LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > General
User Name
Password
General This forum is for non-technical general discussion which can include both Linux and non-Linux topics. Have fun!

Notices

Reply
 
Search this Thread
Old 02-14-2011, 01:17 PM   #1
cwizardone
Senior Member
 
Registered: Feb 2007
Distribution: Slackware64-current & "True Multilib." PC-BSD.
Posts: 2,207

Rep: Reputation: 176Reputation: 176
Using Linux to clean up a Xp hard drive.


A friend, running XP SP3, clicked on a link in an e-mail from a "friend" and now has infected his computer with, "Trojan.RootKit.ZAccess."
I tried several things while at his keyboard, but nothing reported the trojan and anything I tried to install to find it was not allowed to run. I used the
AVG emergency boot disk, based a linux distribution, and it did not fine the trojan.
Finally, I took the drive out of his case, put it in a external USB case and plugged it into my Slackware Linux box. I ran ClamAV on it and it reported the Trojan.RootKit.ZAccess as mentioned above. I've found the infected file and all references to it, BUT even in Linux I cannot delete anything from the drive. Doesn't manner if I on as root or user. It won't even let me change the permissions.
Any ideas would be greatly appreciated (other than reformatting the drive).
 
Old 02-14-2011, 01:25 PM   #2
fordeck
Member
 
Registered: Oct 2006
Location: Utah
Posts: 520

Rep: Reputation: 61
Is it possible that the drive is mounted read only? Or that the file you are trying to delete has its attributes set to read only?

Regards,

Fordeck
 
Old 02-14-2011, 04:04 PM   #3
cwizardone
Senior Member
 
Registered: Feb 2007
Distribution: Slackware64-current & "True Multilib." PC-BSD.
Posts: 2,207

Original Poster
Rep: Reputation: 176Reputation: 176

Thanks for the "wake up call."
I blame the decaf.
 
Old 02-14-2011, 04:27 PM   #4
Latios
Member
 
Registered: Dec 2010
Distribution: Arch
Posts: 115

Rep: Reputation: 21
Quote:
Originally Posted by cwizardone View Post
clicked on a link in an e-mail from a "friend"
Blame that friend for not securing his computer, not for sending the email. If his computer is infected, the virus will email itself to all his contact list without him knowing about it
 
Old 02-14-2011, 10:32 PM   #5
cwizardone
Senior Member
 
Registered: Feb 2007
Distribution: Slackware64-current & "True Multilib." PC-BSD.
Posts: 2,207

Original Poster
Rep: Reputation: 176Reputation: 176
Quote:
Originally Posted by Latios View Post
Blame that friend for not securing his computer, not for sending the email. If his computer is infected, the virus will email itself to all his contact list without him knowing about it
Thanks. He has been so informed.
 
Old 02-15-2011, 02:14 AM   #6
Kenny_Strawn
Senior Member
 
Registered: Feb 2010
Location: /usa/ca/orange_county/lake_forest
Distribution: ArchBang, Google Android 2.1 + Motoblur (on Motortola Flipside), Google Chrome OS (on Cr-48)
Posts: 1,791
Blog Entries: 62

Rep: Reputation: 54
After Googling that rootkit, I have found that it happens to be a variant of the Agent.nsf Trojan, am I right? Definitely sounds like the email from a "friend" had to have really been an email from the Trojan itself as it resided on the friend's computer. To me, that sounds like the Trojan is trying to play botnet on your friend. The only way to stop the spread of the Trojan, unfortunately, is to format your friend's hard drive.

Fortunately, you can easily do this from a Linux Live CD, specifically an Ubuntu, Fedora, Debian, or Mint (or anything with a desktop environment that can run GParted) one. If the Live CD has GParted (which I'm sure Ubuntu does) then try the following:

Launch GParted (System -> Admin -> GParted on Ubuntu or anything GNOME-based). When GParted launches, select the drive to partition, but instead of partitioning it, select "Create partition table" from the Device menu. This will completely erase anything on the drive. After this, then you can create a new partition (ext4 is a good file system to use) that takes up the entire disk, and apply the changes. Then, use the Live CD's installer to install Linux to the drive.

But please, teach your friend how to use Linux if he doesn't know. If he learns all the open source alternatives to proprietary apps, that's great. If not, and he's more comfortable with Windows XP, then he can easily reinstall it (provided he has the XP CD).
 
Old 02-15-2011, 02:44 AM   #7
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Hanover, Germany
Distribution: Gentoo
Posts: 15,357
Blog Entries: 2

Rep: Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980
Quote:
Originally Posted by Kenny_Strawn View Post
The only way to stop the spread of the Trojan, unfortunately, is to format your friend's hard drive.
Definitely wrong.
Quote:
Launch GParted (System -> Admin -> GParted on Ubuntu or anything GNOME-based). When GParted launches, select the drive to partition, but instead of partitioning it, select "Create partition table" from the Device menu. This will completely erase anything on the drive.
Also wrong, it will erase nothing but the partition table. Also, I would consider this a malicious advice without pointing out to make a backup of valuable/important data first.
Quote:
After this, then you can create a new partition (ext4 is a good file system to use) that takes up the entire disk, and apply the changes.
Windows XP will not run on ext4.
Quote:
Then, use the Live CD's installer to install Linux to the drive.

