- luv-beginners - luv.asn.au

malware or not
by Peter Wolf 27 Dec '20

27 Dec '20

Hello, I have found numerous files being added to my /usr/bin folder.I want to know if one of them,a perl script is malware.I strongly suspect that it is malware.Unfortunately, I don't know enough about perl to be able to tell for sure.The script doesn't seem to work properly and seems to hang the perl interperetor.Be very careful running it.I will embed it at the bottom of this email.If it is malware and something new,please forward it to the relevant people.Thanks.The filename on my hard drive is function_grep.pl -------------------------------------------------------------------------------------------------------------------------------------- #! /usr/bin/perl -w # # Copyright 2000 Patrik Stridvall # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public # License as published by the Free Software Foundation; either # version 2.1 of the License, or (at your option) any later version. # # This library is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA # use strict; my $name0=$0; $name0 =~ s%^.*/%%; my $invert = 0; my $pattern; my @files = (); my $usage; while(defined($_ = shift)) { if (/^-v$/) { $invert = 1; } elsif (/^--?(\?|h|help)$/) { $usage=0; } elsif (/^-/) { print STDERR "$name0:error: unknown option '$_'\n"; $usage=2; last; } elsif(!defined($pattern)) { $pattern = $_; } else { push @files, $_; } } if (defined $usage) { print "Usage: $name0 [--help] [-v] pattern files...\n"; print "where:\n"; print "--help Prints this help message\n"; print "-v Return functions that do not match pattern\n"; print "pattern A regular expression for the function name\n"; print "files... A list of files to search the function in\n"; exit $usage; } foreach my $file (@files) { open(IN, "< $file") || die "Error: Can't open $file: $!\n"; my $level = 0; my $extern_c = 0; my $again = 0; my $lookahead = 0; while($again || defined(my $line = <IN>)) { if(!$again) { chomp $line; if($lookahead) { $lookahead = 0; $_ .= "\n" . $line; } else { $_ = $line; } } else { $again = 0; } # remove C comments if(s/^(|.*?[^\/])(\/\*.*?\*\/)(.*)$/$1 $3/s) { $again = 1; next; } elsif(/^(.*?)\/\*/s) { $lookahead = 1; next; } # remove C++ comments while(s/^(.*?)\/\/.*?$/$1\n/s) { $again = 1; } if($again) { next; } # remove empty rows if(/^\s*$/) { next; } # remove preprocessor directives if(s/^\s*\#/\#/m) { if(/^\#[.\n\r]*?\\$/m) { $lookahead = 1; next; } elsif(s/^\#\s*(.*?)(\s+(.*?))?\s*$//m) { next; } } # Remove extern "C" if(s/^\s*extern[\s\n]+"C"[\s\n]+\{//m) { $extern_c = 1; $again = 1; next; } elsif(m/^\s*extern[\s\n]+"C"/m) { $lookahead = 1; next; } if($level > 0) { my $line = ""; while(/^[^\{\}]/) { s/^([^\{\}\'\"]*)//s; $line .= $1; if(s/^\'//) { $line .= "\'"; while(/^./ && !s/^\'//) { s/^([^\'\\]*)//s; $line .= $1; if(s/^\\//) { $line .= "\\"; if(s/^(.)//s) { $line .= $1; if($1 eq "0") { s/^(\d{0,3})//s; $line .= $1; } } } } $line .= "\'"; } elsif(s/^\"//) { $line .= "\""; while(/^./ && !s/^\"//) { s/^([^\"\\]*)//s; $line .= $1; if(s/^\\//) { $line .= "\\"; if(s/^(.)//s) { $line .= $1; if($1 eq "0") { s/^(\d{0,3})//s; $line .= $1; } } } } $line .= "\""; } } if(s/^\{//) { $_ = $'; $again = 1; $line .= "{"; $level++; } elsif(s/^\}//) { $_ = $'; $again = 1; $line .