Startup login joke virus, 2nd time now

I had Ubuntu 14… when i got this weird problem-- the CPU ran crazy, fan on high so i reboot. When it rebooted the login screen had a robot voice sounding something like the game from the 80’s called “impossible mission” saying something like “this is the green screen…” not very clear. There was also a screen capture of the login screen and this was now my wallpaper on the desktop. I’m thinking, “okay, i downloaded a bad app and this is obviously a harmless prank.” So, i format and install fresh, Ubuntu 15… then about a year goes by just fine and i download testDisk 7.0 from cgsecurity.org and run the program by opening one of the 3 executable files to recover an SD-card that got formatted. My CPU goes nuts, the fan starts to race and so i reboot and the same damn robot voice happens again!
I’ve just installed Ubuntu 16.04 LTS and i would love to know if anyone else has had this bug or whatever it was.
I did a search of all my .ogg audio files and none were the startup sound that i was hearing. Just really curious.

Yeah it’s definitively not a bug or a feature.
You have a security problem.

2 Likes

I seriously doubt that this is a virus … but just like @ouroumov stated You have a security problem

I suspect that some one has either physical or electronic access to your computer. The symptoms you described are probably a harmless prank … you should question by whom? and what’s next?

Consider enacting a bios password which will prevent most users from gaining access to a powered down computer.

1 Like

But be careful with that, especially if the machine is a laptop. A forgotten BIOS password is not something you can trivially recover from.

####Exactly

It’s not trivial for a desktop computer either. If one needs to insure exclusive access then one will power down the machine and will be forced to enter the password every time. Remembering a password used daily is probably not a problem.

Rule of thumb, never download stuff from the web that you do not trust, especially not on Linux where we have a nice repository set up.

2 Likes

See also:

1 Like

Well, that’s curious. I did not suspect it to be a security issue. I’m rarely ever “online” at all with Ubuntu. Once or twice a week I’ll watch Netflix and even then I have a second drive with winblows on it that I dual boot into. As for the apps I download for Ubuntu, they are all from trusted sites. I have no pirate anything on my Linux drives, as for my windows drives I have a but-load. If it were a security breach then why didn’t they change my password?

Security and online are NOT synonymous, certainly being responsible online is a portion of safe computing.

The symptoms described in your OP suggest to me that someone planted a prank on your machine. They probably meant no harm therefore didn’t change your password.

As to your statement I'm rarely ever "online" at all with Ubuntu
If my suspicion above is correct and this prank code wasn’t inserted by someone having physical access then it’s entirely possible the code was inserted via electronic access. Your statement indicates that you don’t often use a web browser or check email - this gives you an incorrect safe feeling. More than likely your computer is connected to the internet once you log in to Ubuntu. In order for internet isolation the network cable would have to be disconnected or a special login sequence that electronically severs the intern connection would have to be employed.

We have no idea about how your network is connected, nor how many individuals might be sharing the internet connection, nor if you use a password protected WIFI. The prank could have been inserted by a neighbor, roommate, any visitor to your home using your WIFI - there are numerous possibilities.

It’s also possible you got some nasty malware on windows and that it attacked your Linux drive.
Same machine.

I believe malware to be the most likely scenario. I connect via wifi, with a password, manually on both OS’s. When I’m not online I’m not connected and I don’t have any neighbors close enough to hack into my system. It’s all farmland out here. There are 5 other PC’s & Macs sharing the router in the house but I’m the only one using Linux. I’m thinking that it’s a dumb little program that I’m overlooking. I’ll find it eventually. What I find most curious is how it takes a screenshot of before I login and sets that as the desktop wallpaper. The sound is also mysterious as I can never find any audio files matching it, and I’ve played every audio file on my system! And why can’t I find any Linux malware descriptions that come close online?
Anyway, I’ll post any new discoveries.
Later…

1 Like

I agree - keep looking ! and yes please do post future findings.

I would not discount 5 other PCs based on the OS. There’s really nothing so unique about any one of these three OSes that would prevent an accomplished user from from installing a prank.

Do you have access to the admin account on the router? If so I suggest changing the admin account name and password. Additionally, providing you have the credentials, you can review the router log.

The router is part of Xfinity cable. I’ve never tried to gain access as admin.I believe the password is particular to the box and is permanent. I will check the log but everyone in the house has a tech level of a 5-year old–seriously. I may need to run an RJ45 cable direct to it to become admin.
Thanks

I would definitely change the password of your router/Wifi SSID instead of using what came by your ISP.

Any router can be accessed via a web browser, you just need to know the IP address of your router, if I want to access my router (as an example), I just open a web browser and type 192.168.2.3 in the address bar and then press enter, look at the web page of your ISP for further info about accessing your router and changing settings BUT BE CAREFUL WHAT YOU DO!. :smiley:

1 Like

Well, after had some problem with Nvidia driver, my screen goes blank when logged out, and then after rebooting, i had exactly the same problem.
My i couldn’t change my wallpaper, and i heard strange voice when i was logging in.

anyway, @bearthly, have you found any solution ?

Did you run a full system update in the meantime?:

Well, somehow the problem resolved.
Now my wallpaper is changeable and right-click functionality is back.

still don’t know the culprit, though

1 Like