LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices


Reply
  Search this Thread
Old 04-04-2015, 10:33 PM   #1
paulb2
Member
 
Registered: Feb 2011
Location: Evansville, IN USA
Distribution: Slackware64 14.1(multilib) and Win7
Posts: 30

Rep: Reputation: 5
sx version 0.12.21rc - Is this malware?


On Slack64 14.1 multilib:

I have been using "sx" as an alias for "startxfce4" for several months with no problem. A couple days ago, when I typed "sx", I got the message:

"sx: need at least one file to send
Try `sx --help' for more information"

"sx --help" gave me the file name shown above (Subject) and a long list of flags for use with sx, but no direct information about what sx is supposed to do. From the flags, one would assume that sx transfers files using either Xmodem protocol, Ymodem protocol or Zmodem protocol, depending on the flag.

A search for "sx version 0.12.21rc" led to
< github.com/gjhiggins/Deepcoin/new-sx-0.8.7 >

Many of the new commits there had "bitcoin" in their subject lines. The latest new commit was in February, 2015; so, the project is apparently still under active development.

A search for "Deepcoin" dredged up this at < Deepcoin.biz >:

"DEEPCoin is a peer-to-peer Internet currency that enables instant, near-zero cost payments to anyone in the world. DEEPCoin is an *open source*, global payment network that is fully decentralized without any central authorities.

< marketing hype deleted >

More impressively, DEEPCoin features a *proprietary* DEEPHash algorithm to protect it from the rise of SHA256 and SCRYPT ASIC's."

[Aside: Are not *opensource* and *proprietary* mutually exclusive terms?]

The possible connection between "sx version 0.12.21rc" on my machine and "sx-0.8.7" at github is probably coincidental, because the version numbers are out of sync.

But, the question still remains, is "sx version 0.12.21rc" malware. I know not whence it came, unless I stumbled across the wrong website somewhere, because I have not downloaded any new software for months.

I have not yet found where it is hiding. It is not listed in /var/log/packages; and "whereis" comes up empty, whether I run it as user or as root. Many thanks for any information that might help me rid my computer of this.

Happy Passover or Happy Easter to all who celebrate either holiday.

paulb2
 
Old 04-04-2015, 10:53 PM   #2
MadMaverick9
Member
 
Registered: Aug 2010
Posts: 353
Blog Entries: 4

Rep: Reputation: Disabled
Code:
bash $ which sx
/usr/bin/sx

bash $ whereis sx
sx: /usr/bin/sx /usr/X11R6/bin/sx /usr/bin/X11/sx /usr/X11/bin/sx

bash $ ls -al /usr/bin/sx /usr/X11R6/bin/sx /usr/bin/X11/sx /usr/X11/bin/sx
lrwxrwxrwx 1 root root 2 Jan 24  2013 /usr/bin/sx -> sz
lrwxrwxrwx 1 root root 2 Jan 24  2013 /usr/bin/X11/sx -> sz
lrwxrwxrwx 1 root root 2 Jan 24  2013 /usr/X11/bin/sx -> sz
lrwxrwxrwx 1 root root 2 Jan 24  2013 /usr/X11R6/bin/sx -> sz

bash $ ls -al /usr/bin/sz /usr/X11R6/bin/sz /usr/bin/X11/sz /usr/X11/bin/sz
lrwxrwxrwx 1 root root 3 Jan 24  2013 /usr/bin/sz -> lsz
lrwxrwxrwx 1 root root 3 Jan 24  2013 /usr/bin/X11/sz -> lsz
lrwxrwxrwx 1 root root 3 Jan 24  2013 /usr/X11/bin/sz -> lsz
lrwxrwxrwx 1 root root 3 Jan 24  2013 /usr/X11R6/bin/sz -> lsz

bash $ ls -ial /usr/bin/lsz /usr/X11R6/bin/lsz /usr/bin/X11/lsz /usr/X11/bin/lsz
1710235 -rwxr-xr-x 1 root root 65052 Aug 15  2012 /usr/bin/lsz
1710235 -rwxr-xr-x 1 root root 65052 Aug 15  2012 /usr/bin/X11/lsz
1710235 -rwxr-xr-x 1 root root 65052 Aug 15  2012 /usr/X11/bin/lsz
1710235 -rwxr-xr-x 1 root root 65052 Aug 15  2012 /usr/X11R6/bin/lsz

bash $ grep -i bin/lsz /var/log/packages/*
/var/log/packages/minicom-2.6-i486-1:usr/bin/lsz

bash $ sx --version
sx (lrzsz) 0.12.21rc

bash $ lsz --version
lsz (lrzsz) 0.12.21rc
 
1 members found this post helpful.
Old 04-05-2015, 12:15 AM   #3
paulb2
Member
 
Registered: Feb 2011
Location: Evansville, IN USA
Distribution: Slackware64 14.1(multilib) and Win7
Posts: 30

