Text 6743, 94 rader
Skriven 2006-08-03 20:44:00 av MARTIN ATKINS (1:123/140)
     Kommentar till en text av WAYNE CHIRNSIDE
Ärende: Hijacked
================
-=> WAYNE CHIRNSIDE wrote to MARTIN ATKINS <=-


 -> It takes a while to do its thing but let it go on to start doing
 -> a second pass before you shut it down. You can get it off the
 -> web but it needs compiling or it comes as an iso so i hope you
 -> have it on your CD.

 WC> I had the image file.
 WC> I can retrieve another copy if I need to do so and put it on floppy
 WC> without hard drive activity.

If you run it at the boot prompt before you call your knoppix config
files it runs without the hard disk being involved. No need for
a floppy. You run it the same way you call your config at the start.  

 WC> My question being, how would doing so assist in confirming a virus?

Your only assuming a BIOS virus. Strange behavior can sometimes be
RAM. Other than saying "strange behavior" your not giving much
information about how it manifests its self or why you suspect
the BIOS. 

WC> Having recently run memtest86 it's reassuring to know my memory ( the
WC> computer's RAM that is), is sound.

How recently? Things can go wrong over night and just because it
coincides with this hard disk problem doesn't mean they are related.

WC> Progress here but not entirely out of the woods yet.

I have just had a problem that is eerily similar to yours.

I booted my system and for some reason the first partition was
maxed out and wouldn't startx because there wasn't any room
on /dev/hda5. I knew this was wrong because that partition is
is over 3 gig and only carries root, boot and etc and what have
you. I did "df" and indeed it was full.

I deliberately crashed the system so i could do a partition scan
at the next boot. Boy did it scream about the full disk.

Here is similarity with yours in that it kept on about /boot/boot.030
and although i could get the prompt i couldn't startx.

I thought the worse and decided to back up the stuff on the low
level directory that i thought would help me if i needed to
reformat /dev/hda5. I used "mc" but just as i was about to get 
committed i decided to move every thing of that partition
i could and still have a working system. The idea being that
i might just free up enough room for X to start. I cleared
8 meg and bingo it was enough. I looked over the directory
but couldn't identify where all that space had gone.

I noticed though that Firefox wouldn't work and even if i called
an old version i had i still got nothing. I'm using Mandrive 2006
which has a prog that backs up all configuration files and
fortunately had backed up everything a few days previous.

I set it to reinstall and over write all configs, rebooted
and the problem was solved. Although Firefox still wouldn't
work (possibly because i had played with things). I reinstalled
the newest F/F version i had and tested it. As soon as it started
it upgraded it self to v 1.5.05. Coincidence???

I strongly suspect that Mozilla-Firefox had something to do with
this. Wow just as i was writing this message it updated to v 1.5.06.

Two updates in a week or so? Something is going on over there
so if i were you i would poke around Mozilla and see if there
is any chatter about this.

I can't confirm any strangeness with mail as i use Kmail so
when you get up and running again it might be a good idea to
use an unrelated mail client to the browser you use.

I think that /boot/boot.030 thing is not related to the problem
as i still have it in my /boot directory and it appears to be a 
grub thing. Strange though 'cos i don't use grub but the way they
mess with this stuff it might just be needed if i wished to change
the boot loader.

I'm pleased that through experience i always make a separate
partition /opt or /local last on the disk and this carries all
downloaded aps and backups but absolutely plays no part in 
the actual day to day running of the system.
 
I think this virus (if that is what it is) is poking itself into the
/boot directory or is in the Mozilla files somewhere.

Best bet is it's triggered by Mozilla.

--- MultiMail/Linux v0.47
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)