bug#25278: Possible virus found in icecat-45.5.1

bug#25278: Possible virus found in icecat-45.5.1

[dian_cecht]

Wanted to report a (possible) virus in icecat (45.5.1 for me, but someone on IRC
was using 45.3.0 with at least one identical checksum of one of the related
files). I'm not sure if this is a false positive, but I though it better to
report it than to ignore it. Better to draw attention to a nonissue than ignore
something dangerous.

I run clamdscan over my home directory daily and ran into a virus report using
it. I won't go into great detail of what I did, how, and why, but long story
short I removed any and all instances of the virus, rebooted, ran guix pull (I
had to remove files in /gnu/store because they were apparently infected. I
wasn't sure how or why, but I don't question viruses too much wrt what they can
and can't do), rescanned /gnu/store (which came out clean), then reinstalled
icecat. The relavant clamdscan output follows:

/gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/html5-video-everywhere@lejenome.me.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/jid1-KtlZuoiikVfFew@jetpack.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/spyblock@gnu.org.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/features/loop@mozilla.org.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/https-everywhere-eff@eff.org.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/omni.ja: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/jid1-KtlZuoiikVfFew@jetpack.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/html5-video-everywhere@lejenome.me.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/spyblock@gnu.org.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/features/loop@mozilla.org.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/https-everywhere-eff@eff.org.xpi: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/omni.ja: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/omni.ja: Win.Trojan.Toa-5370166-0 FOUND
/gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/omni.ja: Win.Trojan.Toa-5370166-0 FOUND

and for completeness sake, sha1sums of the files in question:


for i in $(cat pastebit-this.txt | cut -d':' -f1); do sha1sum $i; done
a0798a225f833c5fc495b7d34f842f6895430c05  /gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/html5-video-everywhere@lejenome.me.xpi
660a532ab26271d807484745549eb50c96e1d17d  /gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/jid1-KtlZuoiikVfFew@jetpack.xpi
d1f71a8f48fb67096fd2317593662c93427ec200  /gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/spyblock@gnu.org.xpi
2352c47726144e6f3b16dbbfd851767ec4da12f4  /gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/features/loop@mozilla.org.xpi
f514044393bbcb35fd416f8934cc5796668880de  /gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/https-everywhere-eff@eff.org.xpi
e33f82770d29052967ea554a64fa3c2abbaa654b  /gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/omni.ja
660a532ab26271d807484745549eb50c96e1d17d  /gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/jid1-KtlZuoiikVfFew@jetpack.xpi
a0798a225f833c5fc495b7d34f842f6895430c05  /gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/html5-video-everywhere@lejenome.me.xpi
d1f71a8f48fb67096fd2317593662c93427ec200  /gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/spyblock@gnu.org.xpi
2352c47726144e6f3b16dbbfd851767ec4da12f4  /gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/features/loop@mozilla.org.xpi
f514044393bbcb35fd416f8934cc5796668880de  /gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/extensions/https-everywhere-eff@eff.org.xpi
46a63a6d5a0fc94ee2646a6079cba38fb16715d9  /gnu/store/4jv2jr91pl7p7gwsi4bincvd19gn29hi-icecat-45.5.1-gnu1/lib/icecat-45.5.1/omni.ja
e33f82770d29052967ea554a64fa3c2abbaa654b  /gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/browser/omni.ja
46a63a6d5a0fc94ee2646a6079cba38fb16715d9  /gnu/store/90xjd0x6hylkcxhf3gg3xjzf5sm2aj4d-icecat-45.5.1-gnu1/lib/icecat-45.5.1/omni.ja

I'm hoping this is a false positive. I run Guix ontop of Gentoo and have also
found the same Trojan appearing in Firefox-related files in my home directory,
as well as in Wine directories (I didn't record the exact directories, but I
think they were something like ../drive_c/windows/sys?????/gecko/ or something
like that. Don't trust this 100%).