Original Poster
Rep: Reputation: 5
Quote:
Originally Posted by MadMaverick9 View Post
Code:
bash $ which sx
/usr/bin/sx

bash $ whereis sx
sx: /usr/bin/sx /usr/X11R6/bin/sx /usr/bin/X11/sx /usr/X11/bin/sx

bash $ ls -al /usr/bin/sx /usr/X11R6/bin/sx /usr/bin/X11/sx /usr/X11/bin/sx
lrwxrwxrwx 1 root root 2 Jan 24  2013 /usr/bin/sx -> sz
lrwxrwxrwx 1 root root 2 Jan 24  2013 /usr/bin/X11/sx -> sz
lrwxrwxrwx 1 root root 2 Jan 24  2013 /usr/X11/bin/sx -> sz
lrwxrwxrwx 1 root root 2 Jan 24  2013 /usr/X11R6/bin/sx -> sz

bash $ ls -al /usr/bin/sz /usr/X11R6/bin/sz /usr/bin/X11/sz /usr/X11/bin/sz
lrwxrwxrwx 1 root root 3 Jan 24  2013 /usr/bin/sz -> lsz
lrwxrwxrwx 1 root root 3 Jan 24  2013 /usr/bin/X11/sz -> lsz
lrwxrwxrwx 1 root root 3 Jan 24  2013 /usr/X11/bin/sz -> lsz
lrwxrwxrwx 1 root root 3 Jan 24  2013 /usr/X11R6/bin/sz -> lsz

bash $ ls -ial /usr/bin/lsz /usr/X11R6/bin/lsz /usr/bin/X11/lsz /usr/X11/bin/lsz
1710235 -rwxr-xr-x 1 root root 65052 Aug 15  2012 /usr/bin/lsz
1710235 -rwxr-xr-x 1 root root 65052 Aug 15  2012 /usr/bin/X11/lsz
1710235 -rwxr-xr-x 1 root root 65052 Aug 15  2012 /usr/X11/bin/lsz
1710235 -rwxr-xr-x 1 root root 65052 Aug 15  2012 /usr/X11R6/bin/lsz

bash $ grep -i bin/lsz /var/log/packages/*
/var/log/packages/minicom-2.6-i486-1:usr/bin/lsz

bash $ sx --version
sx (lrzsz) 0.12.21rc

bash $ lsz --version
lsz (lrzsz) 0.12.21rc
@MadMaverick9

Many thanks for your quick and thorough reply. I feel confident now that sx is not malware, and I thank you for that. Several questions remain, such as: Why did "sx" work as an alias for "startxfce4" for such a long time?; and Why did which and whereis not find sx earlier?, but I do not think they are worth any more time being spent on them. I have marked this thread [SOLVED].

Happy passover or Happy Easter to all who observe either of these holidays.

paulb2
 
Old 04-06-2015, 11:49 AM   #4
the3dfxdude
Member
 
Registered: May 2007
Posts: 730

Rep: Reputation: 358Reputation: 358Reputation: 358Reputation: 358
Check if your aliases are loaded. (probably not)
Check how you are launching your shell that is affected.
Check which login/interactive initialization scripts are being sourced when you launch your shell.

It's not hard to loose your aliases if you make a small change.

'which' doesn't look at your aliases by default, unless you've aliased it to do so--something I've seen on some systems. I'm not sure if whereis can do this.
 
Old 04-07-2015, 05:22 PM   #5
paulb2
Member
 
Registered: Feb 2011
Location: Evansville, IN USA
Distribution: Slackware64 14.1(multilib) and Win7
Posts: 30

Original Poster
Rep: Reputation: 5
Quote:
Originally Posted by the3dfxdude View Post
Check if your aliases are loaded. (probably not)
Check how you are launching your shell that is affected.
Check which login/interactive initialization scripts are being sourced when you launch your shell.

It's not hard to loose your aliases if you make a small change.

'which' doesn't look at your aliases by default, unless you've aliased it to do so--something I've seen on some systems. I'm not sure if whereis can do this.
@the3dfxdude

1) Yes, all my aliases are loaded; they all work normally now, since I changed the alias for "startxfce4", which used to be "sx"and worked for seven months before last week.

2) I login to tty1 (level 3): all aliases work. Occasionally I used to switch to X with "sx": all aliases also work in xfce4.

3) I don't think that is necessary, because all my aliases used to work until last week, when bash stopped recognizing "sx" as an alias and started recognizing it as a command to start sx version 0.12.21rc. I still have no idea how or why that happened; but, now that I know that sx version 0.12.21rc is not malware [thanks again. MadMaverick9], I see no need to spend time to try to find out, since it took about one minute to change the alias from "sx" to something new in my .bashrc file.

Thank you for your reply. It's good to know that the helpful people on this forum are always ready to lend a hand - or an idea. However, as far as I am concerned, this problem, that turned out to be a non-problem, is solved.

paulb2

Last edited by paulb2; 04-07-2015 at 05:25 PM. Reason: Corrected a typo
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Malware? kcredden Linux - Security 2 05-04-2014 12:19 PM
[SOLVED] May have contracted malware. Yes, malware. Firefox on Ubuntu Fiesty. Seeking a fix drachenchen Linux - Security 22 08-17-2008 01:05 PM
May have contracted malware. Yes, malware. Firefox on Ubuntu Fiesty. Seeking a fix drachenchen Linux - Security 1 06-12-2008 05:10 AM
Regarding distribution + kernel version + gcc version + glib version. JCipriani Linux - General 8 04-19-2008 02:54 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware

All times are GMT -5. The time now is 09:24 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration