LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Virus infested my laptops (dell 620 D820etc) 17. by doing a loopback on the cd rom cannot remove. (https://www.linuxquestions.org/questions/linux-newbie-8/virus-infested-my-laptops-dell-620-d820etc-17-by-doing-a-loopback-on-the-cd-rom-cannot-remove-4175587762/)

zuegma 08-23-2016 10:24 AM

Virus infested my laptops (dell 620 D820etc) 17. by doing a loopback on the cd rom cannot remove.
 
Hi!

I have been here before but have lost my original name and password

I had an hp ssd prostream 11. Tried to install Linux side by side. Made a mess. Along the way media was purchased to re install win 8.1 from ebay. We don't know what was on that usb. The hp Died. Our other machines are hanging on. This is quite a learning experience:

The virus enters through blue tooth. If you shut off all wired/wireless options in bios, it still is able to run

My access point and password has been changed 2 with my isp
All laptops have 17.1 machines are D620 lattitude (2)D820, (lattitude),E6400 (lattitude)


It takes over as root. It has it's own, Inode directory protected by root, /rofs

Then you start getting locked out of everything.
I have used the following to try to eradicate the pest.

1: Dban 2 per mchine doesn't touch it.

2. GParted showed where it was /dev/sda1/ but was unable to format, delete clear.

3. I went to a laptop with internet and followed the instructions to wipe hard disk using the shred commands, no command "shred"

Is there another way to wipe this without using the CD or the command? I have considered putting Dban on a USB (if possible) but am unreasonably afraid my last laptop will somehow join the ranks of the infected and I will be back to the Kindle again.

Any ideas?

lazydog 08-23-2016 10:59 AM

Quote:

Originally Posted by zuegma (Post 5594875)
Hi!

I have been here before but have lost my original name and password

Thou I have not checked, I'm sure there is a way to recover his on the login page.

Quote:

I had an hp ssd prostream 11. Tried to install Linux side by side. Made a mess. Along the way media was purchased to re install win 8.1 from ebay. We don't know what was on that usb. The hp Died. Our other machines are hanging on. This is quite a learning experience:

The virus enters through blue tooth. If you shut off all wired/wireless options in bios, it still is able to run
How do you know the virus entered through the blue-tooth? How do you not know the virus was on the software you bought off ebay? Bad move by the way. Never buy OS off ebay. If you have your license still you could always download it from Microsoft.

Windows 8

Quote:

My access point and password has been changed 2 with my isp
All laptops have 17.1 machines are D620 lattitude (2)D820, (lattitude),E6400 (lattitude)


It takes over as root. It has it's own, Inode directory protected by root, /rofs

Then you start getting locked out of everything.
I have used the following to try to eradicate the pest.

1: Dban 2 per mchine doesn't touch it.

2. GParted showed where it was /dev/sda1/ but was unable to format, delete clear.

3. I went to a laptop with internet and followed the instructions to wipe hard disk using the shred commands, no command "shred"

Is there another way to wipe this without using the CD or the command? I have considered putting Dban on a USB (if possible) but am unreasonably afraid my last laptop will somehow join the ranks of the infected and I will be back to the Kindle again.

Any ideas?
OK, you want to boot from a Live CD/DVD, preferably linux, so that it cannot become infected.
Next you want to look at the HD with fdisk

Code:

fdisk -l
Next you want to enter into the partition table by using the following:

Code:

fdisk /dev/<device id>
So in the first case you will see something like this;

Code:

  Device Boot      Start        End      Blocks  Id  System
/dev/sda1  *        2048    1026047      512000  83  Linux
/dev/sda2        1026048  976773119  487873536  8e  Linux LVM

In my case to edit the partition table I would enter fdisk /dev/sda
Be ware that you could have hda also. This all depends on the type of disk that is installed in the system.

Once you are in there you want to delete all partitions because you are infected with a virus and you cannot trust anything on the drive anymore.

At the prompt simple type a p

To list all the partitions. Next you can delete them but typing d
this will ask you which partition you want to delete. As said before you might as well go ahead and delete them all.

After you have deleted everything verify that there are no more by typing p again. You should see no partitions.
Now type w to write the partition to the disk.

Disk should now be ready to install everything new again.

jefro 08-23-2016 02:46 PM

"install win 8.1 from ebay." Well..... Why didn't you get it from HP?

Every device in your lan is suspect now. The only logical way is to wipe everything and replace with known clean software.

Almost top every distro can easily be put on a usb and run usually. It will have the ability to install software like AV and malware detection. You can also create a BartsPE or UBCD4Win usb with free tools. I'd run a few tools. I'd make the usb on some remote system. I'd remove all lan connections during re-installs.

zuegma 08-23-2016 03:11 PM

Thanks here's the results
 
2 Attachment(s)
PHP Code:

How do you know the virus entered through the blue-toothHow do you not know the virus was on the software you bought off ebayBad move by the wayNever buy OS off ebay. If you have your license still you could always download it from Microsoft.

Windows 8 

I don't know. All the other machines are Linux and the infected usb was never near them- assumption- You don't have to say it.

Code:

OK, you want to boot from a Live CD/DVD, preferably linux, so that it cannot become infected.
Next you want to look at the HD with fdisk

Done.

mint@mint ~ $ fdisk -l
mint@mint ~ $ fdisk /dev/<device id>
bash: syntax error near unexpected token `newline'
mint@mint ~ $ fdisk /dev/<device id>
bash: syntax error near unexpected token `newline'
mint@mint ~ $ fdisk /dev/sda
fdisk: unable to open /dev/sda: Permission denied
mint@mint ~ $ root
The program 'root' is currently not installed. You can install it by typing:
sudo apt-get install root-system-bin
mint@mint ~ $ sudo apt-get install root-system-bin
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
cfortran comerr-dev g++ g++-4.7 gfortran gfortran-4.7 krb5-multidev
libX11-dev libfreetype6-dev libftgl2 libgfortran-4.7-dev libgfortran3
libgl2ps-dev libgl2ps0 libgssrpc4 libkadm5clnt-mit8 libkadm5srv-mit8
libkdb5-6 libkrb5-dev libpcre3-dev libpcrecpp0 libpthread-stubs0
libpthread-stubs0-dev libroot-core-dev libroot-core5.34 libroot-geom-dev
libroot-geom5.34 libroot-graf2d-gpad-dev libroot-graf2d-gpad5.34
libroot-graf2d-graf-dev libroot-graf2d-graf5.34 libroot-graf3d-g3d5.34
libroot-graf3d-gl-dev libroot-graf3d-gl5.34 libroot-gui-dev
libroot-gui-ged5.34 libroot-gui5.34 libroot-hist-dev libroot-hist5.34
libroot-io-dev libroot-io5.34 libroot-math-mathcore-dev
libroot-math-mathcore5.34 libroot-math-matrix-dev libroot-math-matrix5.34
libroot-math-minuit5.34 libroot-net-dev libroot-net5.34 libroot-proof-dev
libroot-proof5.34 libroot-tree-dev libroot-tree-treeplayer5.34
libroot-tree5.34 libssl-dev libssl-doc libstdc++6-4.7-dev libx11-doc
libxau-dev libxcb1-dev libxdmcp-dev libxpm-dev root-plugin-geom-gdml
root-plugin-geom-geombuilder root-plugin-geom-geompainter
root-plugin-graf2d-asimage root-plugin-graf2d-x11 root-plugin-gui-guibuilder
root-plugin-hist-histpainter root-plugin-io-xml root-system-common
x11proto-core-dev x11proto-input-dev x11proto-kb-dev xorg-sgml-doctools
xtrans-dev zlib1g-dev
Suggested packages:
g++-multilib g++-4.7-multilib gcc-4.7-doc libstdc++6-4.7-dbg
gfortran-multilib gfortran-doc gfortran-4.7-multilib gfortran-4.7-doc
libgfortran3-dbg krb5-doc krb5-user gccxml root-plugin-net-netx
root-plugin-proof-xproof libstdc++6-4.7-doc libxcb-doc
Recommended packages:
root-plugin-graf3d-gl libroot-math-minuit root-fitter
The following NEW packages will be installed:
cfortran comerr-dev g++ g++-4.7 gfortran gfortran-4.7 krb5-multidev
libX11-dev libfreetype6-dev libftgl2 libgfortran-4.7-dev libgfortran3
libgl2ps-dev libgl2ps0 libgssrpc4 libkadm5clnt-mit8 libkadm5srv-mit8
libkdb5-6 libkrb5-dev libpcre3-dev libpcrecpp0 libpthread-stubs0
libpthread-stubs0-dev libroot-core-dev libroot-core5.34 libroot-geom-dev
libroot-geom5.34 libroot-graf2d-gpad-dev libroot-graf2d-gpad5.34
libroot-graf2d-graf-dev libroot-graf2d-graf5.34 libroot-graf3d-g3d5.34
libroot-graf3d-gl-dev libroot-graf3d-gl5.34 libroot-gui-dev
libroot-gui-ged5.34 libroot-gui5.34 libroot-hist-dev libroot-hist5.34
libroot-io-dev libroot-io5.34 libroot-math-mathcore-dev
libroot-math-mathcore5.34 libroot-math-matrix-dev libroot-math-matrix5.34
libroot-math-minuit5.34 libroot-net-dev libroot-net5.34 libroot-proof-dev
libroot-proof5.34 libroot-tree-dev libroot-tree-treeplayer5.34
libroot-tree5.34 libssl-dev libssl-doc libstdc++6-4.7-dev libx11-doc
libxau-dev libxcb1-dev libxdmcp-dev libxpm-dev root-plugin-geom-gdml
root-plugin-geom-geombuilder root-plugin-geom-geompainter
root-plugin-graf2d-asimage root-plugin-graf2d-x11 root-plugin-gui-guibuilder
root-plugin-hist-histpainter root-plugin-io-xml root-system-bin
root-system-common x11proto-core-dev x11proto-input-dev x11proto-kb-dev
xorg-sgml-doctools xtrans-dev zlib1g-dev
0 upgraded, 77 newly installed, 0 to remove and 34 not upgraded.
Need to get 44.2 MB of archives.
After this operation, 148 MB of additional disk space will be used.
Do you want to continue [Y/n]? Y
Err http://archive.ubuntu.com/ubuntu/ raring/main libgfortran3 i386 4.7.3-1ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libgssrpc4 i386 1.10.1+dfsg-4+nmu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libkadm5clnt-mit8 i386 1.10.1+dfsg-4+nmu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libkdb5-6 i386 1.10.1+dfsg-4+nmu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libkadm5srv-mit8 i386 1.10.1+dfsg-4+nmu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libpcrecpp0 i386 1:8.31-2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-system-common all 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-core5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-io5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-math-mathcore5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-geom5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-math-matrix5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-hist5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-graf2d-graf5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-graf2d-gpad5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-graf3d-g3d5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Get:1 http://archive.ubuntu.com/ubuntu/ raring/universe libftgl2 i386 2.1.3~rc5-4 [62.5 kB]
Get:2 http://archive.ubuntu.com/ubuntu/ raring/universe libgl2ps0 i386 1.3.6-1 [37.4 kB]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-net5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-gui5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-tree5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-gui-ged5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-graf3d-gl5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-math-minuit5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-proof5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-tree-treeplayer5.34 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-plugin-io-xml i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main zlib1g-dev i386 1:1.2.7.dfsg-13ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libssl-dev i386 1.0.1c-4ubuntu8
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main comerr-dev i386 2.1-1.42.5-1ubuntu4
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main krb5-multidev i386 1.10.1+dfsg-4+nmu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libkrb5-dev i386 1.10.1+dfsg-4+nmu1
404 Not Found [IP: 91.189.88.161 80]
Get:3 http://archive.ubuntu.com/ubuntu/ raring/main xorg-sgml-doctools all 1:1.10-1 [12.0 kB]
Err http://archive.ubuntu.com/ubuntu/ raring/main x11proto-core-dev all 7.0.23-1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libxau-dev i386 1:1.0.7-1
404 Not Found [IP: 91.189.88.161 80]
Get:4 http://archive.ubuntu.com/ubuntu/ raring/main libxdmcp-dev i386 1:1.1.1-1 [26.8 kB]
Err http://archive.ubuntu.com/ubuntu/ raring/main x11proto-input-dev all 2.2.99.1-0ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Get:5 http://archive.ubuntu.com/ubuntu/ raring/main x11proto-kb-dev all 1.0.6-2 [269 kB]
Err http://archive.ubuntu.com/ubuntu/ raring/main xtrans-dev all 1.2.7-1
404 Not Found [IP: 91.189.88.161 80]
Get:6 http://archive.ubuntu.com/ubuntu/ raring/main libpthread-stubs0 i386 0.3-3 [3,264 B]
Get:7 http://archive.ubuntu.com/ubuntu/ raring/main libpthread-stubs0-dev i386 0.3-3 [2,860 B]
Err http://archive.ubuntu.com/ubuntu/ raring/main libxcb1-dev i386 1.8.1-2ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libX11-dev i386 2:1.5.0-1ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libfreetype6-dev i386 2.4.11-0ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libpcre3-dev i386 1:8.31-2
404 Not Found [IP: 91.189.88.161 80]
Get:8 http://archive.ubuntu.com/ubuntu/ raring/main libxpm-dev i386 1:3.5.10-1 [91.0 kB]
Err http://archive.ubuntu.com/ubuntu/ raring/main libstdc++6-4.7-dev i386 4.7.3-1ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main g++-4.7 i386 4.7.3-1ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main g++ i386 4:4.7.3-1ubuntu10
404 Not Found [IP: 91.189.88.161 80]
Get:9 http://archive.ubuntu.com/ubuntu/ raring/universe cfortran all 4.4-14 [131 kB]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-core-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-math-mathcore-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-geom-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-plugin-geom-gdml i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-plugin-geom-geombuilder i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-plugin-geom-geompainter i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-plugin-graf2d-asimage i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-plugin-graf2d-x11 i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-plugin-gui-guibuilder i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-plugin-hist-histpainter i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libgfortran-4.7-dev i386 4.7.3-1ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main gfortran-4.7 i386 4.7.3-1ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main gfortran i386 4:4.7.3-1ubuntu10
404 Not Found [IP: 91.189.88.161 80]
Get:10 http://archive.ubuntu.com/ubuntu/ raring/universe libgl2ps-dev i386 1.3.6-1 [4,634 B]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-math-matrix-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-hist-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-graf2d-graf-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-graf2d-gpad-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-graf3d-gl-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-gui-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-io-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-net-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-tree-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe libroot-proof-dev i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libssl-doc all 1.0.1c-4ubuntu8
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/main libx11-doc all 2:1.5.0-1ubuntu1
404 Not Found [IP: 91.189.88.161 80]
Err http://archive.ubuntu.com/ubuntu/ raring/universe root-system-bin i386 5.34.00-1ubuntu2
404 Not Found [IP: 91.189.88.161 80]
Fetched 640 kB in 10s (60.9 kB/s)
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...+nmu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...+nmu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...+nmu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...+nmu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo....31-2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...buntu2_all.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu8_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu4_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...+nmu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...+nmu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...0.23-1_all.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...0.7-1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...buntu1_all.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo....2.7-1_all.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo....31-2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...ntu10_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu1_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...ntu10_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...buntu8_all.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...buntu1_all.deb 404 Not Found [IP: 91.189.88.161 80]
Failed to fetch http://archive.ubuntu.com/ubuntu/poo...untu2_i386.deb 404 Not Found [IP: 91.189.88.161 80]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
mint@mint ~ $ apt-get update
E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
E: Unable to lock directory /var/lib/apt/lists/
E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?
mint@mint ~ $ su
Password:
su: Authentication failure
mint@mint ~ $ sudo
usage: sudo [-D level] -h | -K | -k | -V
usage: sudo -v [-AknS] [-D level] [-g groupname|#gid] [-p prompt] [-u user
name|#uid]
usage: sudo -l[l] [-AknS] [-D level] [-g groupname|#gid] [-p prompt] [-U user
name] [-u user name|#uid] [-g groupname|#gid] [command]
usage: sudo [-AbEHknPS] [-r role] [-t type] [-C fd] [-D level] [-g
groupname|#gid] [-p prompt] [-u user name|#uid] [-g groupname|#gid]
[VAR=value] [-i|-s] [<command>]
usage: sudo -e [-AknS] [-r role] [-t type] [-C fd] [-D level] [-g
groupname|#gid] [-p prompt] [-u user name|#uid] file ...
mint@mint ~ $
mint@mint ~ $ root
The program 'root' is currently not installed. You can install it by typing:
sudo apt-get install root-system-bin
mint@mint ~ $ apt-get install root-system-bin
E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?
mint@mint ~ $ fdisk -l

I have the log that I turned on gor the session as well.

zuegma 08-23-2016 03:47 PM

Third party media- not advisable
 
1 Attachment(s)
Code:

Well..... Why didn't you get it from HP?
I called HP first, they stated that as it was out of warranty, there would be a charge of 79.99. I even had the embedded key code. HP is great, they have great reps. Sometimes you just get a person, like myself, that buys 3rd party software on ebay. I was unaware that I could download the media from windows.com. I didn't even look it up on google.

As above you will see my terminal output, but I had forgotten to mention that I went into disks to see what was going on and here is the screen shot. It should show if not I will send it again.

I burned Dban and the other distros at a friends house. After Dban that showed no errors and all good, I went on as a live user. The same routine happened again. I would turn on the laptop, choose CD in bios and start up. Then I was denied permissions.: To root, to users and groups etc etc. Oddly, when I checked the network connections, wifi was not listed but wired was. I had not plugged in the lan. I also went into Disks to see what was what and found the path used as well as the partition it was stored in and the file name. I have a screen shot:

kilgoretrout 08-23-2016 04:26 PM

Try running:
Code:

$ sudo umount /rofs
$ sudo losetup -d /dev/loop0

Post back your results. Also, what is on the 4.1GB usb drive(Mint?)? What, if anything is on the 100GB drive? The file that's generating that mess is /cdrom/casper/filesystem.squashfs; it will probably be readonly. That file generates the filesystem mounted at /rofs using a loop device, /dev/loop0.

IsaacKuo 08-23-2016 04:30 PM

Have you considered simply removing the hard drive from a laptop and reformatting it on a different (clean) computer? Make sure the BIOS of the new computer does NOT boot from the new hard drive, and there's no way for it to magically infect the clean computer.

The steps I would use are:

1) Remove 2.5" SATA drive from infected laptop.

2) Prepare a clean computer by going into the BIOS and setting it to boot ONLY from CD. Confirm that it boots up to the Debian install disc.

3) Attach the 2.5" SATA drive to the clean computer.

4) On boot, press F2 (or delete) to confirm it will boot ONLY from CD. Save; boot to Debian install disc.

5) Choose manual partitioning and delete all existing partitions. Create a new partition to install into.

6) Complete installation steps for a minimal system; DO install grub so the mbr gets overwritten by grub.

yancek 08-23-2016 06:31 PM

You make reference in your initial post to 17.1 on your laptops. Is that Linux Mint 17.1? In your other post you have an image of the Mint Desktop which clearly shows Mint 15 which has not been supported since January, 2014 so which are you using to try to install?

You also indicate you were trying to install Linux 'side by side'. Side by side with what? Did you originally have windows 8 installed when you tried this? Which installation type option did you select when installing Mint? If windows 8 was installed, was it using UEFI/GPT or MBR? Did u you install Mint with the same option?

When you tried the 'shred' command, were you using Mint? It might not be on the iso image but you could easily check with: which shred or whereis shred.

You also reference 'CD' which none of the recent versions of Mint will fit on. How are you trying to install/boot, DVD/flash drive or loop mounted iso?

It's hard to read (for me anyhow) the image but what you have highlighted looks like the loop mounted iso.

IsaacKuo 08-24-2016 08:27 AM

Yeah, the 930MB loop device in the screenshot has NOTHING to do with any virus. It's just the read-only squashfs file system from the Mint LiveCD currently booted. There's no way to erase that partition, obviously, because it's only a read only medium (the CD or DVD). It is mounted on /rofs.

If there's any virus to look for, it's not on /rofs or the squashfs loop device. Those are just normal components of the Mint LiveCD when you boot up from the CD/DVD. It would be the 100GB hard disc or the 4.1GB USB disk.

schneidz 08-24-2016 10:43 AM

the op is hard to follow.

what makes you think you have a virus (what unexpected behaviour is the pc demonstrating) ?

what os has the virus (linux-mint or windows) ?

at this point do you want to delete everything on the hd (then i would boot up something like gparted live-usb and run gparted as root (sudo gparted) and highlight the disk and partitions i want erased) ?

zuegma 08-24-2016 12:27 PM

After typing my response, workspace 2 opened up next to workspace to and all that was on the screen i.e, the terminal readouts, the open LQ. I did not open that window. The 100- I have no idea what that is- I don't have a sdc slot even. The 4.1 was me. I plugged it into the back usb: Why? I was copying the files that I could from The rofs.


Code:

d54@d5 ~ $ sudo bash
[sudo] password for d54:
d5 ~ # sudo umount /rofs
umount: /rofs: not found
d5 ~ #  sudo losetup -d /dev/loop0
loop: can't delete device /dev/loop0: No such device or address
d5 ~ #


lazydog 08-24-2016 12:48 PM

Are you sure it is even mounted?

Code:

mount

IsaacKuo 08-24-2016 01:47 PM

There is nothing to be concerned about with /rofs or /dev/loop0. These are normal components of the Linux Mint LiveCD that you can't get rid of.

Everything in the logs pasted above look like it is operating normally. It's simply a matter of the user not knowing or understanding what commands to type in. The first several commands fail because the user is not logged in as root. In order to log in as root in Mint, you can use the command "sudo su". Or you can simply not log in as root and put "sudo" before any command that must be run as root. But root or not, there's nothing you can do to get rid of the liveCD squashfs mount. Don't worry about it and move along.

I do not think there is any virus involved at all, at least not on the linux side.

zuegma 08-24-2016 01:47 PM

Isaac Kug: Thanks for the info on the loop and rofs- As for doing the sata- I don't think I can do that. I've already made a mess trying to figure out how to do that.

Yancek: Yes, I put dvds not cds (soory). I threw 15 in another machine, I was afraid to lose everything I had on this one. I do not have windows on any machines the 2 that came with windows pre installed I wiped prior to ever using them. The only one I ever used windows was on the original HP. They all are Linux. I am confusing myself here.I have over the course of trying to install a good distro, used unetbootin to make a bootable usb. I couldn't contact the modemmanager at Freedesk.org. I was denied permission on changing some items. I used bleach bit and received that 660 files could not be accessed. Trying to install software from the terminal came up with command not found that I just had used the day before. The list goes on. Here is a portion of the log about the wifi going as wired:


25.457653] pcmcia_socket pcmcia_socket0: cs: IO port probe 0xa00-0xaff:
[ 25.458767] clean.
[ 25.479690] systemd-udevd[365]: Error calling EVIOCSKEYCODE: Invalid argument
[ 25.670267] Bluetooth: Core ver 2.17
[ 25.670303] NET: Registered protocol family 31
[ 25.670306] Bluetooth: HCI device and connection manager initialized
[ 25.670359] Bluetooth: HCI socket layer initialized
[ 25.670364] Bluetooth: L2CAP socket layer initialized
[ 25.670372] Bluetooth: SCO socket layer initialized
[ 25.682938] Bluetooth: RFCOMM TTY layer initialized
[ 25.682956] Bluetooth: RFCOMM socket layer initialized
[ 25.682966] Bluetooth: RFCOMM ver 1.11
[ 25.848974] cfg80211: World regulatory domain updated:
[ 25.848981] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 25.848984] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 25.848988] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 25.848991] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 25.848994] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 25.848997] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 25.874135] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 25.874141] Bluetooth: BNEP filters: protocol multicast
[ 25.874154] Bluetooth: BNEP socket layer initialized
[ 26.392757] init: cups main process (665) killed by HUP signal
[ 26.392778] init: cups main process ended, respawning
[ 28.541503] iwl3945 0000:0c:00.0: loaded firmware version 15.32.2.9
[ 28.614795] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 28.615213] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 29.942283] init: samba-ad-dc main process (758) terminated with status 1
[ 30.987339] wlan0: authenticate with 3c:7a:8a:b6:82:60
[ 30.991756] wlan0: send auth to 3c:7a:8a:b6:82:60 (try 1/3)
[ 30.995735] wlan0: authenticated
[ 30.995920] wlan0: associating with AP with corrupt beacon
[ 30.996068] wlan0: associate with 3c:7a:8a:b6:82:60 (try 1/3)
[ 30.999579] wlan0: RX AssocResp from 3c:7a:8a:b6:82:60 (capab=0x431 status=0 aid=4)
[ 31.001134] wlan0: associated
[ 31.001162] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 31.001232] cfg80211: Calling CRDA for country: US
[ 31.005146] cfg80211: Regulatory domain changed to country: US
[ 31.005151] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 31.005154] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
[ 31.005158] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
[ 31.005161] cfg80211: (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 31.005164] cfg80211: (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 31.005167] cfg80211: (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 31.005170] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
[ 31.005172] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm)

I don't know if that helps.




Schneldz: I don't want anything on them. I went to G parted and could not delete the partitions. I do have the copied files tho. I have them on the usb. Where they were locked I just compressed them and moved the tars. If you have drop box I can send them?

All I really want to do is wipe every hdd. That's it. I followed the shred commands from a link to this forum. I know I sound paranoid. Maybe I am. I will retry to do the entire dban install again on another machine and record every step that is odd. I think that will be less confusing?

Thanks for all your help- I will report back what happens with documentation.

schneidz 08-24-2016 01:59 PM

Quote:

Originally Posted by zuegma (Post 5595484)
...
Schneldz: I don't want anything on them. I went to G parted and could not delete the partitions. I do have the copied files tho. I have them on the usb. Where they were locked I just compressed them and moved the tars. If you have drop box I can send them?

All I really want to do is wipe every hdd. That's it. I followed the shred commands from a link to this forum. I know I sound paranoid. Maybe I am. I will retry to do the entire dban install again on another machine and record every step that is odd. I think that will be less confusing?

Thanks for all your help- I will report back what happens with documentation.

nope, you made it more confusing.

if i had a need to erase all data on a hard drive, i would boot up a live distro with gparted on it (i like fedora 24 live-usb).

then i would run:
Code:

sudo gparted
and select the drive/s to be erased and clik ok.


all this mite be moot since there probably isnt a virus.


All times are GMT -5. The time now is 05:03 AM.