Removal of virus from your home directory

Virus on stud

ITEA is frequently scanning all the home and shared directories for viruses. This is an automated program, so nobody will see who has which files in their home directories. If the program finds an infected file, the owner of the file will recieve an email with a list of the infected files (this email is sent to the mailing list if found on a shared directory), with a request to disinfect the files before further use.

The program will also automaticly remove all read and write permissions for the infected files, so you won't accidentaly open them and infect other machines. This means you can't run or delete the files in Windows.

How to remove the infected files?

1. Update the virus definitions for your antivirus program. If you don't have an antivirus program you can get F-Secure Antivirus from Orakeltjenesten or from progdist
2. Log in with ssh to login.stud.ntnu.no or login.ansatt.ntnu.no. For a small introduction to UNIX you can read this article.
3. If you want to remove the files use the rm filename command
4. If you want to disinfect the files use the chmod u+rw filename command to change the permissions. Disinfect the files by connecting to your home directory and running your antivirusprogram on the infect files

If you just want to delete the infected files

If you do not need the infected files and just want to remove them it's easiest just to type: rm filename in the ssh connection. You can do this through Windows by rightclicking the file and choose "Delete". Remember, to do this you have to change the permissions through the ssh connection first.

If the file contains spaces(e.g. My document.doc) you must include quotation marks around the file name: rm "filename with spaces in it"

You'll get the following question: rm: remove write-protected file `filename'?

Press "y" to confirm the deletion.

If you want to disinfect the files and keep them

If you want to keep the files, you need to disinfect them before you can use them. If you don't disinfect the files, the virus can spread to computers you access the files with.

First we need to change the permissions on the affected files. To do this we use the command chmod.

A typical example would be: chmod u+rw filename

If the file contains spaces (as the example mentioned earlier, "my document.doc") you need to use quotation marks around the file name chmod u+rw "A long letter to mom.doc"

After the right read and write permissions has been added you need to disinfect the files with an antivirus program.

Disinfecting the files

How you disinfect the files depends on how your antivirus program works. If you're on a computer in a computer room on NTNU the program F-secure antivirus should be installed. You can also do this from a computer at home or a laptop on the wireless network on NTNU. You can use other antivirus programs, just make sure the virus defintions are up to date!

F-Secure Antivirus is installed on many computer rooms on NTNU. You can see that it's active and installed on the machine you're on if there is a small blue triangle shaped like an "F" in the system tray (by the clock on the bottom right). After you've made sure that the program is active and the virus definitions are up to date connect to your home directory. With F-secure just rightclick on the directory you want to scan and select "Scan Folder for Viruses". A dialog window should appear and guide you through the process of disinfecting the viruses if the scan finds any.

If you want to keep the viruses

Make a folder named virus in your home directory and place the virus there. This folder will not be scanned for viruses by the automatic program running on the servers.

The folder does not have to be directly placed in your home directory, f.ex: "school/virus-class/virus/evil_virus.exe"