How can I determine if my system was infected?

Question

At the risk of being overly cautious (after a bout of recklessness, due to being groggy from lack of caffeine), I want to be certain that my system is not infected after running an infected file.

I'm on Linux and I'm almost certain the virus only affects Windows via MS Office. But I'm not a virus expert, so I would appreciate some pointers (after ClamAV not detecting anything).

Here's what a Virus Total online scanner found:

I researched some of the malware names, and it seems the main exploit is via Microsoft Office, inside a Windows machine. However, as I said, I foolishly opened the file in Libre Office and clicked "Edit file" in Linux Mint, which presumably would have activated the infection.

How can I be certain my computer is still safe? Should I format?

Answer 1

Unfortunately, we can't be 100% certain your computer is safe after opening a probably infected file. It seems that multiple security products flagged this .xlsx file as potential malware according to Virus Total report, I doubt this is a false-positive.

However, the risks might be mitigated since you are running on Linux and with Libre-office. The probabilities that the malware might have been made to run on Windows with Microsoft Office is higher.

In paranoid mode, if you want to be more than 95% certain than no malware is left on your computer, I would recommend you the following :

1) Backup all your files (except the malware-bundled .xlsx one) from a clean OS instance. - A Linux Live CD burned from a trusted computer would be the best

2) Completely wipe your computer hard disks, using a software such as DBAN. - If you want to go faster, I suggest you use dd from the Linux Live CD. dd if=/dev/zero of=[your hard disk] bs=4M count=256 (writing 1 GB of zeros should be enough to clear the MBR/GPT of unwanted stuff, in case you got a tough malware)

3) Reinstall your OS, be sure your installation media comes from a trusted source.

4) Reinstall your program, again, be sure installer is from a trusted source.

5) Restore your data

Answer 2

Looking a bit into the CVE-2017-11882 reported by the various scanners, it's a Microsoft Office Memory Corruption Vulnerability, a kind of remote code execution vulnerability. It allowed a specially crafted file to run arbitrary code in the scope of the current user. It seems it affected only MS Office and WordPad programs in 2017 and was promptly patched out. Judging by the rest of the detections, the exploit's purpose was to download and execute a malicious payload on the affected machine.

That's about everything I believe can be figured out from the VirusTotal report alone. To really answer your question "How can I be certain my computer is still safe?", one would have to properly analyze the file, which is a task that requires equipment and knowledge far exceeding mine. And even then, the answer would still come with only a certain degree of certainty.

Without that, it's impossible to know whether that exploit was the only thing in the .xlsx file. I personally would treat the file as unsafe since it has clearly gone through the hands of someone with malicious intents - and treat your PC as such. In their answer, pmbonneau summed up the recommended steps to take very nicely and I must second those. The fact the detected exploit shouldn't affect your computer only works to your advantage here, but to really be certain your computer is safe, it's either thoroughly analyze the file, or "nuke your PC from the orbit".