0

At the risk of being overly cautious (after a bout of recklessness, due to being groggy from lack of caffeine), I want to be certain that my system is not infected after running an infected file.

I'm on Linux and I'm almost certain the virus only affects Windows via MS Office. But I'm not a virus expert, so I would appreciate some pointers (after ClamAV not detecting anything).

Here's what a Virus Total online scanner found:

enter image description here

I researched some of the malware names, and it seems the main exploit is via Microsoft Office, inside a Windows machine. However, as I said, I foolishly opened the file in Libre Office and clicked "Edit file" in Linux Mint, which presumably would have activated the infection.

How can I be certain my computer is still safe? Should I format?

  • Are you running a vulnerable version of LibreOffice, or did you allow macros? If neither are true, it is very unlikely that anything malicious could happen. – multithr3at3d Jun 6 at 22:49
  • I allowed macros (never opening email again before my morning tea), but was running the latest version of LibreOffice. – Khashir Jun 7 at 22:00
1

Unfortunately, we can't be 100% certain your computer is safe after opening a probably infected file. It seems that multiple security products flagged this .xlsx file as potential malware according to Virus Total report, I doubt this is a false-positive.

However, the risks might be mitigated since you are running on Linux and with Libre-office. The probabilities that the malware might have been made to run on Windows with Microsoft Office is higher.

In paranoid mode, if you want to be more than 95% certain than no malware is left on your computer, I would recommend you the following :

1) Backup all your files (except the malware-bundled .xlsx one) from a clean OS instance. - A Linux Live CD burned from a trusted computer would be the best

2) Completely wipe your computer hard disks, using a software such as DBAN. - If you want to go faster, I suggest you use dd from the Linux Live CD. dd if=/dev/zero of=[your hard disk] bs=4M count=256 (writing 1 GB of zeros should be enough to clear the MBR/GPT of unwanted stuff, in case you got a tough malware)

3) Reinstall your OS, be sure your installation media comes from a trusted source.

4) Reinstall your program, again, be sure installer is from a trusted source.

5) Restore your data

| improve this answer | |
  • I have 4 partitions, 2 linux ones (one for / and one for /home); plus 2 windows one (the os, and a Data one shared with linux). Should I format the whole drive or just the linux partitions? – Khashir Jun 7 at 22:01
  • 1
    I would erase the whole MBR/GPT of all your drives using the dd command above and restart from scratch if we want to target a 95%+ certitude level about your computer safety. We can't tell exactly the behaviour of this suspicious file, the payload might be smart enough to detect additional OS partitions and install itself in. Also, another OS partition like a Windows one is usually mounted as a data volume from a Unix current running system, ACLs aren't effective. This means that even without root privilèges, the executed malware could read and write any files on your other OS partitions. – pmbonneau Jun 10 at 19:52
0

Looking a bit into the CVE-2017-11882 reported by the various scanners, it's a Microsoft Office Memory Corruption Vulnerability, a kind of remote code execution vulnerability. It allowed a specially crafted file to run arbitrary code in the scope of the current user. It seems it affected only MS Office and WordPad programs in 2017 and was promptly patched out. Judging by the rest of the detections, the exploit's purpose was to download and execute a malicious payload on the affected machine.

That's about everything I believe can be figured out from the VirusTotal report alone. To really answer your question "How can I be certain my computer is still safe?", one would have to properly analyze the file, which is a task that requires equipment and knowledge far exceeding mine. And even then, the answer would still come with only a certain degree of certainty.

Without that, it's impossible to know whether that exploit was the only thing in the .xlsx file. I personally would treat the file as unsafe since it has clearly gone through the hands of someone with malicious intents - and treat your PC as such. In their answer, pmbonneau summed up the recommended steps to take very nicely and I must second those. The fact the detected exploit shouldn't affect your computer only works to your advantage here, but to really be certain your computer is safe, it's either thoroughly analyze the file, or "nuke your PC from the orbit".

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.