Text 6658, 161 rader
Skriven 2006-08-01 06:56:20 av WAYNE CHIRNSIDE (1:123/140)
     Kommentar till en text av MAURICE KINAL
Ärende: Hijacked
================
-> Hey WAYNE!

-> Jul 31 20:23 06, WAYNE CHIRNSIDE wrote to MAURICE KINAL:

->  WC> Got an unpleasant surprise.
->  WC> Someone jacked my Linux box :-(

-> Ouch!

->  WC> All I can figure is the default settings for the apt.list
->  WC> file included some risky defaults.

-> I don't use anything like that so I am not sure.  Do you run it as root?

Only time I operated as SU is during apt-get or when configuring my user
account. 
Originally unknown to me the default setting configurations
in apt-get were high risk. 
I fixed that but it's too late now. 

There's a root SU account hiding in a hidden partition  
operating outside of my control and nothing stops it.

Linux fdisk, cfdisk, mkfs, Dos fdisk, format, Win 98 fdisk all fail to
clear this crap.  
Fdisk /mbr fails too.
Norton wipeinfo fails also.

Reminds me nothing so much as a Compaq P.C.'s hidden partition ( which
is why I hate Compaqs.)
 
Even Linux fdisk in expert mode  doesn't touch this bugger.
Fdisk the hard drive, check the settings and it looks ok but reboot
and the previous partitioning scheme is tossed and the invader 
has repartitioned the hard drive.                 
It never really got repartitioned as the hard drive geometry has been
messed with but you wouldn't know until you rebooted and looked

Something written to the superblocks, ( whatever they are) persists
and prevails over attempts to restore the hard drive.

This is both subtle and a big hammer attack both at the same time.
Dos's fdisk gives me "can't delete a network" when I try to delete    
the partition with Dos.
Depending on the tool I throw at it it's either a network, dos
partition or non-dos partition.
What it won't do is die.

->  WC> 5 percent is reserved for SU ( 24679855 blocks) but it ain't me :-(

-> Hm.

->  WC> Somehow I've been jacked and every time  I load mail it prompts for 
->  WC> how do I handle this file, save to disk?

-> Whoa.  I am not sure what it is trying to save.  Again, is this a root
account?
                        
Neither am I, sure that is.
It _appears_ this hidden partition retains data for Mozilla and
Konqueror as both take me right to a fraudulent web side for 
a online P.C. adware and trojan scan.     
On a _clean_ install, which isn't in fact clean Mozilla snags
"Netscape preferences" and loads them.
My name appears in the email account without my ever having entered it.
Has to be hiding either in the hidden partition, superblocks or even the
slaved hard drive.

Then on the first use of mail it says "I don't know how to handle this",
open it with ? or save to disk?                                

Think it's "Spy Killer" or some such ( web site it takes me to.)
Anyway with my default home page being google that's where
the browsers take me as soon as I log on ( Spy Killer)

->  WC> Well I don't do it but it gets in anyway.

-> That isn't right.

->  WC> Any suggestions?

-> Looks like you should probably reinstall from scratch and make sure lilo is
run
-> from whatever you boot/install from with absolutely *NO* networked installs.

-> Do you have a CD install?  If not you should get one.  How did you install
the
-> last time?  However it was don't do that.

I need to get a clean hard drive.

I have a installation CD and I'm working from a _clean_ install now
however it's no use.
It's on the hard drive and I can't purge it.
Some file created by Lilo fails when I try to either delete or recreate
it. 
Something like /boot/boot.0.003 ( read only) is the error message.
I don't trust apt-get.
I don't trust any floppy I've used in the last week, nor either hard
drive.
Even mr. modem and mr. keyboard are no longer my friend :-(

With 5 percent of a 20 gig hard drive this malware has a large bag of
tricks it can dip into.
There's even a cron job by root scheduled for 12:14 A.M.
Not *my* cron job but a hidden SU in that phantom partition
that keeps recreating itself.               

->  WC> I figure I'm rooted or have a trojan but am well over
->  WC> my head here.

-> Could be.  I've never seen that happen but it is quite possible.

I've never seen anything remotely like it myself.
In expert mode fdisk ought to be at least able to mangle the hard drive 
however this phantom SU account hiding in the hard drive geometry
won't even allow that.                      
Damn thing almost acts intelligent it's so sneaky and devious.

I've got to stay offline and assume everything I've typed
has been logged and forwarded.
My risks are huge.
Someone could be doing anything from online banking, child porn to
terrorism in my name and I wouldn't know a thing about it.
I just caught the system acting weird, went looking and don't like at
all what I've found. 

->  WC> I have to presume all my transactions are insecure :-(

-> I'd assume the same until you know better.

That especially sucks.
Being mobility impaired online banking is a necessity as I can't go
to the bank.
Now I dare not even use that.
I've just been warped into the stone age.

Someone has gone to a lot of trouble to mess with someone here.
Likely I just got caught up in a larger scheme as I'm small fish   
but in my situation the computer is all I've got and someone else
has got that now.
                 
Well, off to do a bit of surfing to read some newspapers however I can't
even open a mail account without being hijacked to that fraudulent "Spy
Killer" web site.
It ain't right to mess with a man's hard drive :-(            

All I've got left is some low risk web surfing and fidonet.
Can't even have an address list or mail account as this puts others at
risk.
Who knows what some clown is doing with the information he's harvested
here.
How much and what he's got is anyone's guess but the system, started
acting strange about three days ago then it became obvious I was messed
with.
Someone came a phone phishing last night for info or so it seemed.
Getting paranoid but then who'd a thunk fdisk would fail?
Even editting online here the system's acting strange.

--- Platinum Xpress/Win/WINServer v3.0pr5
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)