Text 6664, 145 rader
Skriven 2006-08-01 15:11:36 av Maurice Kinal (1:140/13.1)
   Kommentar till text 6658 av WAYNE CHIRNSIDE (1:123/140)
Ärende: Hijacked
================
Hey WAYNE!

Aug 01 06:56 06, WAYNE CHIRNSIDE wrote to MAURICE KINAL:

 WC> Only time I operated as SU is during apt-get or when configuring my 
 WC> user
 WC> account. 

Sounds to me like that is the culprit then.  I've never allowed myself to use
stuff like that over the internet and anyone claiming that I need to have an
application that requires root access, including su, is treated with extremely
high suspicion as to their motives or way of thinking, up to and including
Debian 'people'.

 WC> Originally unknown to me the default setting configurations
 WC> in apt-get were high risk. 

Anything that requires root access over a networked connection is suspicious.

 WC> I fixed that but it's too late now. 

Right.  I read further down.  Other then a secondary boot I don't know what to
suggest.  Maybe mke2fs but if the geometry is screwed then that probably won't
work either.  Another option might be to 'dd' the entire drive with /dev/zero? 
Something like 'dd if=/dev/zero of=/dev/hda' and then see if it can be fdisked
after that.  If it were a tape then a magnet would fix it but I don't recommend
that with harddrives.

 WC> There's a root SU account hiding in a hidden partition  
 WC> operating outside of my control and nothing stops it.

Weird.

 WC> Norton wipeinfo fails also.

Norton is garbage.  They started off on the right foot but somewhere along the
line got crappy.  Overbloated crap methinks.

 WC> Reminds me nothing so much as a Compaq P.C.'s hidden partition ( 
 WC> which
 WC> is why I hate Compaqs.)

Another reason for me avoiding Compaqs.  The thing about them is all their
hardware is the same as everyone else's hardware but they insisted on crippling
it further then everyone else other then maybe HP.  Given they are the same
company now it isn't hard to see why.

 WC> Even Linux fdisk in expert mode  doesn't touch this bugger.

Is that from a secondary boot?

 WC> Fdisk the hard drive, check the settings and it looks ok but reboot
 WC> and the previous partitioning scheme is tossed and the invader 
 WC> has repartitioned the hard drive.                 

You need to try all that from a different boot device.  Sounds to me like
leakage.

 WC> It never really got repartitioned as the hard drive geometry has been
 WC> messed with but you wouldn't know until you rebooted and looked

Right.  I've seen that happen with Windows formatted drives.  I've even showed
people that but they insist the *NEED* to do that so they are basically
screwed.  Go figure eh?

 WC> Something written to the superblocks, ( whatever they are) persists
 WC> and prevails over attempts to restore the hard drive.

That shouldn't happen.

 WC> It _appears_ this hidden partition retains data for Mozilla and
 WC> Konqueror as both take me right to a fraudulent web side for 
 WC> a online P.C. adware and trojan scan.     

Neither of those gets airtime on any machine here.  I hate that stuff and now
you just gave me another reason to continue hating that stuff.  Again,
overbloated crap methinks.

 WC> On a _clean_ install, which isn't in fact clean Mozilla snags
 WC> "Netscape preferences" and loads them.

Get rid of it.

 WC> My name appears in the email account without my ever having entered 
 WC> it.

Wipe it out.

 WC> Then on the first use of mail it says "I don't know how to handle 
 WC> this",
 WC> open it with ? or save to disk?                                

Get rid of it.

 WC> Think it's "Spy Killer" or some such ( web site it takes me to.)

Never heard of it.  Sounds to me like corruption to the extreme.

 WC> I need to get a clean hard drive.

Right.

 WC> I have a installation CD and I'm working from a _clean_ install now
 WC> however it's no use.

You need to wipe out the original before reinstalling else it'll probably
persist.  Also just install basics and ensure that everything absolutely
required is working properly before installing further.  Definetly don't
install Mozilla until you are sure that isn't where the funky stuff is coming
from.

Do you like even Mozilla?

 WC> I've never seen anything remotely like it myself.

Me neither.  You probably should get a new install CD, one that has a
console/commandline option and basic tools.

 WC> Damn thing almost acts intelligent it's so sneaky and devious.

Yeah.  Sure sounds suspicious.

 WC> Being mobility impaired online banking is a necessity as I can't go
 WC> to the bank.
 WC> Now I dare not even use that.
 WC> I've just been warped into the stone age.

Ouch.

 WC> Someone has gone to a lot of trouble to mess with someone here.

Right.  Quite a few jerks around that is for sure.

 WC> All I've got left is some low risk web surfing and fidonet.
 WC> Can't even have an address list or mail account as this puts others 
 WC> at
 WC> risk.

Whatever you are using for email get rid of it.

Life is good,
Maurice

--- Msged/LNX 6.2.0
 * Origin: The Pointy Stick Society XVIII - Don't know what I want (1:140/13.1)