Possible trojan virus Clamtk

Hi I have a possible virus clam tk has flagged up.

/usr/share/tk8.6/demos/images/earth.gif Heuristics.Broken.Media.GIF.TruncatedImageDataBlock

I downloaded some photos from Dp-review about eight in all. I then noticed that the same jpegs were in all my fed36 vm downloads exept for vault so I ran clamtk it flagged up 130 possible issues with Libre Office + microsoft Exel files.
also a trojan. so I panicked wiped my beta version of qubes and downloaded 4.1 did a scan with
clamtk which was clear then went to dpreview downloaded nothing, but opend a photo online did another scan and this

/usr/share/tk8.6/demos/images/earth.gif Heuristics.Broken.Media.GIF.TruncatedImageDataBlock

came up again.As it did in beta, it says I dont have pemmission to erase it (root). How can I erase it in terminal and how did those jpegs get into every 36vm bar Vault?

whats about a sudo rm /usr/share/tk8.6/demos/images/earth.gif in the teminal of the affected vm?

Ok. But should I leave /usr/share/tk8.6/ alone in case they are needed later?

/tk8.6 looks suspicious. Assume I would delete this also also

Will do and get back later thanks.

sudo rm/tk8.6/demos/images/earth.gif : command not found.

If I put the whole command in will it remove usr/share?

rm: cannot remove ‘/tk8.6/demos/images/earth.gif’ : No such file or directory.

sudo rm /usr/share/tk8.6/demos/images/earth.gif

Seems to have done the trick will re scan and report.

no! It will delete the “file” at the end only. If you don’t have a file at the end of the string, it breaks up with an error, because the command of removing a folder is ‘rd’

and if you use rd -R /usr/share/tk8.6 it will delete tk8.6 and all folders downwards (demos, images and the file inside images)

No EVERY Fedora vm affected. including the Templates.
I opend each vm in turn and ran
sudo rm /usr/share/tk8.6/demos/images/earth.gif in the respective terminal
this deleted /tk8.6/demos/images/earth.gif` then wiped and reloaded 4.1.1
this seems to have cured the problem so I’m going to open dpreview again to see if it reoccurs. thanks for your help by the way.

1 Like