Linux Virus?

anon02 · 09-30-2011, 04:02 PM

Recently I was browsing the web on my netbook, and I clicked a link. It went to Encyclopedia Dramatica, and Epiphany said it downloaded a file called css.php. I thought this was just the website not set up correctly, but Geany opened the file. Since then, I deleted the file, ran chkrootkit, but I was wondering if anyone else knew about it.

I am using Ubuntu 11.04

MS3FGX · 09-30-2011, 04:28 PM

What makes you think it's a virus? More than likely just a poorly written website.

What did the css.php file contain?

frieza · 09-30-2011, 04:28 PM

it's probably just the website not set up correctly, php scripts can't run without a php interpreter even if you did manage to grab the code, and even so are unlikely to contain malicious payloads.

anon02 · 10-01-2011, 12:29 AM

Quote:

Originally Posted by MS3FGX

What makes you think it's a virus? More than likely just a poorly written website.

What did the css.php file contain?

Originally I was suspicious as Geany instantly opened it. When I get the PHP files off of my website to work on, it just saves them. It contained something like @FONTTYPE (Probably not FONTTYPE, something like it.) UTF-8

Quote:

Originally Posted by frieza

it's probably just the website not set up correctly, php scripts can't run without a php interpreter even if you did manage to grab the code, and even so are unlikely to contain malicious payloads.

Thanks for the reassurance. I think now that is was just a badly written website.

qlue · 10-01-2011, 01:15 AM

There's is a 'trick' used by some website designers that use the 'include' function in php to create dynamic css code. (for example, a different theme according to time of day or the season)
It sounds like your browser downloaded this file instead and, because it didn't know what else to do with it, it simply passed it on to the system's default text editor. (geany on your system)

anon02 · 10-01-2011, 02:10 AM

Quote:

Originally Posted by qlue

There's is a 'trick' used by some website designers that use the 'include' function in php to create dynamic css code. (for example, a different theme according to time of day or the season)
It sounds like your browser downloaded this file instead and, because it didn't know what else to do with it, it simply passed it on to the system's default text editor. (geany on your system)

Ah, thanks for the explanation. Geany isn't my systems default text editor, but it is default for PHP, C, and C++ files. That explains it, I think.