Non Existent App Showing in Tool Bar and Running!

General system Newbie
1

Some time ago, I had Koofr (a cloud storage) on my laptop. I used it from a downloaded app from their website ( https://koofr.eu/desktop-apps/ ).

A few months ago I quit, deleted my Koofr data folders, and the downloaded app, and everything went fine.

Strangely, last night rebooting my laptop, I found the Koofr icon in my tool bar! More strange I can click it and launch the Koofr app!!!

Searching from dolphin for koofr, there is nothing, no app, no folders, absolutely nothing!

[limo@asus ~]$ yay -Rc koofr
[sudo] password for limo: 
error: target not found: koofr
 -> exit status 1
[limo@asus ~]$ 


[limo@asus ~]$ sudo find / -name koofr | grep koofr
[sudo] password for limo: 
find: ‘/tmp/.mount_pcloudVSmUus’: Permission denied
/run/user/1000/koofr
[limo@asus ~]$

Then I deleted this folder /run/user/1000/koofr

[limo@asus 1000]$ ls
at-spi  dbus-1  gnupg         p11-kit     pipewire-0.lock  recoll-e49ae25c09bc6cf76c473faf09facf25-index.pid
bus     dconf   KSMserver__0  pipewire-0  pulse            systemd
[limo@asus 1000]$

Nothing koofr!
Strangely, rebooting it is there again! Both the icon in tool bar that I can click open, and the folder!

What’s going on? Do I have some malware? How an app that was just running from a downloaded file in a folder then deleted came back?
How can I fix this?

Update: I just thought to check autostart apps, and strangely I found it there! (remember my problem is that I totally removed it and it was not showing up for several months, but suddenly last night it is back!)

Update 2:
After removing from Autostart and rebooting, checking /run/user/1000/ it is not there!

How did it come to Autostart! How did it suddenly appear after 4 months!

2

There are two general Autostart-directories:

  • /etc/xdg/autostart/ for all users.

  • /$HOME/.config/autostart/ for you.

If the unused app is not in these two directories, maybe its hiding systemd service is currently enabled.

Check $ systemctl list-unit-files --state=enabled

If this app does not use systemd service, maybe it uses cronie instead systemd.

Check $ sudo crontab -l

1 Like
3

Thanks a lot @Zesko
This is the first folder:

[limo@asus autostart]$ ls
at-spi-dbus-bus.desktop      klipper.desktop                            print-applet.desktop
baloo_file.desktop           org.kde.kdeconnect.daemon.desktop          wallpaper-once.desktop
eos-update-notifier.desktop  org.kde.plasmashell.desktop                welcome.desktop
firewall-applet.desktop      pam_kwallet_init.desktop                   xapp-sn-watcher.desktop
gmenudbusmenuproxy.desktop   polkit-kde-authentication-agent-1.desktop  xembedsniproxy.desktop
kaccess.desktop              powerdevil.desktop
[limo@asus autostart]$

This is the second:

/home/limo/.config/autostart/

[limo@asus autostart]$ ls
appimagekit-pcloud.desktop  kopia-ui.desktop  recollindex.desktop
[limo@asus autostart]$

[limo@asus autostart]$ systemctl list-unit-files --state=enabled
UNIT FILE                          STATE   PRESET  
cups.path                          enabled disabled
avahi-daemon.service               enabled disabled
cups.service                       enabled disabled
firewalld.service                  enabled disabled
getty@.service                     enabled enabled 
NetworkManager-dispatcher.service  enabled disabled
NetworkManager-wait-online.service enabled disabled
NetworkManager.service             enabled disabled
power-profiles-daemon.service      enabled disabled
rslsync.service                    enabled disabled
sddm.service                       enabled disabled
systemd-timesyncd.service          enabled enabled 
avahi-daemon.socket                enabled disabled
cups.socket                        enabled disabled
remote-fs.target                   enabled enabled 
fstrim.timer                       enabled disabled
paccache.timer                     enabled disabled
snapper-boot.timer                 enabled disabled
snapper-cleanup.timer              enabled disabled
snapper-timeline.timer             enabled disabled

20 unit files listed.


[limo@asus autostart]$ sudo crontab -l
[sudo] password for limo: 
sudo: crontab: command not found
[limo@asus autostart]$

I don’t think I see it anywhere!
I wonder how did it come back though deleted and never showed up for over 4 months!
The most important, this Koofr is not a malware and I do not have malware?!

4

I checked current koofr PKGBUID, where would it be installed in your local:

  • $ ls -al /usr/share/applications/ | grep koo

  • $ ls -al /opt/ | grep koo

  • $ ls -al /usr/share/icons/hicolor/64x64/apps/ | grep koo

  • $ ls -al /usr/bin/ | grep koo

5

Thanks @Zesko
There is no trace of it!

[limo@asus ~]$ ls -al /usr/share/applications/ | grep koo
[limo@asus ~]$ ls -al /opt/ | grep koo
[limo@asus ~]$ ls -al /usr/share/icons/hicolor/64x64/apps/ | grep koo
[limo@asus ~]$ ls -al /usr/bin/ | grep koo
[limo@asus ~]$

It is strange how did it come back after being deleted and not showing for about 4 months and how did it run in the first place though I deleted it from the folder it runs from!

6

I would think it’s malware because it is the binary package like blackbox.

7

So, Koofr itself is malware?!!!
Well, what you suggest I should install, scan my laptop and remove any malware? Or better a fresh install from the latest ISO?

8

But I am not sure where exactly this toolbar is located? I thought KDE plasma panel, not toolbar?

9

Sorry. maybe I missexpressed the name, it is this bar/panel/strip in the bottom where on the most left the Strat button and to the right the clock, Klipper… etc. buttons!

10

Or if you have any Btrfs root snapshot older than 4 months, you can restore it, reboot and then chroot to your system via live USB and reinstall kernel when using systemd-boot. (Do not forget to remove kernels, then reinstall kernel)

11

I have but just to avoid a lot of work!
I am on BTRFS, Sanpper,… systemd-boot and yes for sure I have old snapshots. Maybe better start and try clamav first?

12

I never try to use clamav and can not answer. You can try it if it helps.

See: https://wiki.archlinux.org/title/ClamAV

13

You did not install koofr from AUR, but installed it from the website. I overread, sorry.

koofr binary would be installed in your home without using root privileges.

  • ls -al /$HOME/.local/bin/

  • ls -al /$HOME/bin/

1 Like
14

Thanks a lot @Zesko
I found /home/limo/.koofr/ and /.koofr-dist/
I better delete it all.

UPDATE:
I followed Best Free Antivirus and it is still running! I will see how it goes.
I noticed somehow in one of those folders there were some python scripts (dated like yesterday) and related to something i was playing with in python. So, maybe pyhton though somehow there is something related to what it does in theses folders and this is how it appeared again…

UPDATE 2:
from the root folder I did:

sudo clamscan -r -i | grep FOUND >> /home/limo/scan.txt

I will see how it goes.

I never thought I would ever install a anti malware software on Linux!

15

You forgot to say that you installed it, and how. Maybe you decompressed the downloaded koofr-b59bd52-linux-x86_64.tar.gz and executed a file named installer.sh in terminal, or double-clicked on a file named Install.desktop, and then answered/confirmed the destination folder path.
Just saying usual random thoughts :rofl: , after having checked the installation script :stuck_out_tongue_winking_eye: .

What exactly had you deleted? (paths)

That’s because you did not delete the program.
This is the reason we always suggest to not install programs manually, but with a PKGBUILD (or AUR). Then the system (pacman) always knows what needs to be deleted when asked to uninstall/remove (pacman -R).

This is a runtime folder, meaning it is deleted on shutdown and created when requested (by some program).

It was there all the time. Maybe you hadn’t noticed, or the icon was hidden.
I hope you can remember if you had installed it more than once, or additionally installed it as root (using sudo install.sh).

The 2nd folder is the program folder, and the 1st was probably data/cache, or similar.
Apart from ~/.config/autostart/koofr.desktop, there is no other autostart method installed, but the program could install something else (in your local user folder) when running. I didn’t see any source code link :wink: .

As for being a malware, whatever is not open source, you don’t know, but if it does not run as system/root, it can only harm your local (user) files. :no_mouth: .

1 Like
16

Thanks @petsam Yes, as far as I remember this is what happened.

I deleted the folder where I extracted the downloaded file! My bad, I thought install.sh would just copy some files to this folder and run from there not a real install!

I can say after about a year on EndeavourOS, this is the best advice to follow.

honestly I cant remember if I did it with sudo or not!

I doubt

Maybe this is the reason it appeared again!

Definitely not! I will never run an app as root!
But it is ok now, everything is fine. Maybe it was the python thing that got it back to life from where it was already installed while I thought it was gone by just deleting the folder I downloaded to.
Thank you all, for all your help!
An amazing distro and an amazing forum and community as usual!

1 Like
17

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.