= "}" if $level > 1; $level--; if($level == -1 && $extern_c) { $extern_c = 0; $level = 0; } } next; } elsif(/^class[^\}]*{/) { $_ = $'; $again = 1; $level++; next; } elsif(/^class[^\}]*$/) { $lookahead = 1; next; } elsif(/^typedef[^\}]*;/) { next; } elsif(/(extern\s+|static\s+)? (?:__inline__\s+|__inline\s+|inline\s+)? ((struct\s+|union\s+|enum\s+)?(?:\w+(?:\:\:(?:\s*operator\s*[^\)\s]+)?)?)+((\s*(?:\*|\&))+\s*|\s+)) ((__cdecl|__stdcall|CDECL|VFWAPIV|VFWAPI|WINAPIV|WINAPI|CALLBACK)\s+)? ((?:\w+(?:\:\:)?)+($\w+$)?)\s*$([^$]*)\)\s* (?:\w+(?:\s*$[^$]*\))?\s*)*\s* (\{|\;)/sx) { $_ = $'; $again = 1; if($11 eq "{") { $level++; } my $linkage = $1; my $return_type = $2; my $calling_convention = $7; my $name = $8; my $arguments = $10; if(!defined($linkage)) { $linkage = ""; } if(!defined($calling_convention)) { $calling_convention = ""; } $linkage =~ s/\s*$//; $return_type =~ s/\s*$//; $return_type =~ s/\s*\*\s*/*/g; $return_type =~ s/(\*+)/ $1/g; $arguments =~ y/\t\n/ /; $arguments =~ s/^\s*(.*?)\s*$/$1/; if($arguments eq "") { $arguments = "void" } my @argument_types; my @argument_names; my @arguments = split(/,/, $arguments); foreach my $n (0..$#arguments) { my $argument_type = ""; my $argument_name = ""; my $argument = $arguments[$n]; $argument =~ s/^\s*(.*?)\s*$/$1/; # print " " . ($n + 1) . ": '$argument'\n"; $argument =~ s/^(IN OUT(?=\s)|IN(?=\s)|OUT(?=\s)|\s*)\s*//; $argument =~ s/^(const(?=\s)|CONST(?=\s)|__const(?=\s)|__restrict(?=\s)|\s*)\s*//; if($argument =~ /^\.\.\.$/) { $argument_type = "..."; $argument_name = "..."; } elsif($argument =~ /^ ((?:struct\s+|union\s+|enum\s+|(?:signed\s+|unsigned\s+) (?:short\s+(?=int)|long\s+(?=int))?)?(?:\w+(?:\:\:)?)+)\s* ((?:const(?=\s)|CONST(?=\s)|__const(?=\s)|__restrict(?=\s))?\s*(?:\*\s*?)*)\s* (?:const(?=\s)|CONST(?=\s)|__const(?=\s)|__restrict(?=\s))?\s* (\w*)\s* (?:\[\]|\s+OPTIONAL)?/x) { $argument_type = "$1"; if($2 ne "") { $argument_type .= " $2"; } $argument_name = $3; $argument_type =~ s/\s*const\s*/ /; $argument_type =~ s/^\s*(.*?)\s*$/$1/; $argument_name =~ s/^\s*(.*?)\s*$/$1/; } else { die "$file: $.: syntax error: '$argument'\n"; } $argument_types[$n] = $argument_type; $argument_names[$n] = $argument_name; # print " " . ($n + 1) . ": '$argument_type': '$argument_name'\n"; } if($#argument_types == 0 && $argument_types[0] =~ /^void$/i) { $#argument_types = -1; $#argument_names = -1; } @arguments = (); foreach my $n (0..$#argument_types) { if($argument_names[$n] && $argument_names[$n] ne "...") { if($argument_types[$n] !~ /\*$/) { $arguments[$n] = $argument_types[$n] . " " . $argument_names[$n]; } else { $arguments[$n] = $argument_types[$n] . $argument_names[$n]; } } else { $arguments[$n] = $argument_types[$n]; } } $arguments = join(", ", @arguments); if(!$arguments) { $arguments = "void"; } if((!$invert && $name =~ /$pattern/) || ($invert && $name !~ /$pattern/)) { if($calling_convention) { print "$return_type $calling_convention $name($arguments)\n"; } else { if($return_type =~ /\*$/) { print "$return_type$name($arguments)\n"; } else { print "$return_type $name($arguments)\n"; } } } } elsif(/\'(?:[^\\\']*|\\.)*\'/s) { $_ = $'; $again = 1; } elsif(/\"(?:[^\\\"]*|\\.)*\"/s) { $_ = $'; $again = 1; } elsif(/;/s) { $_ = $'; $again = 1; } elsif(/extern\s+"C"\s+{/s) { $_ = $'; $again = 1; } elsif(/\{/s) { $_ = $'; $again = 1; $level++; } else { $lookahead = 1; } } close(IN); }

