I think it's more about the architecture, than about specific security holes.

Quote:
Originally Posted by Emerson View Post
Cars without brakes are illegal on public highways, why are Windows computers allowed to connect to the internet?
Because the law doesn't protect those who are right and prosecute those who are wrong. The law is a tool used by people and people are foul.
 
Old 05-15-2014, 01:20 PM   #14
Emerson
LQ Sage
 
Registered: Nov 2004
Location: Saint Amant, Acadiana
Distribution: Gentoo ~amd64
Posts: 7,661

Rep: Reputation: Disabled
Quote:
Originally Posted by Mr. Alex View Post
I think it's more about the architecture, than about specific security holes.
Nope. Lots of people not very familiar with computers think virus is something that comes and gets you, as you get flu. Not true for computers, to write a successful virus you need to exploit a vulnerability in target system. No security holes = no viruses.
 
Old 05-15-2014, 02:32 PM   #15
metaschima
Senior Member
 
Registered: Dec 2013
Distribution: Slackware
Posts: 1,982

Rep: Reputation: 492Reputation: 492Reputation: 492Reputation: 492Reputation: 492
Quote:
Originally Posted by Mr. Alex View Post
What can they do to a system if run by user (not root)?

It's OK to care about your security even if some people call it "too paranoid".

Like what?
They can usually only do what the user can do, but if it contains a keylogger or kernel exploit it can gain root access reasonably easily.

File sharing servers, and there are plenty of them. Some call themselves "cloud", but file sharing servers have existed long before the "cloud". For smaller sized sharing, you can use e-mail. There's usually a 20-50 MB limit on e-mails.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows malware and Linux in dualboot Mr. Alex Linux - Security 2 07-05-2012 04:33 PM
Unable To Use Thumb Drives carlosinfl Debian 2 12-15-2008 03:01 PM
Formatting Flash drives / thumb drives lawrence_lee_lee Linux - Software 3 06-12-2008 02:28 AM
newbie:finding my windows hard drives jamil_1 Linux - Newbie 17 03-12-2007 06:45 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 03:27 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration