October 2023 - main

Transferring settings and data from Firefox and Thunderbird
by Bev Nicolson 02 Nov '23

02 Nov '23

It looks like I will be getting another laptop as my old one is reaching the end of the road. I want to be certain about what I'll be doing, hence asking. What I want to do is transfer all the bookmarks (I have *a lot*), passwords and settings for Firefox over. Is creating a profile the easiest way of doing that? I also want to ensure I have the folders of old emails saved in Thunderbird somewhere safe. Those are emails I have stored on the laptop, not online. Transferring Thunderbird's settings would be a bonus too. If I create a Thunderbird profile, will it do both of those things? Bev.

5 16

Re: Trojans....
by Peter Berrie 27 Oct '23

27 Oct '23

On Fri, 20 Oct 2023 12:00:02 +0100 main-request(a)lists.alug.org.uk wrote: Adam, Thanks for replying! > Have you ever saved or copied a browser cache onto this stick? No, this is the puzzling thing. I only seem to recall having used it on Debian. I've only used it to put some files on it which I then accessed from my laptop, which is also Debian. So I cannot think where these can have come from. I am wondering if possibly they were on the stick itself when I bought it. They are not going to be able to do anything in Linux, are they? I have also checked online and found a couple of similar trojans which MS AV says it detects, so they sound like Windows trojans. I am thinking now of having clamav run all night on my total Debian hard drive, in recursive mode. That ought to detect them, do you think, if they are on it? Is there anything else you would do? My laptop is dual boot, windows and Debian, so I will boot to windows and then run the MS AV in windows. I suppose run ClamAV in Debian after that. What a pain. But in Windows it would probably be a lot more than just a pain. Peter

3 2

Comparing XML files
by Mark Rogers 26 Oct '23

26 Oct '23

This has been driving me mad all afternoon. How can I compare xml files from the commandline? Specifically: If I have two XML files and one contains: ... <field name="A">ValueA</field> <field name="B">ValueB</field> ... and the other contains: ... <field name="B">ValueB</field> <field name="A">ValueA</field> ... ... then I consider those two files to be the same, but obviously a diff will not. How can I compare just the content and not the ordering/formatting/etc? -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0344 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

3 5

Re: Trojans....
by Peter Berrie 23 Oct '23

23 Oct '23

This gets even more puzzling. Running clamav now for about two days non stop (lots of timeouts) and I am getting many reports like this: LibClamAV info: Suspicious link found! LibClamAV info: Real URL: http://www.globalkap.com LibClamAV info: Display URL: https://secure.skype.com But I can't tell where its finding those links, and don't recall ever visiting them anyway. I am now going through and checking some of them, and often not finding anything odd about them except that the name of the url is different from where the link ends up. And often the Real URL seems to be in the name of a real entity, but one that does not own the domain linked to! For instance another reported suspicious link, new.egg.com, takes me to Yorkshire Building Society, and seems like the real site of YBS. This is apparently due to YBS having taken over Egg. This really was different, though legit. But globalkap, the Real URL doesn't go anywhere, the Display goes to skype login, as you would expect. And globalkap seems to be a variety of real entities, a pool vendor in Aix en Provence, or a salesforce automation outfit somewhere! Another one is equally weird: LibClamAV info: Suspicious link found! LibClamAV info: Real URL: http://smitherfamilykitchen.com LibClamAV info: Display URL: http://www.lloydstsb.com But actually the display URL doesn't go to what clamav thinks is the real one, but goes to LLoyds TSB as it should. Not that I ever recall having visited them! Then when I try to go to smitherfamilykitchen.com (either just http:// or http://www.) its showing Server Not Found. But SmitherFamilyKitchen seems to be a real place selling hot sauces, based in Texas! Though it apparently (oddly) does not have that domain, and I don't recall having ever heard of it before this. But why is it claiming that the display URL is different from the real one? It does not seem to be. The most unhelpful thing about clamav, at least run like this, is that it reports suspicion, but gives you no idea what to do about it, and if I wanted to delete these suspicious URLs I have no idea where to find them! Are they in bookmarks someplace? Or history? Who knows? Anyone have any ideas what to do? Is there any more useful AV to try? Peter On Fri, 20 Oct 2023 14:57:34 +0100 Peter Berrie <peter.northerly(a)gmail.com> wrote: > On Fri, 20 Oct 2023 12:00:02 +0100 > main-request(a)lists.alug.org.uk wrote: > > Adam, > > Thanks for replying! > > > Have you ever saved or copied a browser cache onto this stick? > > No, this is the puzzling thing. I only seem to recall having used it on Debian. I've only used it to put some files on it which I then accessed from my laptop, which is also Debian. So I cannot think where these can have come from. I am wondering if possibly they were on the stick itself when I bought it. > > They are not going to be able to do anything in Linux, are they? > > I have also checked online and found a couple of similar trojans which MS AV says it detects, so they sound like Windows trojans. > > I am thinking now of having clamav run all night on my total Debian hard drive, in recursive mode. That ought to detect them, do you think, if they are on it? Is there anything else you would do? > > My laptop is dual boot, windows and Debian, so I will boot to windows and then run the MS AV in windows. I suppose run ClamAV in Debian after that. > > What a pain. But in Windows it would probably be a lot more than just a pain. > > Peter main-owner(a)lists.alug.org.uk > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of main digest..."

2 1

Recommended Webcam?
by Steve Mynott 21 Oct '23

21 Oct '23

I've been successfully using a Asus cloudbook running "motion" from the Debian repos https://motion-project.github.io/ to detect motion, record and push video of the cat at her bowl while we've been on holiday but the internal webcam isn't that great. So I've basically solved the software problem but I'm looking at a better external USB (?) webcam Most of the commercial webcams I've seen seem to push people into expensive subscriptions which I don't care about but does anyone have recommendations for cheap, good quality webcams? It would be ideal to be being able to move it remotely and maybe start using it as a more general security cam? -- Steve Mynott <steve.mynott(a)gmail.com> rsa3072/629FBB91565E591955B5876A79CEFAA4450EBD50

2 1

installing Linux over Windows
by Bev Nicolson 20 Oct '23

20 Oct '23

I have done this before but I think I may need a little help. Finally got round to wresting the info from my old laptop. (Note that if the keyboard is stuffed, clicking on the human figure on the top right of the screen brings up an on-screen keyboard. You probably know this, but I pass it on anyway.) But to the point of this email. Stuck the usb drive in which has Mint on it and powered the laptop up. Clicked on ESC as it said that would bring the boot menu up. It did not. Not fast enough? What speed should I aim for next time? I found out how to shutdown before it got me all the way through the Windows set up so that's something. Thanks in advance. Bev.

4 8

Trojans....
by Peter 19 Oct '23

19 Oct '23

I took some files today to a local print shop on a usb stick to get them printed. They have the very sensible procedure that, when given files on a stick, they first insert the stick into a laptop which is not on their network, and scan it. The stick is a Maxell FAT32, and my systems are Debian 11. To my horror they came back and said it had trojans! There were two phishbank.ajy JSI:trojan.cryos.3892 This last had three copies installed, the first only one. I'm pretty confident these are not false positives, they get their systems and network from a very competent IT shop. I don't know what AV they use. They are a windows shop of course, so it will be one of the usual windows AV products. So I am pretty sure these trojans were the real thing. They asked what did I want to do. Leave them alone, delete them? I said delete, after making a note of what they were. At the moment I am downloading and installing clamav for my Debian installation. I did a scan of the Windows 10 VM that I have running in Virtual Box, using the MS antivirus that comes with Windows, and it came up clean. I'm also proposing to insert the stick, hopefully now disinfected, into my Debian system, copy a few files to and fro, and go back to the shop to see if it has got itself reninfected from Debian. Unlikely, but it seems like a useful precaution. Should I be worried, and what else should I do? Be grateful for any thoughts. The only other thing about my Debian machine that I've noticed lately is that on one Wordpress site I sometimes get a 429 too many requests error, in Firefox. This happens on first clicking on a link on the site or first visiting it, so there has not in fact been more than one request. Don't see how that could be related but thought it best to mention, just in case. Peter

2 1

Using testdisk to fix a corrupt thumb drive
by Mark Rogers 12 Oct '23

12 Oct '23

I have a thumb drive which is formatted to FAT32 but not recognized in Windows. Using "testdisk" I can find the partition OK, but testdisk reports: Disk /dev/sdc - 30 GB / 28 GiB - CHS 29327 64 32 Current partition structure: Partition Start End Size in sectors Warning: number of heads/cylinder mismatches 255 (FAT) != 64 (HD) Warning: number of sectors per track mismatches 63 (FAT) != 32 (HD) 1 * FAT32 LBA 0 1 1 29327 63 32 60063712 [DATADISC] If I select the partition and view files then i see what I expect to see, and I can manually copy off individual files from there. So from a data recovery perspective I have everything I need. However, if I try writing the partition information back using testdisk the thumb drive is still not recognised in Windows and if I reopen it in testdisk it reports the same issues. I tried changing geometry to 255/63 as testdisk suggested, but then analyse says "Bad relative sector". What do I need to do so that the disk is recognised in Windows? Mark -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0344 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

2 1