3 2

Re: [luv-beginners] Duplex not working on Samsung CLX 6260FW MF laser printer
by Trent W. Buck 25 Feb '20

25 Feb '20

[Re-CC'ing the list because I don't think this is secret or private.] Bruce Campbell wrote: > On 24/2/20 11:25 am, Trent W. Buck wrote: >> "Before you try any traditional vendor shit, see if the modern "driverless" approach works" etc. > Thanks for input Trent, have gone through "driverless" approach with help from user on Mint Forum. > > From your post tried changing > <-o sides=two-sided-long-edge> to > <-o duplex=duplexnotumble> > [but it] still prints out 2 single sided sheets. I found the support page here: https://support.hp.com/us-en/product/samsung-clx-6260-color-laser-multifunc… It looks like most or all 6260 models do at least *have* duplex print hardware. i.e. it's NOT simply that you're trying to print two-sided on a single-sided printer. I am too lazy to read the full manual. I would try poking around in the menus in case e.g. duplex module is turned off for some stupid reason. Good luck!

1 0

Duplex not working on Samsung CLX 6260FW MF laser printer
by Bruce Campbell 24 Feb '20

24 Feb '20

Cannot print double- sided in LM 19.3- Cinnamon using Master PDF Editor nor scan both sides of document with the same app or using gscan2pdf. Able to do both in Windows 10. Have tried doing same through USB connection as per a post I found online but this made no difference. I am mainly wanting to print double sided & after searching online scanning double sided would see more problematic. A experienced user on the Mint Forum has tried many ways to solve problem but to no avail. The Samsung “Universal Linux Driver “(ULD) is installed. This is frustrating as I have virtually moved from Win 10 to LM & this seems to be the last stumbling block to doing so. Any input on this would be greatly appreciated- Bruce -- *Bruce Campbell* PO Box 45 LOCH SPORT VIC 3851 (03) 90130156 _Mob: 0427 347 012_

3 2

Re: [luv-beginners] Computer security questions
by Peter Wolf 05 Jan '20

05 Jan '20

n 19/12/19 10:48 am, Piers Rowan via luv-beginners wrote: > > On 19/12/19 9:43 am, Piers Rowan wrote: >> >>> Very likely they are and have been.I have strong evidence of this >>> such as the following - >>> >>> - computer slow during startup,shutdown and general operation >>> compared to just after a fresh install >>> >>> ,I can tell because the fastest computer I normally use is a dual >>> core and have found these run quicker than hacked >>> >>> quad and 6 core computers for many /most applications when dual core >>> not hacked. >> >> >> How old it the computer? If you have dust in CPU fan then it will >> overheat and throttle the CPU so it doesn't overheat. (I just >> re-lifed a PC yesterdau for this reason). >> My computers are 10-20 years old and not overheating except for maybe 1 or 2 out of 20-30 computers. >> >>> >>> - After visiting dodgy websites that create dozens of connections to >>> residential computers with Firefox, >> >> >> Multiple connections are standard fare for advert laden sites. >> >>> >>> software updates no longer work and a change of password stops linux >>> Mint from starting up at all. >> >> >> That is strange. >> >> >>> >>> A check shows almost every file has had its permissions changed. >>> >>> - When apparently hacked ,some of my data (such as old important >>> looking photos) has mysteriously gone missing. >>> >>> - Firefox stops working with many websites when apparently hacked >>> and slows down dramatically. >>> >>> - excessive hard drive activity after I visit some websites,like a >>> search is going on. >>> >>> >>> - Once I found the "find" command running on one of my computers >>> using the command htop.It was taking a large chunk of CPU usage.I >>> never started the "find" command and it was running constantly. >>> >>> >> OK I'm guessing the HDD could be the issue - bad sectors would cause >> this behavior. >> >> Is it an old disk or a new SSD? >> >> I'm getting mostly the same thing on multiple computers (more than >> 10),they do have old hard (disk) drives.(5-15 years old) The above >> trouble has 90% gone after using my custom software to "stop the >> hacking".It's an interesting suggestion and although I very much >> doubt it is the cause, I can't definitively say that it's not.So I'll >> make a point of checking my hard drives. Thanks. > Thanks > _______________________________________________ luv-beginners mailing list luv-beginners(a)luv.asn.au https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-beginners

5 5

Re: [luv-beginners] Computer security questions
by Piers Rowan 18 Dec '19

18 Dec '19

On 19/12/19 9:43 am, Piers Rowan wrote: > >> Very likely they are and have been.I have strong evidence of this >> such as the following - >> >> - computer slow during startup,shutdown and general operation >> compared to just after a fresh install >> >> ,I can tell because the fastest computer I normally use is a dual >> core and have found these run quicker than hacked >> >> quad and 6 core computers for many /most applications when dual core >> not hacked. > > > How old it the computer? If you have dust in CPU fan then it will > overheat and throttle the CPU so it doesn't overheat. (I just re-lifed > a PC yesterdau for this reason). > > >> >> - After visiting dodgy websites that create dozens of connections to >> residential computers with Firefox, > > > Multiple connections are standard fare for advert laden sites. > >> >> software updates no longer work and a change of password stops linux >> Mint from starting up at all. > > > That is strange. > > >> >> A check shows almost every file has had its permissions changed. >> >> - When apparently hacked ,some of my data (such as old important >> looking photos) has mysteriously gone missing. >> >> - Firefox stops working with many websites when apparently hacked and >> slows down dramatically. >> >> - excessive hard drive activity after I visit some websites,like a >> search is going on. >> >> >> - Once I found the "find" command running on one of my computers >> using the command htop.It was taking a large chunk of CPU usage.I >> never started the "find" command and it was running constantly. >> >> > OK I'm guessing the HDD could be the issue - bad sectors would cause > this behavior. > > Is it an old disk or a new SSD? > > > Thanks >

1 0

Computer security questions
by Peter Wolf 18 Dec '19

18 Dec '19

Hello, I'm still having major problems with computer security of Linux Mint 19 MATE.I believe that with default settings ,this version of linux is unusable as it gets hacked in a few minutes by bots,mainly via firefox. I have not found any security measures to prevent this and have had to write custom software to stop the hacking or mostly stop it. I've found that the previously mentioned "firehol" firewall program doesn't stop the hacking,it maybe delayed it by a few days at first.The same goes for ufw,but maybe I'm not using it correctly.The default apparmor profile for firefox simply does nothing or close to nothing to protect the computer.I've written my own firefox apparmor profile which has worked reasonably well for weeks/months but is still not complete .I've also written my own active firewall program that blocks connections from all residential computers (which are probably mostly hacked and used as bots to hack other computers) and rented servers.This combination of programs as well as a few others not written by me ,like snort and fail2ban have mostly stopped the hacking but not completely.I haven't had to reinstall linux for a month or so on any of my machines.Unfortunately,recently, I've discovered that snort and fail2ban have been disabled on many of my machines and that the logviewer seems to not be working properly.So my questions are - what is the command to run the linux mint logviewer? (I normally run it from the menu) - is it normal for the linux mint logviewer to automatically switch viewing logs after a few seconds? (I strongly suspect not) regards Peter

3 3

computer security questions
by Peter Wolf 08 Oct '19

08 Oct '19

Hello, This is a follow up email in the hope that someone as confused as me might find it useful. I have solved my computer security issues for now using the following script. ----------------------------------------------------------------------------------------------- #!/bin/sh sudo apt install -y apparmor sudo apt install -y apparmor-profiles sudo apt install -y apparmor-profiles-extra sudo apt install -y apparmor-utils sudo aa-enforce /etc/apparmor.d/* fireholpath="/usr/sbin/firehol" sudo apt remove -y ufw sudo apt install -y firehol sudo crontab -u root -l > temp.txt if grep 'firehol' temp.txt; then echo "no need to update crontab" else echo "updating crontab" echo "@reboot $fireholpath start" >> temp.txt sudo crontab -u root temp.txt fi sudo firehol start --------------------------------------------------------------------------------------------- I don't know how smart the above script is , but it works for me.I found that the default firewall with linux mint (ufw) was not working effectively.At least with the default settings it comes with.My computers were getting hacked through using firefox with attackers gaining root access in about 20 minutes no matter how strong the password was.In such times, changing the hostname and password helped things temporarily. Enjoy your linux. regards Peter

3 2

Important
by Andrew Pam 27 Sep '19

27 Sep '19

From: Benjamin Conway <bjnconsulting(a)outlook.com> Date: 28/9/19, 1:13 am Dear Members of Linux users Victoria Hi, My name is Benjamin & I would really love some support. I would love to become a member. I am a Windows 7 user who runs a business through various computers. Although as I am sure you are aware Windows 7 support is finishing soon. I would like to ask if someone you know (perhaps even yourself), could assist me to install a linux system. For over 5 years I have avoided migrating to windows 10 as I hate it and I like Mac Hardware but I am not too savy with the software. I prefer to build my own computers and I have being using windows almost everyday since 1997, (I still have an old Windows 97 computer which still works). I used to use Linux in the 1990’s as a kid although now I am using Zorin OS 15 as a transition to a linux based OS, Based on my extensive research I believe I would be suited to either Fedora 20 or 30 or Pop_OS 19. I would really appreciate some help to install one of these OS systems onto my desktop. Sincerely, Benjamin J. Conway Principle Director BJN Consulting tel. 0451 480 462 e-bjnconsulting(a)outlook.com

