First of all I am really sorry for my English. It is not so perfect at all. Please feel free to refer to that in your future comments if you like too or, if you could be so kind as to, just ignore that. (-:

Second, I am not quite sure whether this is the best place for addressing my questions. In the case being not please help me find the better one.

Third, I am totally new here and I am going to read everything about rules etc. but now I’ve got tricky situation here and stakes could be high for me, so I have no time to do this before asking all of you.

Please, regard also, I have purely theoretical/analytical background and I’ve been playing all that information technology things since very short (to be perfectly honest, only a few months). So my only weap3n for now is logic, open mind (as I am capable to) and patience.

The situation.

I have an external drive for my usual everyday not-important files (music, photos favourite text files etc.,), partitioned in windows os. Yesterday I sent somebody a few docs – we used to have a conversation on a http site where people used to have such a kind of conversations. She answered me that all are infected (she scanned files with software) and she won’t open them. ‘Good choice’, I thought. I asked for logs from her antivirus, but she can’t send me them.

So below I describe scenarios which I can imagine:

1) I'd gotten infected earlier than the conversation was beginned (I hope not to);

2) Some UFO, NSA, GRU or other bad people with all their fetishes and colours of their hats has infected my files somewhere in the middle of the road from my host to her (found something here: https://www.youtube.com/watch?v=SeVz36FN61w);

3) She lied to me;

Regardless third option, I should probably take this situation serious.

Maybe there are some other possibilities and perhaps you could help me investigate them but, actually, this is not the case, I think (at least of my interest now), cause I am not doing forensics and any other things like that. I am just really concern about my computers.

So my main question remains what is the best way for scanning possibly infected external drive (ntfs) in Debian Stretch?

Unfortunately I’d used that sh!t drive on my main Debian just before the conversation – I read my files.

And I unfortunately ran my live debian also with that drive plugged in (and checked my secure mail probably to), so in the case of keylogger etc. I'm also lost, I suppose.

So what I want to do is to check my external drive. Next I probably should check my two debian hosts (one without gui) and finally my live debian (maybe even change all passwords, including encrypted partitions lvm etc.). So my question is what is the best (not necessary the fastest and simplest) way to clean all of this up. Of course I would sudo shred everything and build from scratch - and I am ready to do this - but this is not the most elegant way of doing things for me. And maybe this is a good moment to go further and learn some more important things.

I read about clamav but I got back my fingers from the mouse after seeing some amazon(?) strings linked to the main site.

And I wonder about (for future use) wheter is there any secure way for opening suspicious files in the, let us say, some kind of laboratory like fully (physically) isolated (perhaps encrypted like my debian lvm partitions, for instance) place on the hd or something like that. Probably the best way would be just having one host without wifi firmware for doing that kind of things. I am aware about VM, but this is not looking enough secure for me and my cpu's do not support virtualisation, so making two virtualisations (one for boosting cpu and another for host) seems to be a little bit strange for me.

Thanks a lot in advance!

Best regards!

  • Welcome to the Security Stack Exchange! What do you mean you saw "amazon(?) strings linked to the main site"? I was going to suggest running an antivirus such as ClamAV to see if you could reproduce the results. – multithr3at3d Jan 16 '18 at 20:40
  • Some strings looking like redirections(?) on the left down corner of my browser. Maybe nothing strange amd I am too sensitive. – merlenoir Jan 16 '18 at 20:46
  • You wrote "Third, I am totally new here and I am going to read everything about rules etc." but several months later and you still haven't got the badge for reading the rules. Why did you even write that? – ChrisM Sep 14 '18 at 12:15
  1. If the files are not sensitive, consider uploading them to VirusTotal. This will run a couple of dozen AV products on them simultaneously. It's fairly unlikely that anything that would have tripped your correspondent's AV would not be caught in this scan.
  2. ClamAV is a decent AV scanner (mostly designed for the mail server use case) but has slightly fewer signatures (in my experience) than commercial AVs. Also, AFAIK, it has no heuristic detection capabilities.
  3. If you're running Debian, it's fairly unlikely that the malware would have any affect on you. The vast majority of malware targets Windows and Windows applications, for obvious reasons.
  4. You missed some other options, such as error (not lying) on her part, or files becoming infected on her computer prior to her scanning them.
  • Thank you for immediate responses! David, I was thinking about the things you mentioned in the 4th, but I've just considered the worst (known to me) scenarios for me. – merlenoir Jan 16 '18 at 21:36
  • Ok, no engines detected my files. So next maybe I will try ClamAV or something commercial (with heuristics) and google for some other (perhaps even more manual) techniques like reading hexes or something. Thank you all! – merlenoir Jan 17 '18 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.