3

I'm using Ubuntu, I detected a file called "yveqsh93.exe" after plugging my USB into a heavily used Windows XP machine in one of the labs of my research group at university (Controlling some lab equipment).

This file was labeled as a trojan by VirusTotal

How do I act now? I immediately disconnected my Password vault from my Ubuntu machine. But maybe I've been too late already! I'm changing my Master Password via my phone now.

Can I get a virus scan for Ubuntu or is this .exe only harmful to Windows any ways? I'm a total noob with these things.

Do I need to inform the admin at the university? I'm only a visiting student there and don't want to make any trouble.

Improve this question

2 Answers 2

Reset to default
4

It's a Windows program, it won't magically execute on Ubuntu. And don't bother informing the administrator at the university, most client-facing computers on universities are either locked down hard, or heavily infected.

You don't need to worry about your Ubuntu machine. Unless you have wine installed, and ran that executable by hand, it cannot damage your computer. But you'd better copy your files elsewhere, delete everything from that USB drive, and copying the files back. Not to protect you, but to protect any Windows computer you plug that USB drive later.

Improve this answer
10
  • I plugged this very same stick in one of my colleagues windows computer. Do you think there newer Windows took care of it immediately?
    – anon
    Dec 15, 2020 at 0:19
  • I already thought it wouldn't execute on its own. I do have wine installed but did not execute it. I now fromatted the USB.
    – anon
    Dec 15, 2020 at 0:19
  • 1
    So you have nothing to worry about, and your colleague have to worry about.
    – ThoriumBR
    Dec 15, 2020 at 0:20
  • So I guess I will inform them then! I feel kind of happy to use Ubuntu now.
    – anon
    Dec 15, 2020 at 0:25
  • 1
    And I bet you never saw a Rubber Ducky in person, let alone one targeting a Linux device. It's way more probable to find malware using the USB device as storage than hacking the USB device itself. I never saw or heard of any malware hacking the device itself.
    – ThoriumBR
    Dec 18, 2020 at 17:59
-1

First, you should absolutely report any suspicious activity to the Network/Security Admins. Even if they're completely inept and ultimately fail to protect the users they support, they can do nothing if we fail to do our part!

Assuming that you trust the initial acquisition of the USB drive (purchased the drive from a reputable vendor), a reformat might be a good first step. These days it's fairly common for self-propagating malware to inject itself into existing objects, such as PDF's and MS Office documents, that support auto launching of malware. Unless you've taken steps to ensure the integrity of all the files stored on the USB device it's best to assume anything previously stored on the device has been compromised.

Finally, while the sudden appearance of the EXE object and VT hit are HIGHLY suspicious, AntiVirus (AV) solutions are reactive in nature and not as reliable as we'd like to believe. False positives are common, which is another reason to report the incident to the Network and Security Admins. False Negatives or missed detections are just as prolific, if not more so.. If you have been unfortunate enough to become a victim of a malicious attack, there is no guarantee that you won't continue to re-infect yourself by keeping your original data.

Improve this answer
6
  • For clarity, the comment regarding VT hits was an intentional overgeneralization. The VT hit in this case looks pretty conclusive (60/69 detections at the time of writing).
    – Simpleton
    Dec 18, 2020 at 20:08
  • 1
    I believe "not common" is a massive understatement, I would say it's "very rare." I've still to see one "in the wild", and all the examples I saw were on lab environments.
    – ThoriumBR
    Dec 21, 2020 at 13:19
  • 1
    To create a HID attack device, software on Windows would have to put the USB drive in programming mode, and that is not possible without physically opening the drive and shorting a specific pin. And the malware would have to know the exact maker and firmware version to change it AFTER shorting a circuit trace by software...
    – ThoriumBR
    Dec 21, 2020 at 13:33
  • No sense in making a mountain out of a mole hill. We have enough people who come here with excessively paranoid questions. "My monitor flickered and the next day my phone restarted. Clearly someone has hacked my router and used it to inject malicious firmware in all my devices. How do I fix it?" Answers like this make questions like those more common...
    – Conor Mancone
    Dec 21, 2020 at 13:51
  • EDIT: removed reference to USB microcontroller vulnerabilities and the dangers of Human Interface Devices (HID) based on community feedback.
    – Simpleton
    Dec 31, 2020 at 8:04

You must log in to answer this question.