Text 14078, 89 rader
Skriven 2010-03-23 14:20:00 av WAYNE CHIRNSIDE (1:123/140)
     Kommentar till en text av MAURICE KINAL
Ärende: Re: do do loo do do
===========================
-=> MAURICE KINAL wrote to WAYNE CHIRNSIDE <=-

 MK> Hey Wayne!

 MK> A 'killall firefox' in an xterm should have worked.

 > This was one smart malware, linux aware, f-prot aware

 MK> Perhaps but if 'killall firefox' doesn't work it suggests to me that
 MK> firefox itself is the malware.  Are you sure f-prot isn't the problem?

I did kill that process but offline I reinvoked it and it opened the same six
tabs it left me 
with as it opened a new tab every time I tried to close it at the GUI level. 


I am of the opinion Firefox is a vulnerabilty I've been aware of.

 > Gotta love that javascript :-(

 MK> What javascript?

Yeah, I get it.
I'm not as sharp as you to do everything at the command line.

However my cable provider and bank require javascript as well as some of the
entertainment sites I visit.

 > That's the one thing it did allow, minimizing or reducing the
 > screen.

 MK> Next time try 'killall firefox' and see if that works.  If that doesn't
 MK> work then jump to a root console and 'dhcpcd -k eth0' which will kill
 MK> the internet connection and then jump back to GUI and see if you can
 MK> just quit firefox.

Did that, actually dhcpcd -k -d eth0.

 > but rather freezing the system along about 1/3rd of the way
 > through its run.

 MK> Ah!  I've seen system freezes before.  That doesn't mean you have a
 MK> worm. As a rule freezes are related to funky hardware or drivers.

Nope, this was malware, no doubt about it.
My Firefox default page is "blank" however when reinvoked offline I still had
six tabs if malware site.

 MK> Could be bad memory, a flakey pci card or slot, etc.  

I routinely run memtest86 and in fact I've set it in lilo.conf as a boot
option.
No memory fault.

MK> Sometimes
 MK> conflicting hardware. 

Every trace of Nvidia is GONE.

MK> Things like that.  Having said that it sounds to
 MK> me like firefox got grabbed by a malicous web site and cannot escape in
 MK> which case killing the connection should free it.

Nope, I did that too.
This slimy sucker is very linux savy to write a beast like this.

 MK> If the only real reason for having firefox is to do your banking then
 MK> create an account that *only* does that.  That should save you some
 MK> possible future grief.  As for browsing the web I see no real need for
 MK> firefox.  99.99% pure crap.  If a text browser cannot access a web site
 MK> then that should be an indication of that web site's true value.

Sorry, I do crooksandliars.com, Jon Stewart, and my ISP home site requires
javascript.

 > Lots of referances to logging in  in /var just before fpscan froze.

 MK> What is logging?  You mean something from the outside is attempting a
 MK> login? If so what is it attempting a login to?  If it's attempting drop
 MK> to a shell from firefox that would be a huge security breach.

This I do not know.
It was a somewhat irritating experience.

F-prot has never failed me before and now it's going to be run as daemon.

... MultiMail, the new multi-platform, multi-format offline reader!
--- MultiMail/Linux v0.49
 * Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)