On Wednesday, I installed an old copy of Ubuntu 10.04LTS onto a pristine desktop PC that I built w/ brand new hardware--DSL modem, too--except for the CPU. Then, I downloaded Ubuntu 12.04 from Ubuntu.com, and compared hash values before erasing v10.04 & installing the new OS. The old 10.04 disk & the virgin CD onto which I burned the Ubuntu v12.04 ISO file are the only external media this PC has seen.

As a new convert to Open Source & a paranoid ex-Windows user (for good reason), I have been scanning every file I download, and randomly scanning the entire system every few hours, with ClamTk. It found trojans in

• Ubuntu's built-in Ruby program;


• a Photoshop file and


• a SysInternals tool I downloaded last night; and


• several files in the Firefox cache.

All but one malware specimen belong to the same family. When instructed to quarantine the infected files in the Firefox cache, ClamTk appeared to do so but the quarantine list was empty. As a precaution, I emptied the cache. Note: ClamTk REFUSES to quarantine the infected Ruby & Photoshop files. Is that normal?

Google provided sparse info about the trojans, except they were first noted about 10 years ago. There does seem to be a surge of inquiries about them in Google over the past 2 weeks. It's unlikely that Ruby has had a known trojan all this time, that ClamTk simply ignored till now... I doubt these malware are false-positives.

Some questions:

1. Is anyone else finding PUA.Win32.xxxxx with ClamTk?



2. Is Ubuntu naturally immune to malware named "Win32"?

   
   
   

   Actually, what compels me to post here is finding, while I was checking my Firefox Preferences, six DigiNotar entries in the list of security certificates (Advanced-->Encryption-->View Certificates). The IT security world ostracized DigiNotar last Fall, & Mozilla permanently removed DigiNotar from its list of approved certification providers (see http://blog.mozilla.org/security/2011/09/02/diginotar-removal-follow-up/).

   
   
   

   So, I am wondering:



3. Did Ubuntu developers forget to remove DigiNotar from Ubuntu's version of Firefox in v12.04?


4. Does anyone else have DigiNotar in your list of certification authorities?


5. Are the DigiNotar certificates and the trojans I am finding related?

Thanks for any information you can provide.