I'm not happy - javascript exploit got me (I think)

Harrie · #1 September 16th, 2007, 01:34 PM

Was on my Linux machine this morning - Linux Mint Cassandra, which is basically Feisty Fawn underneath. I go to a site I use to host images at times, weblogimages.com I use Firefox instead of Opera because I never can navigate there with Opera. And I then entered a URL that would show whatever album I have there and bam, suddenly I'm going off to drivecleaner.com and things are flashing at me - basically this guy tells exactly the message I saw.

http://www.falvotech.com/blog/index....D-HARMFUL.html

I think I did click on the cancel button. (Unfortunately).

I took his advice and edited my hosts file. What else should I do? Is my Linux infected? I've never used a virus scanner or anything on Linux. I'd like advice on how to check my machine, please.

jmtjet · #2 September 16th, 2007, 05:28 PM

Sorry to hear of your problem. I don't know if this will help you now but will stop future infections. It's a Firefox add on called NoScript. It's designed to stop the very kind of hijack you encountered:
https://addons.mozilla.org/en-US/firefox/addon/722

As far as an anti virus apts for linux ClamAV seems to be a good one: http://www.clamav.net/

Hope this helps.

Harrie · #3 September 16th, 2007, 07:22 PM

Thanks, jmtjet. I wish I'd had NoScript in the first place. I used it a long time ago with Firefox, before I became an Opera fan. I'll go get it right now.

What I'm also worrying about is whether it's safe to use that site anymore too, weblogimages. I have a subscription there (paid) so if not, hey I want to ditch it.

Thanks about clamav. Yes, I'll have to check it out.

Harrie · #4 September 16th, 2007, 11:38 PM

ClamAV was run and the results were 0 infected files after scanning the whole drive. Feel a bit better!

**kage** · #5 September 17th, 2007, 03:14 AM

ClamAV only scans for Windows viruses and related malicious content. Don't panic though, it would scan for linux viruses if they existed. At present, there are not "viruses" for linux. There are exploits, however, but if you're running a reasonably updated system chances are you're already patched for any exploits.

Keep your system patched, don't run applications as root, and don't install things if you don't know what they do / trust their source. You won't have any trouble if you play by those rules.

Harrie · #6 September 17th, 2007, 12:34 PM

Thanks, Kage, thanks very much. I suppose I never realized that about ClamAV, actually.

By the way, I've visited your Tips for Linux Explorers a few times and it is really great. Awesome, in fact!