Hi, I have/had malware that was opening a system window and asking to "active" a link to "live Science" when I used the Network Manager to connect to the internet. I don't have it set to automatic. It would pop up after the Network Managers window of 'network is up' appeared.

I ran clamav and it did not find anything. Intuitively I wanted to remove and reinstall Firefox and there was a new version so I did this. The windows do not appear now.

My question is what program opens up System Windows (dialog boxes) so I can better track down the malware if clam misses it?

Thanks for your expertise!

It sounds like it might have been a Firefox add-on or similar that caused the dialog to pop up.

To my understanding it's either your desktop environment/window manager or X itself, that can bring up dialog boxes. And of course, applications themselves may have different dialog boxes they bring up depending on what's going on with it.

You could look at using a different antivirus program - but I would not recommend using more than one though. You can also use https://www.virustotal.com/#/home/upload to scan any suspect files.

There are several free antivirus programs available.

And: also in the browser cache can virus/malware be installed.

https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx

Use
as debug tool

https://www.makeuseof.com/tag/how-to...onfig-utility/

This issue is with Mageia.

was the browser running when the popups came?

I too think it is a browser popup.

Install hosts file from http://winhelp2002.mvps.org/hosts.htm maybe or other that slows down the internet creeps.

I kind of doubt your system is in any danger as long as you are not running as root.

Might run wireshark to see what ip addresses or domain names show up on this.

There ways to increase firewall or iptables or white/black lists too.

Sorry, I took "windows" in subject literally.
Version?

1

Opera and Firefox were open.

I opened one of these links after Firefox warned that it was infecting computers and did the "I know the risks" routine. I really wanted to look at the material and I'm using linux so what the hell.
http://www.mytreelessons.com/Drawing...20Thoughts.htm

It could also be consequential and not have anything to do with MyTreeLessons.

I'm quite sure it was a system window and asked if I wanted to 'activate the link' after giving the headline of the webpage and it was always "live Science". It's a nice website by the way.

I'm actually running Mageia 4. I intalled 6 on a laptop and it was the worst mandrake fork I had ever used so updating got put on the back burner for my usual desktop computer. I thought I had a 32 bit system etcetera, but I'm going to try to see if Mageia 6 64bit is okay on this desktop before I bite the bullet and switch over to Fedora or Centos again.

I know I need to get more involved with computer security but I have some other pressing needs to take care of first. Right now I can only react and not be proactive like I should be. I have clam ,wireshark and a few others on this install but I really don't know enough about them to be of intentional use. I would be relying on mostly luck in other words.

yes, the spammers/mal/spywarehackers do their best to make it look "genuine".
from your description, i think it's safe to assume it's a bad browser addon or some such.
just create a new profile, and dlete the old one, and be more careful in the future.
don't allow javascript by default, clean out local files after closing the browser, and of course don't install fishy addons.

"I opened one of these links after Firefox warned that it was infecting computers" '


Sometimes firefox and others may legitimately warn users of a compromised web site. You should heed that warning and not proceed .....ever.....!

Many times the popups are as fake as the news.

i wouldn't go that far.

it is well possible to safely traverse the web without depending on yet another google product (the lists of "potentially harmful" sites).

and not every site with an outdated security cert is even potentially harmful.

The browser "let this happen" so clearing/cleaning the cache and/or profile now and then is pretty common.
Tested backups are suggested as recovery methodology

The "malware" is whatever you were doing at the time, plus Internet.
If you believe the system infected, here's a basic diagnostic technique:
Create a new (unprivilged first...) user on the system.
Log in as the new user. Passive monitoring of the new user... meaning, just use it for a few...no scan, no diagnostics, just use it. Waiting for confirmation via a (dialog boxes)?
Do NOT go back to the site or sites that instigated this.

and tell us how you "ran clamav" exactly.
ClamTK. c-line....?
Change any options before you scanned? PUA? Scan / ?
Yeah, don't as the new user.

I ran 'clamscan -i -e'.