"Virus" on a fresh install!

[junior-s]

I scanned my PC with Clamtk tonight and it reported a vitrus at /usr/lib/linuxmint/mintWifi/drivers/i386/WUSB54Gv4/rt2500usb.sys PUA.Win32.Packer.NspackDotnetNor-1

More details: http://img443.imageshack.us/img443/5438/seleo007.png

So what should I do?

PS: avast doesn't detect anything

[jungle_boy]

Nothing. Relax and enjoy your linux mint. The virus (if it is one) is for windows, not Linux.

[junior-s]

There's no relaxing, I can't even remove it with clamtk. I'll be installing Wine in a couple of hours and I don't want any malicious files in my computer.

The question is: How did I get it?

[junior-s]

Removed it from Terminal. Rebooted and the file was really gone.
Question is how did it get permission to be there?

[TheDynamicHamza21]

It doesn't look like a virus but driver for your wireless.
http://wiki.debian.org/rt2500usb


http://forums.linuxmint.com/viewtopic.p ... 83#p612772
http://forums.linuxmint.com/viewtopic.p ... 83#p612948

[junior-s]

Thanks. SInce I don't use WIFI I removed it. If anything the updated should re-download it, IF this file is legit.

[sammiev]

Clamtk gives a lot of false positives.

[TheDynamicHamza21]

Thanks. SInce I don't use WIFI I removed it. If anything the updated should re-download it, IF this file is legit.

Just checked my system I have installed as well. It's a legit file it's for a Linksys Wireless-G USB Network Adapter.

[Orbmiser]

Clamtk gives a lot of false positives.

Yep and all anti-virus programs on any platform give false positives.
As Clamtk isn't really a die-hard desktop antivirus so much as for gateway,network Mail server protection?
And seems to say so in their description. Or I am reading it wrong?

Don't know about all the paranoia lately about Linux as there are no real world in the wild viruses for Linux?
Don't use it myself on dual boot with windows7 and it has it's own protection.
And no way for a windows virus to get from my linux partition to infect my windows side. Unless I manually transfer an infected .exe to the windows partition which would be pretty careless of me.

If I was networked with windows machines I might install it to scan email files. And of course I was running a server.
But can any linux guru give some valid reasons for single desktop user has a need too?

I would think setting up a proper firewall and protecting your ports and such would pretty much bullet proof your system?
Than some infrequent and rare occurrence of a linux virus or a windows virus being transfered to a windows partition?

[junior-s]

I scanned with avast as well and it gave not infection results.

Which one is better, avast or clamtk?

[eanfrid]

It is (was) written in the documentation that enabling detection of PUA (Possibly Unwanted Applications) is rather unreliable - i.e. many in-depth admin and network tools are wrongly identified as "virusses". It leads to many false positives and then is (was) discouraged unless you know what you are doing with this option.

Edit: From clamav FAQ

What is PUA? I get a lot of false positives named PUA.*

With the release of ClamAV 0.91.2 we introduce the option to scan for Potentially Unwanted Applications. The PUA database contains detection for applications that are not malicious by itself but can be used in a malicious or unwanted context. As an example: A tool to retrieve passwords from a system can be useful as long as the person who uses it, is authorized to do so. However, the same tool can be used to steal passwords from a system. To make use of the PUA database you can use the --detect-pua switch for clamscan or enable it in the config file for clamd (add: DetectPUA yes). At this point we DON'T recommend using it in production environments, because the detection may be too agressive and lead to false positives. In one of the next releases we will provide additional features for fine-tuning allowing better adjustments to different setups. NOTE: A detection as PUA does NOT tell if a application is good or bad. All it says is, that a file MAYBE unwanted or MAYBE could compromise your system security and it MAYBE a good idea to check it twice.