bug#25278: Acknowledgement (Possible virus found in icecat-45.5.1)

[dian_cecht]

I just wanted to add that I went ahead and ran icecat-45.5.1 then rescanned
~/.mozilla and nothing related to the virus popped up with the scan.

bug#25278: Acknowledgement (Possible virus found in icecat-45.5.1)

[ng0]

dian_cecht@zoho.com writes:

> I just wanted to add that I went ahead and ran icecat-45.5.1 then rescanned
> ~/.mozilla and nothing related to the virus popped up with the scan.
>
>
>
>
>

So this issue is done and can be closed?
-- 
♥Ⓐ  ng0
PGP keys and more: https://n0is.noblogs.org/ http://ng0.chaosnet.org

bug#25278: Acknowledgement (Possible virus found in icecat-45.5.1)

[Leo Famulari]

On Mon, Dec 26, 2016 at 12:11:13PM -0800, dian_cecht@zoho.com wrote:
> I just wanted to add that I went ahead and ran icecat-45.5.1 then rescanned
> ~/.mozilla and nothing related to the virus popped up with the scan.

Are the files with the same SHA1 hashes still present?

bug#25278: Acknowledgement (Possible virus found in icecat-45.5.1)

[dian_cecht]

On Mon, Dec 26, 2016 at 06:57:50PM -0500, Leo Famulari wrote:
> On Mon, Dec 26, 2016 at 12:11:13PM -0800, dian_cecht@zoho.com wrote:
> > I just wanted to add that I went ahead and ran icecat-45.5.1 then rescanned
> > ~/.mozilla and nothing related to the virus popped up with the scan.
> 
> Are the files with the same SHA1 hashes still present?

So I rechecked the files listed in this bugreport and yes, the checksums are the
same. However, they no longer list as viruses according to ClamAV. I checked my
logs and I'm assuming that a database update fixed a false positive (freshclam
updates the database every 2 hours on my machine, and, afaik, the virus
definition was added in the last day or two).

So it looks to me like it was simply a false positive.

bug#25278: Acknowledgement (Possible virus found in icecat-45.5.1)

[dian_cecht]

On Mon, Dec 26, 2016 at 08:24:15PM -0500, Leo Famulari wrote:
> On Mon, Dec 26, 2016 at 04:20:47PM -0800, dian_cecht@zoho.com wrote:
> > On Mon, Dec 26, 2016 at 06:57:50PM -0500, Leo Famulari wrote:
> > > On Mon, Dec 26, 2016 at 12:11:13PM -0800, dian_cecht@zoho.com wrote:
> > > > I just wanted to add that I went ahead and ran icecat-45.5.1 then rescanned
> > > > ~/.mozilla and nothing related to the virus popped up with the scan.
> > > 
> > > Are the files with the same SHA1 hashes still present?
> > 
> > So I rechecked the files listed in this bugreport and yes, the checksums are the
> > same. However, they no longer list as viruses according to ClamAV. I checked my
> > logs and I'm assuming that a database update fixed a false positive (freshclam
> > updates the database every 2 hours on my machine, and, afaik, the virus
> > definition was added in the last day or two).
> > 
> > So it looks to me like it was simply a false positive.
> 
> Good news!
> 
> You can close the bug by sending a message to
> <25278-done@debbugs.gnu.org>.

Good to know. Thanks.

bug#25278: Possible virus found in icecat-45.5.1

[David Craven]

> I'm hoping this is a false positive. I run Guix ontop of Gentoo and have also
> found the same Trojan appearing in Firefox-related files in my home directory,
> as well as in Wine directories (I didn't record the exact directories, but I
> think they were something like ../drive_c/windows/sys?????/gecko/ or something
> like that. Don't trust this 100%).

It's an anti-viruses business model to find viruses everywhere. That's
how they scare you into buying a license. They usually are overly
optimistic with declaring something a virus. Besides, what's a windows
virus going to do on a gentoo system?