Unbelievable, I think I got a virus and need help removing it.

[Shabakthanai]

I was trying to locate an application on a torrent request. I was interested in Open Source voice application software which works on Kubuntu 15.10.

I clicked on something that talked about Dragon Systems; I heard they have good voice activated software. I was directed to a site called something like kickass something or other. When I clicked on the option, I was directed to some kind of video game offerings. I don't play video games and don't know how I got there.

I clicked the X to get out of there and one-after-another sites appeared having nothing to do with voice activated software. Now things happen that corrupt normal work on my computer.

I installed Clamav. I used Muon and it says it is installed, but I cannot find it in my list of installed applications. Additionally when I select Alt+ f2 and type in Clamav, it does not provide the application. Neither does typing Clamav in the konsole.

Typing in the search on the browser, does not print all the letters and characters now and the panel blinks on and off while I type.

Is this how a virus appears? Since Clamav is installed but cannot be found, what do I do. Can this be corrected or do I have to re-install Kubuntu to solve the problem? Thanks for any help. Additionally, if you know what I did to cause this problem, getting on the wrong site, please tell me, so I won't do it again. Thanks

[whatthefunk]

In a terminal, what is the output of 'which clamav'? Try installing it again, but use the terminal, not Muon.

About the problems... I use kickass daily for torrents, but dont trust it at all. I have a pretty strict cookie policy in my browser and kickass isnt allowed anything. Have you tried clearing cookies and everything in your browser? What kinds of things are happening on your computer?

[Shabakthanai]

I hope I was in the correct place to modify cookies. I found kickass; it had 3 entries. I don't know what any of them are. There was an empty box in front of the entries. I highlighted the primary kickass entry and selected remove all entries. Unfortunately it removed all cookies from my machine.

Does it sound like I was in the correct preferences of firefox? What should I have done to remove the selected cookies. I don't want kickass in my computer if it is going to screw it up.

My thoughts are that kickass may provide stuff I never would want to have in my computer. That is OK if it doesn't get installed in my computer without permission. Nonetheless, I do not want to frequent a site that has trickery included. I am not the brightest bulb on the tree. I rarely know how to protect myself from the kind of stuff I am inferring.

I am totally in favour and support all open source offerings and want government out of Internet completely. Still, I want to be able to safely use the Internet without getting caught in what happened.

The primary loss of function that happened after this instance is, "sometimes when I am typing in search parameters, not all the letters print". When this is going on, the panel is blinking on and off.

The only way to continue typing the entry is to slow to a near pause between printing each letter or number. Then the letters print and I can continue. It is, however, very annoying to be messed with that way, especially when I don't know what I did to cause the attack.

I use the desktop theme 'bare naked'. Since this problem, the panel on my desktop has become opaque. It has always been invisible, not transparent. That is the way I prefer.

I have tried to uninstall 'bare naked'. When I make the choice, it goes from uninstall to install again. When I return to my desktop, the corrupted 'bare naked' theme remains, with the opaque panel.

Of course I can live with these changes, but I do not want to. I then installed the theme 'naked', which I did not realize existed until now. It appeared to have invisible backgrounds for the widgets and panel. That was my preference anyway. When I opened system settings to make the change to the 'naked' theme, it was not included in the options. I even selected a blank area in case it was also invisible in the choices. It just plain was not there. Nonetheless, 'bare naked' remained as a choice, even though I supposedly removed it from my machine.

On one occasion, my desktop background booted pitch black. Plazmoids still appeared and the panel also, but I had to reinstall the default background to restore to original.

I have had many problems over the past year, ever since I increased my memory. The memory has been exchanged for new, but problems still exist. Nevertheless, since I found and removed what I believe is the offending stick, operating with the original memory configuration seems to have returned to normal

I have dusted both sides of my motherboard twice, cleaned out my video card and processor, reconnected all sata drive connections and HDD's and SSD's. I have cleaned all fans. I have tested the video card by using my old video card, which worked perfect when replaced, but was replaced to increase memory in the GUI.

I have removed and installed my OS on two occasions. My motherboard checks perfect. I have run memory tests on each of the 8gb memory sticks that ran for 14+ hours each. I have removed each memory stick and tried them individually for two weeks each. One had problems, so I removed it. I then tried every combination of two sticks of memory to see if they worked perfectly. I did this for two weeks minimum on each combination. No problems occurred. As a final test on the memory, I included the memory stick that tested bad in use.

I thought perhaps all the cleaning and checking and reconnection of cables may have corrected my problems. The system operated perfectly for a few days. The kickass problem happened and I became unsure whether it was a virus, or the probable defective memory stick finally going bad again. I am so frustrated, I cannot stand it any more.

I have seen your wisdom benefit many users and trust your increased capabilities. This post may be out of order, because of the return of the probable memory stick, or it may be the entry of a virus.

I am glad to know you have found a way to use the site in question regularly, without problems. I am not sure if I followed your instructions accurately and hope I am not wasting your time.