1 0

computer security questions
by Peter Wolf 23 Sep '19

23 Sep '19

Hello, My questions are - how do I detect a suspicious network connection? - what sort of computer security tips do people have? Some background information regarding the above questions. Firstly as some of you may have noticed I have very little to no knowledge in this area.I am flat out running a business that is barely paying bills and probably cannot afford to buy security software, hire someone or spend much time on a computer security course. I believe my computers are getting hacked.I have noticed files being changed/added in dropbox that I definitely hadn't changed/added myself.Also at times I am no longer able to easily change my password or do updates.Also I have noticed that at such times web browsing can become very slow as well as the general speed of my computer.I am running Linux Mint 18.My solution to computer security has been to change my user password several times a day which seems to help.I do updates regularly and use relatively low spec computers (dual core machines) so that if there is a problem and someone else is using my computer I can notice it more easily.I always use regular hard drives so that any possible hacking cannot be done too quickly.I have also written a program to change the hostname on my computers and this seems to speed up my computers and web browsing for a while.When web pages start malfunctioning,changing the user password and computer hostname very often fixes it. I have noticed that problems seem to be correlated with how many network connections I see.I am thinking of writing a program to shut down any suspicious network connections as long as I know how to detect them.Buying security software may seem more cost effective but I don't trust commercial products because the seller always has a vested interest to encourage hacking etc to continue the sale of products and maintain subscriptions. Unfortunately I have no computers that can run the latest Qubes Linux. regards Peter

3 2

computer security questions
by Peter Wolf 21 Sep '19

21 Sep '19

On 20/9/19 11:04 am, Peter Wolf via luv-beginners wrote: >/Hello, />//>/ My questions are />//>/- how do I detect a suspicious network connection? />//>/- what sort of computer security tips do people have? />//>//>/Some background information regarding the above questions. />//>/Firstly as some of you may have noticed I have very little to no />/knowledge in this area.I am flat out running a business that is barely />/paying bills and probably cannot afford to buy security software, hire />/someone or spend much time on a computer security course. />//>/I believe my computers are getting hacked. /If you computer is hacked then stop there. Save your data, format everything and reinstall your operating system. You are time poor so that is the quickest option. ******* I often do that but I'm looking for something more efficient and a prevention. >/I have noticed files being changed/added in dropbox that I definitely />/hadn't changed/added myself. /There may be another explanation for this than being hacked. Are you using the Dropbox app or web interface? What are the files? Are they found on both your computer and the cloud? When using the Dropbox folder as an application data storage I have seen temporary files remain after the application exits. ****** I mainly use the dropbox app for the desktop.One file that was modified was a script to enable apparmor.It was changed so that it did ****** some weird stuff with grub files.The script was in the cloud and on my computer. >/Also at times I am no longer able to easily change my password or do />/updates.Also I have noticed that at such times web browsing can become />/very slow as well as the general speed of my computer.I am running />/Linux Mint 18.My solution to computer security has been to change my />/user password several times a day which seems to help.I do updates />/regularly and use relatively low spec /Changing your password will be of no benefit is someone has root access to your computers. >//>/computers (dual core machines) so that if there is a problem and />/someone else is using my computer I can notice it more easily.I always />/use regular hard drives so that any possible hacking cannot be done />/too quickly.I have also written a program to change the hostname on my />/computers and this seems to speed up my computers and web browsing for />/a while.When web pages start malfunctioning,changing the user password />/and computer hostname very often fixes it. />//>/I have noticed that problems seem to be correlated with how many />/network connections I see.I am thinking of writing a program to shut />/down any suspicious network connections as long as I know how to />/detect them.Buying security software may seem more cost effective but />/I don't trust commercial products because the seller always has a />/vested interest to encourage hacking etc to continue the sale of />/products and maintain subscriptions. / I have been using Linux distributions on workstations and servers for over 20 years. User accounts have been hacked in the past when users insisted on using dictionary based passwords. Each time the give away was the accounts were being used to send spam. A password reset stopped that activity. No one has ever gained root access. I hope this helps ******** Yes this helps,thanks,information is good. >//>/Unfortunately I have no computers that can run the latest Qubes Linux. />//>/regards Peter />//>/_______________________________________________ />/luv-beginners mailing list />/luv-beginners at luv.asn.au <https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-beginners> />/https://lists.luv.asn.au/cgi-bin/mailman/listinfo/luv-beginners /

1 0