Text 6691, 104 rader
Skriven 2006-08-01 23:14:22 av WAYNE CHIRNSIDE (1:123/140)
     Kommentar till en text av PAUL ROGERS
Ärende: Hijacked
================
->  WC> Any suggestions?
->  WC> I figure I'm rooted or have a trojan but am well over
->  WC> my head here.

-> Yep.  Got Knoppix on a CD?  Got a DOS fubar floppy that's always
-> been write-protected?  

Been in the drive all day.

-> And best of all, have you got a
-> diagnostic from the drive mfr that will write 0's to every
-> sector of the drive--ON guaranteed clean bootable media?

off the Knoppix CD per Maurice.
dd if=dev/zero of=dev/hda

Looks like I've _also_ got a BIOS virus but I'm still researching that.

-> FIRST, PULL THE PLUG!  Take that puppy off the net until you
-> have it all cleaned up, and its chastity belt cinched-up tight! 

Well I haven't quite done that however there are no email accounts setup
so I can't pass much.
/dev/hda is wiped clean and harbors nothing anymore.

I'm limiting myself to telneting fidonet which I presume is safe
and browsing the web for information on BIOS viruses.

-> (See http://www.xprt.net/~pgrogers/Headline.html for
-> entertaining reading on that subject.)
                                   
noted and saved to RAM for mcopy to /dev/hdb1

-> You've got to sterilize that puppy and start over.  
   
Don't I know it.
It's underway.

-> If you're
-> VERY careful you might be able to boot knoppix and copy off any
-> text files you have to keep, but nothing executable.  Presume
-> everything that CAN be infected HAS BEEN infected.  Take no
-> prisoners! 

Got you and I'd already arrived at this conclusion.
I'm treating everything like it's got ebola.

-> I'd use the diagnostic to write 0's on eevry sector.  Then I'd

Per Maurice's advise I zero'ed out the drive.
BIOS virus next up on my hit list.

-> partition/format it for a DOS drive, then forget that, wipe out
-> those partitions, and repartition for Linux, making sure the
-> layout isn't the same as the original.  Then reinstall your
-> distro from CD/DVD.            

Yup, got there too.

-> I hope you're running a separate router/firewall.  
   
Uh, economic reality intrudes.
Only reason I've a computer at all is found parts in dumpsters
while walking the dog.
I revived a great little Gateway :-)

-> (See
-> http://www.xprt.net/~pgrogers/Firewall.html for suggestions.)  

copied for mcopy to slave.

-> Even so, run an iptables firewall on your workstation.  Enable
-> netfilter & state tracking (including ftp) in your kernel.

Slow down here a bit.
I'm going senile at warp speed here.

  Make
-> sure rc.d saves your iptables on shutdown & restores them on
-> boot BEFORE bringing up the network interfaces.  (My
-> init.d/iptables slams the doors if it cannot read the file.)
-> This works for me:               

That's good enough for me :-) noted. 
Do me another favor if you can as this is scrolling off the screen
and I'm working from a live CD boot to RAM.
You obviously put some thought into this reply.
Can you reset pointers or if saved as file send it to
kevlar@verizon.net???

I'm currently using Verizon's mail server for virtual memory storage.
My my all this malware sure is entertaining, NOT.

-> #!/bin/bash
-> # firewall.sh - Configurable per-host firewall for workstations.
-> # Parts James Stephens (jns@ias.edu)
-> # PGR was here 
-> # PGR Attitude: protect us from the big, bad world, and protect our
-> # LAN from rogue processes.
-> ######################################################################
-> function on 
->   echo "Firewall: enabling filtering"
--- Platinum Xpress/Win/WINServer v3.0pr5
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)