Possible Linux PDF Trojan?

[GreyGeek]

https://latesthackingnews.com/2016/1...nux-computers/

... the trojan is spread in the form of an archived PDF, Microsoft Office, or OpenOffice file.

The infection starts when users open the file. The trojan springs into action by copying itself to “< HOME >/.gconf/apps/gnome-common/gnome-common” and then opens a decoy document, hence his name of “FakeFile.”


The trojan also adds a shortcut to itself in the user’s .profile and .bash_profile files, which allows it to gain boot persistence between PC reboots.

I do not have an "apps" subdirectory under .gconf nor do I have a user .profile or .bash_profile file in my home account.

Anyone else?

[MoonRise]

I don't have the .bash_profile files or the apps under .gconf.

[Qqmike]

In 14.04, the only thing I have under .gconf is the harmless: /home/mike/.gconf/apps/psensor/[and its files] . I do have this folder: /home/mike/.gconf/apps/%gconf.xml, but it's empty at 0 B.

[TWPonKubuntu]

I don't have an apps folder under .gconf and that is using Linux Mint xfce.

Thanks for alert GG

Yes, I still check in daily even though I can't run KDE on my system anymore. Hoping...

[Snowhog]

https://latesthackingnews.com/2016/1...nux-computers/

I do not have an "apps" subdirectory under .gconf nor do I have a user .profile or .bash_profile file in my home account.

Anyone else?

My .gconf directory is empty. I'm surprised you don't have .profile or .bash_profile in your Home directory; I do, and I think everyone using Bash does.

.profile:

# ~/.profile: executed by the command interpreter for login shells.# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
# exists.
# see /usr/share/doc/bash/examples/startup-files for examples.
# the files are located in the bash-doc package.


# the default umask is set in /etc/profile; for setting the umask
# for ssh logins, install and configure the libpam-umask package.
#umask 022


# if running bash
if [ -n "$BASH_VERSION" ]; then
    # include .bashrc if it exists
    if [ -f "$HOME/.bashrc" ]; then
        . "$HOME/.bashrc"
    fi
fi


# set PATH so it includes user's private bin directories
PATH="$HOME/bin:$HOME/.local/bin:$PATH"

.bash_profile:

## ~/.bash_profile
#


[[ -f ~/.bashrc ]] && . ~/.bashrc

[jlittle]

(Firstly, gconf is the Gnome 3 configuration system and if you're not running Gnome you won't have much in .gconf. On login bash looks for ~/.bash_profile, ~/.bash_login and ~.profile in that order and runs the first found. You'd typically have a .bash_profile if you used other Bourne-like shells, and have bash specific stuff.)

I don't get it; even on Windows opening PDFs or office files won't cause something to run these days; that was stopped years ago. I suppose if you really wanted to get your computer infected you could enable on-open macros and set the security option to Low. On my Libreoffice the security level came set to "High. Only signed macros from trusted sources are allowed to run."

[GreyGeek]

Well, my 75 year old eyeballs may have missed them by my KDE Neon installation didn't list those hidden files in Dolphin's sorted list.


Sent from my iPhone using Tapatalk

[marco07]

In 14.04, the only thing I have under .gconf is the harmless: /home/mike/.gconf/apps/psensor/[and its files] . I do have this folder: /home/mike/.gconf/apps/%gconf.xml, but it's empty at 0 B.

Ditto in 16.04.