I am old on a low fixed income and cannot replace my computer to solve my problems. Additionally, it is difficult for me to replace items that may not be defective in pursuit of a solution. I must spend what I have very carefully. If you can see any way to help me, I would appreciate it.

Sorry for the long winded response, I am out of ideas. Thanks my friend for your patience.

In a terminal, what is the output of 'which clamav'? Try installing it again, but use the terminal, not Muon.

About the problems... I use kickass daily for torrents, but dont trust it at all. I have a pretty strict cookie policy in my browser and kickass isnt allowed anything. Have you tried clearing cookies and everything in your browser? What kinds of things are happening on your computer?

[whatthefunk]

So is the problem still around or does it seem to have been solved? If you want to check your memory, use memtest. https://help.ubuntu.com/community/MemoryTest It takes a while to complete...a few hours usually.

About Firefox. To delete cookies for a certain site, go to Preferences->Privacy and click on Show Cookies. From the popup menu, you can delete all cookies or only selected ones.

My basic rule is to not trust anything on the internet. Its full of dodgy sites looking to take advantage of people in one way or another. I use a whitelist policy, meaning that I dont allow sites to leave any cookies unless I allow them to. Its great for security and privacy but sometimes annoying because I have to manually add new sites to my whitelist if I choose to trust them.

[GreyGeek]

I doubt that you got infected.

Those pop-up sites are typical for applications which can't afford their own server (bandwidth) and contract with an ad server which "hides" the button which does the actual download button among a variety of buttons which trigger downloads of other apps, usually payware, or other sites. The secondary sites "cancel" or "X" buttons usually trigger a second copy of the site or another site. I run into this all the time while seeking and downloading mods and resource packs for various versions of Minecraft. They can and often do mess up your browser settings and, as whatthefunk says, saves tracking and other malicious cookies on your HD. Temporarily disconnect your internet and then run the "infected" browser so it can't reconnect with "home". Then use the internet settings to remove cookies you are not familiar with, or remove them all. If you have some sites that you log into and you've selected the "remember me" or "forever" option then you'll have to re-log into those sites, if you can remember the name and password you used to create your account. Also, check your search engine settings to make sure AOL, Bing, ASK or other pseudo engines haven't registered with your browser. If they have, delete them. They are just spyware.

[Simon]

I agree with GreyGeek, I am always showing my friends that I can surf out to places that want to "infect" my PC. Since 99.99% are geared to work only with windows and or a browser, I can delete my infected wine folder or remove the browser infestation (usually a plugin) rather quickly and with ease. I would do as Teunis suggests and try another browser.

[Shabakthanai]

Things appear to be back to normal.

Thanks for the additional advice. It sounds exactly how I would like things to be. I guess I got a little lazy going so long without that kind of junk affecting my computer. I just can't get far enough away from the Microsoft experience.

I hope, since manufacturers are starting to show consideration for Linux users, that our computer experience doesn't start mirroring the windows experience.

Because of how we have had it these many years without the offensive junk, I would hate to see the manufacturer's consideration for us to become an opening for the evil crap windows users have to experience.

I really appreciate you kindness, and extra help.

So is the problem still around or does it seem to have been solved? If you want to check your memory, use memtest. https://help.ubuntu.com/community/MemoryTest It takes a while to complete...a few hours usually.

About Firefox. To delete cookies for a certain site, go to Preferences->Privacy and click on Show Cookies. From the popup menu, you can delete all cookies or only selected ones.

My basic rule is to not trust anything on the internet. Its full of dodgy sites looking to take advantage of people in one way or another. I use a whitelist policy, meaning that I dont allow sites to leave any cookies unless I allow them to. Its great for security and privacy but sometimes annoying because I have to manually add new sites to my whitelist if I choose to trust them.

[GreyGeek]

...
I hope, since manufacturers are starting to show consideration for Linux users, that our computer experience doesn't start mirroring the windows experience.
...

Linux doesn't use the agents that make Windows boxes so susceptible: "ActiveX" dll's.

Several requirements make mass infections of Linux boxes highly unlikely. First, the malware has to be downloaded and saved as a file on the drive. That's because EVERYTHING in Linux is a file, including sockets. Secondly, the saved file has to be marked as executable. Only the user can do that. Thirdly, even if the file is marked with the execute permission it WILL NOT execute unless it is a valid ELF binary or a shell script with the "#!..." sequence as the first line. Fourthly, only then, IF the user "opens" (or runs) it,X will the file run.

About 10 years ago there was a security hole in the KDE desktop which allowed a received email containing a *.dsk (desktop) file attachment to be executed by KDE KMail. It was the closest thing to an ActiveX control that KDE ever had, but that "feature" was eliminated before it became generally known.

I never use AV software. In the last 17 years of extensive internet browsing and use I've never had an infection. I have chirootkit and rkhunter as a cron service running daily, and I have an IPSec firewall on my Cisco E2500 wifi, which is running DD-WRT Linux firmware.