Text 6670, 262 rader
Skriven 2006-08-01 13:07:36 av WAYNE CHIRNSIDE (1:123/140)
     Kommentar till en text av MAURICE KINAL
Ärende: Hijacked
================
-> Aug 01 06:56 06, WAYNE CHIRNSIDE wrote to MAURICE KINAL:

->  WC> Only time I operated as SU is during apt-get or when configuring my 
->  WC> user
->  WC> account. 

-> Sounds to me like that is the culprit then.  I've never allowed myself to
use
-> stuff like that over the internet and anyone claiming that I need to have an
-> application that requires root access, including su, is treated with
extremely
-> high suspicion as to their motives or way of thinking, up to and including
-> Debian 'people'.

I had adhered to a similar cautious ethic... until.
Bedridden, no credit card I'm hesitant to ask for help.
Security issues keep me from using the debit card on the internet.
Upgrading via the internet seemed ideal until this bugger hit.

->  WC> Originally unknown to me the default setting configurations
->  WC> in apt-get were high risk. 

-> Anything that requires root access over a networked connection is
suspicious.

->  WC> I fixed that but it's too late now. 

-> Right.  I read further down.  Other then a secondary boot I don't know what
to
-> suggest.  Maybe mke2fs but if the geometry is screwed then that probably
won't
-> work either.  Another option might be to 'dd' the entire drive with
/dev/zero? 
-> Something like 'dd if=/dev/zero of=/dev/hda' and then see if it can be
fdisked

Quoting wrapped off page, is that /dev/zero?          
wish I'd tried it before I pulled the cables.
It's not especially easy for me to even pull cables nor are they
designed to be repeatedly plugged and unplugged.

-> after that.  If it were a tape then a magnet would fix it but I don't
recommend
-> that with harddrives.

Yeah, drive mapping. You'd need the manufacturers HD utility.
Now that's a thought, if only I had a unaffected hard drive :-( 

Wish I had a FIPS prepared boot diskette, that might just put the drive
right, or not, never seen fdisk fail let alone the fdisk x option.

->  WC> There's a root SU account hiding in a hidden partition  
->  WC> operating outside of my control and nothing stops it.

-> Weird.

->  WC> Norton wipeinfo fails also.

-> Norton is garbage.  They started off on the right foot but somewhere along
the
-> line got crappy.  Overbloated crap methinks.                   

Hey, it was on the old slaved Seage I was just bragging on getting
jumpered and working. Legacy software from when Nrton tools we're so
bad.
I gave it a shot.
Nothing appears to phase this beast.

->  WC> Reminds me nothing so much as a Compaq P.C.'s hidden partition ( 
->  WC> which
->  WC> is why I hate Compaqs.)

-> Another reason for me avoiding Compaqs.  The thing about them is all their
-> hardware is the same as everyone else's hardware but they insisted on
crippling
-> it further then everyone else other then maybe HP.  Given they are the same
-> company now it isn't hard to see why.

I was happy with my Dumpster Gateway untill this weekend,
Now it's RAMdrive only with 384 Meg of RAM.

->  WC> Even Linux fdisk in expert mode  doesn't touch this bugger.

-> Is that from a secondary boot?          

From the live CD boot.
The CD drive is read only.
No joy.
fdisk eXpert mode _appears_ to work.
Rebooting proves otherwise.
that this fiendish thing is clever I'll not deny.
Speaks of an intimate knowledge of the workings of hard drives,
programming  and fdisk.

->  WC> Fdisk the hard drive, check the settings and it looks ok but reboot
->  WC> and the previous partitioning scheme is tossed and the invader 
->  WC> has repartitioned the hard drive.                 

-> You need to try all that from a different boot device.  Sounds to me like
-> leakage.            

Let it try to leak into the read only CD or jump across the air where
power and IDE
cables once lay.
I've booted Win 98 OEM CD and fdisked.
Win 98 S.E. image file recovery disk.
I've booted to the Linux live CD, no joy.

->  WC> It never really got repartitioned as the hard drive geometry has been
->  WC> messed with but you wouldn't know until you rebooted and looked

-> Right.  I've seen that happen with Windows formatted drives.  I've even
showed
-> people that but they insist the *NEED* to do that so they are basically
-> screwed.  Go figure eh?

->  WC> Something written to the superblocks, ( whatever they are) persists
->  WC> and prevails over attempts to restore the hard drive.

