LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (http://www.linuxquestions.org/questions/linux-security-4/)
-   -   Gmail and winnow.compromised.ts.jsexploit.5.UNOFFICIAL malware (http://www.linuxquestions.org/questions/linux-security-4/gmail-and-winnow-compromised-ts-jsexploit-5-unofficial-malware-807389/)

lahqash 04-26-2010 07:12 PM

winnow.compromised.ts.jsexploit.5.UNOFFICIAL and winnow.spam.ts.domains.158.UNOFFICIA
 
Hello, this is the second time clamav detects the malware on my laptop under ubuntu:
winnow.compromised.ts.jsexploit.5.UNOFFICIAL
winnow.spam.ts.domains.158.UNOFFICIAL
gspace.js: winnow.malware.cm.miscspam.387929.UNOFFICIAL
what does this mean, is it serious and what is the origin of this infection?

paulsm4 04-26-2010 10:03 PM

It probably means you've been exchanging Microsoft Word files with someone who's Windows PC has been infected ;)

The good news is that Windows malware probably won't affect your Linux system.

It should also be pretty easy to identify the offending .doc or .docx files, delete them (or at least copy them off to USB or some other safe, external media), and see if ClamAv stops reporting warnings.

lahqash 04-27-2010 08:24 PM

thanks

lahqash 05-12-2010 08:02 AM

The problem reappears every time I open Gmail.
Whenever I scan my laptop after having opened Gmail clamav detect this file:
winnow.compromised.ts.jsexploit.5.UNOFFICIAL
So what does that mean?

lahqash 05-12-2010 10:20 AM

Gmail and winnow.compromised.ts.jsexploit.5.UNOFFICIAL malware
 
Whenever I scan my laptop after having opened Gmail Clamav detect this file in the cache of firefox:
winnow.compromised.ts.jsexploit.5.UNOFFICIAL
What does that mean?
Is it serious?
THANKS

TB0ne 05-12-2010 10:34 AM

Quote:

Originally Posted by lahqash (Post 3965834)
Whenever I scan my laptop after having opened Gmail Clamav detect this file in the cache of firefox:
winnow.compromised.ts.jsexploit.5.UNOFFICIAL
What does that mean?
Is it serious?
THANKS

It means that Clamav found a virus/exploit script. Either clean it or delete it.

What version/distro of Linux are you using?

unSpawn 05-12-2010 10:42 AM

Quote:

Originally Posted by lahqash (Post 3948674)
this is the second time

Creating two threads for the same topic is not useful or necessary: threads merged.

lahqash 05-12-2010 04:20 PM

OK
Tank you
I use ubuntu 10.04
This problem is persistent, and it is bound to gmail
I delete the virus, but it reappears when I open gmail on firefox or on prism

craigevil 05-12-2010 04:32 PM

Try clearing the Firefox cache and cookies. Might want to use NoScript to block unneeded scripts as well.

I use Gmail all the time have never seen this.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.4) Gecko/20100503 Firefox/3.6.4

lahqash 05-13-2010 05:45 AM

with NoScript I can not acces to Gmail in standard view; only basic html view is available


All times are GMT -5. The time now is 08:03 PM.