8

I ran Clamav on an Ubuntu 20.04 machine and it identified ten Certbot files as infected.

/snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/t32.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/t64-arm.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/t64.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/w32.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/w64-arm.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1670/lib/python3.8/site-packages/pip/_vendor/distlib/w64.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1582/lib/python3.8/site-packages/pip/_vendor/distlib/t32.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1582/lib/python3.8/site-packages/pip/_vendor/distlib/t64.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1582/lib/python3.8/site-packages/pip/_vendor/distlib/w32.exe: Win.Malware.Generic-9937882-0 FOUND
/snap/certbot/1582/lib/python3.8/site-packages/pip/_vendor/distlib/w64.exe: Win.Malware.Generic-9937882-0 FOUND

Both the Clamav database and Certbot are up-to-date.

The identified files' "last modified" timestamp coincides with that of many other Certbot files. So, I am not sure whether it might not be false alarm. And the files appear to target Windows. Unfortunately, Clamav does apparently not provide further information on the identified malware.

I tried having Clamav automatically remove those files

sudo clamscan -ir --remove /

but somehow it fails to do so, blaming a read-only privilege - despite running the command with sudo.

Does anyone have any insights on this issue? Is this a false alarm? Did I configure something incorrectly?

Improve this question

2 Answers 2

Reset to default
9

It's almost certainly a false positive if you've installed the snap from a reputable (e.g. the official snap outlet by Canonical).

Furthermore, it's Windows executables and Windows malware - which should never be executed on a Ubuntu system anyway. It's simply packed in the library because of convenience.

The reason you can't remove it is that Snap's is a read only file system image. It's not meant to have parts of it removed.

Improve this answer
3
  • 2
    Thanks, great answer. I was not sure how serious a threat from Windows executables is on Ubuntu as there is apparently the option to run exe files using wine.
    – Chr
    Jan 31 at 13:13
  • 1
    @Chr You can always upload the files to VirusTotal to get a better idea.
    – user163495
    Jan 31 at 16:26
  • 1
    @Chr Wine (or Proton) can run Windows malware on Linux, but it usually will not work correctly unless the malware itself is expecting it (and, of course, you have to have Wine or Proton installed for that to be possible at all).
    – Austin Hemmelgarn
    Feb 1 at 15:50
7

I found this, which seems to indicate that it may have already been removed by clamav. Indeed, it no longer seems to be a problem for us.

https://www.mail-archive.com/clamav-users@lists.clamav.net/msg51536.html

"Next a check to see when that signature was added shows that it was just yesterday and further that it was dropped today, so clearly an indication that it was found to be incorrect."

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.