-> That shouldn't happen.
                                         
But it does, relentlessly.
Changed my online banking account passwords, after yanking cables
and rebooting CD.
Got an email to the effect my password had changed but their web site
shows no record of having sent this though it provides precisely this
tracking for security purposes.
Of course the email warning had a file attachment.
Also of course I'd just set all the account settings into RAM then
had to cold boot to find the warning was a phishing expedition.

->  WC> It _appears_ this hidden partition retains data for Mozilla and
->  WC> Konqueror as both take me right to a fraudulent web side for 
->  WC> a online P.C. adware and trojan scan.     

-> Neither of those gets airtime on any machine here.  I hate that stuff and
now
-> you just gave me another reason to continue hating that stuff.  Again,
-> overbloated crap methinks.                            

A little late I'm becoming a convert but with little else I can do 
it's diverting at least, or was.
Can't even do flash now without downloading to RAM
and installing to same.

->  WC> On a _clean_ install, which isn't in fact clean Mozilla snags
->  WC> "Netscape preferences" and loads them.

-> Get rid of it.      

Along with the hard drive. 
it came bacK with the CD however it's not a writtable CD drive.
I'd not trust even elinks from the infected machine.
Too much of what this malware is doing appears to be happening very
close to hardware level.   
Any access to either hard drive puts me at risk.

->  WC> My name appears in the email account without my ever having entered 
->  WC> it.

-> Wipe it out.
                          
With what?
I didn't try dd before pulling cables but all else.
fdisk was no joy even in expert mode so I'm skeptical dd
would work either though it's likely I'l try it in a few days
after I cable up a drive.
Too bad I soldered that slave or I could master it and use it, maybe but
I think even that little 340 Meg Seagate is affected.
It thinks it's got two FAT 16 partitions and a network drive letter
assigned.
Untrue, it's split three ways type C, 83, 83


->  WC> Then on the first use of mail it says "I don't know how to handle 
->  WC> this",
->  WC> open it with ? or save to disk?                                

-> Get rid of it.

->  WC> Think it's "Spy Killer" or some such ( web site it takes me to.)

-> Never heard of it.  Sounds to me like corruption to the extreme.

not to be unduly dramatic but it _may_ be the end of computers
and independent living for me.
It just got to be too expensive renting hard drives.
Not a bad block between the two of them they're both worse than useless.

->  WC> I need to get a clean hard drive.

-> Right.                                                               

Somewhat unrealistic.
I can manage it this month _just_.
What of my bookmarks?                                     
what did it ride in on?
Apt-get or the Mozilla browser trojan I was reading about.
I can't trust my address.ldfi files on floppy as _something_
is riding in on something in preferences. 

->  WC> I have a installation CD and I'm working from a _clean_ install now
->  WC> however it's no use.

-> You need to wipe out the original before reinstalling else it'll probably
-> persist.  Also just install basics and ensure that everything absolutely
-> required is working properly before installing further.  Definetly don't
-> install Mozilla until you are sure that isn't where the funky stuff is
coming
-> from.

-> Do you like even Mozilla?             

Actually I rather do, or did, no do.
I don't know if that was the actual entry vector though it's highly
affected but when was the last time a browser trojan partitioned your
hard drive, or anyone's for that matter.
This thing doesn't look like it's limited to Mozilla, it owns my hard
drive through faking the hard drive geometry. 

->  WC> I've never seen anything remotely like it myself.

-> Me neither.  You probably should get a new install CD, one that has a
-> console/commandline option and basic tools.

This one has that as a boot option.
Still need a clean hard drive but I'd just be renting as I've no idea of
the entry vector of this monster.

->  WC> Damn thing almost acts intelligent it's so sneaky and devious.

-> Yeah.  Sure sounds suspicious.

It acts like it's thinking and it IS outwitting me.
Whatever I've tried has been anticipated.
I mean it prevents expert mode fdisk from allowing me to alter hard
drive geometry.

->  WC> Being mobility impaired online banking is a necessity as I can't go
->  WC> to the bank.
->  WC> Now I dare not even use that.
->  WC> I've just been warped into the stone age.

-> Ouch.

->  WC> Someone has gone to a lot of trouble to mess with someone here.

-> Right.  Quite a few jerks around that is for sure.

->  WC> All I've got left is some low risk web surfing and fidonet.
->  WC> Can't even have an address list or mail account as this puts others 
->  WC> at
->  WC> risk.

-> Whatever you are using for email get rid of it.

I got rid of ALL of it but to no avail.
Both drives are physically perfect with no bad blocks and they're both
useless. 
worse than useless, much worse.
--- Platinum Xpress/Win/WINServer v3.0pr5
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)