But please, teach your friend how to use Linux if he doesn't know. If he learns all the open source alternatives to proprietary apps, that's great. If not, and he's more comfortable with Windows XP, then he can easily reinstall it (provided he has the XP CD).
What is the point with this? The owner of the computer is using Windows XP, not Linux. So what use has it to install Linux first (are you again trying to force people to Linux?) and after that reinstall XP? It would be a better advice to install XP, and let him use dual-boot or Virtualbox to get comfortable with Linux, without taking away the environment he is used to. You also seem to forget that their are still applications that have no compatible FOSS counterpart and will even not run with wine. People who have the need to use them have no benefit from running a Linux only machine.
I wonder why you still don't get that forcing people to FOSS is not the appropriate way.
 
Old 02-15-2011, 04:52 AM   #8
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Ubuntu 10.10, Slackware 64-current
Posts: 2,124

Rep: Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776
I agree that the nuke and boot approach to handling a virus or trojan is excessive. Typically malwarebytes does a very good job of removing these types of infections. One needs to download it using a clean system and put it on a memory stick under a non assuming name, copy it to the target system and run it under an assumed name. If this fails, there are other programs that can be effective such as hijack-this, but dangerous to use unless you know what you are doing.

If you need or would like help with Windows malware, I highly recommend this other forum. Some of the most knowledgeable experts in Windows malware that I have seen hang out there.
 
Old 02-15-2011, 12:57 PM   #9
MTK358
LQ 5k Club
 
Registered: Sep 2009
Posts: 6,443
Blog Entries: 3

Rep: Reputation: 713Reputation: 713Reputation: 713Reputation: 713Reputation: 713Reputation: 713Reputation: 713
Quote:
Originally Posted by TobiSGD View Post
What is the point with this? The owner of the computer is using Windows XP, not Linux. So what use has it to install Linux first (are you again trying to force people to Linux?) and after that reinstall XP? It would be a better advice to install XP, and let him use dual-boot or Virtualbox to get comfortable with Linux, without taking away the environment he is used to. You also seem to forget that their are still applications that have no compatible FOSS counterpart and will even not run with wine. People who have the need to use them have no benefit from running a Linux only machine.
I wonder why you still don't get that forcing people to FOSS is not the appropriate way.
What's wrong with suggesting him to use Linux? At least show him a live CD, it can't hurt anything.
 
Old 02-15-2011, 01:59 PM   #10
Alexvader
Member
 
Registered: Oct 2009
Location: Japan
Distribution: Arch, Debian, Slackware
Posts: 994

Rep: Reputation: 94
First time i installed Linux in a PC was because I was enough pissed off to nuke and boot xp away... because of Virus and Malware... never turned back...
 
Old 02-15-2011, 02:08 PM   #11
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Hanover, Germany
Distribution: Gentoo
Posts: 15,357
Blog Entries: 2

Rep: Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980Reputation: 3980
Quote:
Originally Posted by MTK358 View Post
What's wrong with suggesting him to use Linux? At least show him a live CD, it can't hurt anything.
Nothing is wrong with suggesting Linux. As I said, I would recommend to use dual-boot or Virtualbox, before nuking the Windows and take his used environment away from the owner of the PC. Of course a Live-CD will also work.
But that wasn't that what Kenny said, he didn't want to suggest Linux, he wanted the OP to erase the whole drive and just install Linux on a PC that even isn't his own:
Quote:
This will completely erase anything on the drive. After this, then you can create a new partition (ext4 is a good file system to use) that takes up the entire disk, and apply the changes. Then, use the Live CD's installer to install Linux to the drive.
That is in no way suggesting, that is forcing. And as I said before, a bad advice without mentioning to make a backup because of the complete data loss that is caused by this action.
Or in short: Suggestion is OK, forcing is not.
 
Old 02-15-2011, 04:31 PM   #12
eveningsky339
Member
 
Registered: Mar 2010
Location: Western Maine
Distribution: PCLinuxOS (LXDE)
Posts: 466

Rep: Reputation: 51
The best way to deal with a broken XP installation is to delete the OS, reformat the hard drive to ext3/4, and install a Linux distribution.

At least, that's what I keep trying to tell my wife for this computer.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Linux Distro that will securely clean hard drive? alime Linux - Distributions 7 02-01-2012 06:43 PM
Cannot clean hard drive bjh1225 Linux - Newbie 15 05-06-2009 12:45 PM
Need to wipe clean a hard drive 144419855310001 General 9 03-07-2007 11:48 AM
How do I format my single, clean hard drive to Linux? deanh2nd Linux - Newbie 2 06-26-2006 10:24 AM
Hard drive at 90%, need to clean up J3N7iL Linux - Hardware 2 08-11-2005 10:08 PM


All times are GMT -5. The time now is 07:05 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration