Hello,

lately I am unable to access the internet through wlan (which it used to work perfectly fine), suddenly it has gone off the internet by itself, although it has received a strong signal. Since then my Mandriva2005 (on Dell inspiron 8100 laptop) does funny things, like opening a terminal although I haven't clicked on it, some programmes don't seem to work properly anymore, it changes to failsafe mode all of a sudden or it just freezes and I cannot click on anything.
Now my question is, could it be that there might be a slight chance of having caught a virus, especially it is a common thing at the other os?

If yes, is there anything I can do to restore my computer apart from "restoring" it or formatting the whole hd. I have tried restoring it already, and it seems since then that it got worse, frankly speaking.

Would be grateful for any help being offered

in kind regards

Leela77 (rather old-ish newbie)

Might not be a virus but someone with root access to your box. If that's the case, then you definately want to format and reinstall, as the whole system could be compromised. You'll have to obrain a live cd with a rootkit checker on and run the check from that.

Hi UK MAdMaN
Thanks for the quick reply...I have tried to follow the steps under http://www.howtoforge.com/scan_linux...s#comment-2220 ...but I can't get to make step 5 work. Don't know what I have done wrong. Anymore help, please! My computer is getting worse the minute...or do you reccommend a full install?

cheers

Might not be a virus but someone with root access to your box
Pranksters and defacers aside, people that invade computers usually will want to lay low as much as possible, because they would rather use your resources for something than just "play" with it.


Since then my Mandriva2005 (on Dell inspiron 8100 laptop) does funny things, like opening a terminal although I haven't clicked on it, some programmes don't seem to work properly anymore, it changes to failsafe mode all of a sudden or it just freezes and I cannot click on anything.
Next to running chkrootkit I would recommend looking at the system logs (find them listed in /etc/syslog.conf) for clues. It would also be good to know when this started (how long ago? was something updated? hardware added?) what services you are running, if your firewall is configured and if all software is updated continuously.

Hello,
I haven't been able to run chkrootkit yet (to be frank, havn't figured out how to run it).
It started just a couple of days ago, when I tried to re-partition my hd, but I only received an error message that the hd drive is busy, so I left it and didn't try to enforce it. Since then really it "works" funny, freezes at shutdown or reboots, wireless doesn't work at all...as much as I can remember, I haven't updated anything or run services at all.

My system logs look like this (maybe not the smartest idea to show my logfiles, but I urgently need help with that with people who know much better than I do) (unfortunatly I don't really know what this all means):

# Various entry
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
user.* -/var/log/user.log

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;;news.none;authpriv.none -/var/log/messages

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Mail logging
mail.=debug;mail.=info;mail.=notice -/var/log/mail/info
mail.=warn -/var/log/mail/warnings
mail.err -/var/log/mail/errors

# Cron logging
cron.=debug;cron.=info;cron.=notice -/var/log/cron/info
cron.=warn -/var/log/cron/warnings
cron.err -/var/log/cron/errors

# Kernel logging
kern.=debug;kern.=info;kern.=notice -/var/log/kernel/info
kern.=warn -/var/log/kernel/warnings
kern.err /var/log/kernel/errors

# Lpr logging
lpr.=debug;lpr.=info;lpr.=notice -/var/log/lpr/info
lpr.=warn -/var/log/lpr/warnings
lpr.err -/var/log/lpr/errors

# News logging
news.=debug;news.=info;news.=notice -/var/log/news/news.notice
news.=crit -/var/log/news/news.crit
news.=err -/var/log/news/news.err

# Daemons logging
daemon.=debug;daemon.=info;daemon.=notice -/var/log/daemons/info
daemon.=warn -/var/log/daemons/warnings
daemon.err -/var/log/daemons/errors


# Everybody gets emergency messages
*.emerg *

# Save mail and news errors of level err and higher in a
# special file.
uucp,news.crit -/var/log/spooler

# Save boot messages also to boot.log
local7.* -/var/log/boot.log

# Explanations from Mandrake Linux configuration tools
local1.* -/var/log/explanations

I haven't been able to run chkrootkit yet (to be frank, havn't figured out how to run it).
Just post the errors you're getting.


It started just a couple of days ago, when I tried to re-partition my hd, but I only received an error message that the hd drive is busy, so I left it and didn't try to enforce it. Since then really it "works" funny, freezes at shutdown or reboots
While this doesn't hold any direct clues for me, this info might come in handy for others. When you're having errors it's always good to post when it started, what the symptoms are etc, etc.


wireless doesn't work at all...as much as I can remember,
Do you (still) have a wired network connection?


I haven't updated anything or run services at all.
Not updating is not good.


My system logs look like this
Hmm. What I meant was to look *at* the logs. Best start with /var/log/boot.log, then /var/log/messages. If you can, post some errorlines. If you think you can't make head or tails we'll figure out what to do then. While there's the opportunity it may be good to gather some more info, open a terminal and:
What this does is check all installed rpm's and put that in a logfile for you to read.

Hello unSpawn,
the thing with the symptoms is that they are varied and they come and go. It all started when my wireless switched itself off the internet by itself that was about a week ago, since then I couldn't get into it, although I do have a wired network connection, which works alright. Since then, it most frequently freezes at shutdowns, but not everytime, once I couldn't click on icons, etc. it is just acting funny, sometimes. It isn't of great help, I know, and I am sorry. And updating...ahem,..but I am a first time user, so to speak.

some more information with the above mentioned command gave me the following (and, I can't make head or tails out of it):

..?..... /usr/lib/ssh/ssh-keysign
.M...... c /etc/rc.d/init.d/mDNSResponder
.M...... c /etc/rc.d/init.d/nifd
S.5....T /var/lib/games/lbreakout2.hscr
missing /boot/kernel.h-2.6.11
S.5....T c /etc/sysconfig/msec
.......T c /etc/postfix/master.cf
.M...... c /etc/rc.d/init.d/postfix
..?..... c /etc/sudoers
..?..... /usr/bin/sudo
..?..... /usr/bin/sudoedit
..?..... /usr/sbin/visudo
S.5....T c /etc/X11/gdm/gdm.conf
.......T /boot/message-graphic
..?..... /usr/bin/passwd
.M...... /etc/rc.d/init.d/dhcpd
..?..... /usr/lib/vte/gnome-pty-helper
.M...... c /etc/rc.d/init.d/pcmcia
SM5....T c /etc/sysconfig/pcmcia
.M...... c /etc/rc.d/init.d/kheader
....L... /lib/cpp
.M...... c /etc/rc.d/init.d/messagebus
..?..... c /etc/ppp/chap-secrets
..?..... c /etc/ppp/options
..?..... c /etc/ppp/pap-secrets
.M...... /var/log/ppp
.M?..... /var/log/ppp/connect-errors
missing /var/run/ppp/resolv.conf
.M...... c /etc/rc.d/init.d/apmd
..?..... /usr/sbin/glibc-post-upgrade
S.5....T /usr/share/applications/defaults.list
S.5..... /usr/share/mime/application/pdf.xml
.M...... c /etc/rc.d/init.d/crond
.......T /usr/lib/mozilla-firefox-1.0.2/chrome/installed-chrome.txt
missing /usr/lib/mozilla-firefox-1.0.2/extensions/temp
.M...... c /etc/rc.d/init.d/acpid
S.5....T /usr/share/fonts/ttf/western/fonts.cache-1
..5....T c /etc/inittab
S.5....T c /etc/modules
......G. /etc/ppp/peers
.M...... /etc/rc.d/init.d/dm
.M...... /etc/rc.d/init.d/functions
.M...... /etc/rc.d/init.d/halt
.M...... /etc/rc.d/init.d/killall
.M...... /etc/rc.d/init.d/mandrake_consmap
.M...... /etc/rc.d/init.d/mandrake_everytime
.M...... /etc/rc.d/init.d/mandrake_firstime
.M...... /etc/rc.d/init.d/netfs
.M...... /etc/rc.d/init.d/network
.M...... /etc/rc.d/init.d/partmon
.M...... /etc/rc.d/init.d/rawdevices
.M...... /etc/rc.d/init.d/single
.M...... /etc/rc.d/init.d/usb
S.5....T c /etc/sysconfig/rawdevices
SM5....T c /etc/sysconfig/usb
S.5....T c /etc/sysctl.conf
S.5....T c /etc/sysconfig/firstboot
.....UG. /etc/cups/certs
SM?...GT c /etc/cups/classes.conf
.M?...G. c /etc/cups/cupsd.conf
......G. /etc/cups/ppd
SM?...GT c /etc/cups/printers.conf
.M....G. /etc/cups/ssl
.M...... c /etc/rc.d/init.d/cups
.M...UG. /var/spool/cups
missing /var/spool/cups/tmp
.M...... c /etc/rc.d/init.d/iptables
.M...... c /etc/rc.d/init.d/cpufreq
S.5....T c /etc/sysconfig/bootsplash
.M...... c /etc/rc.d/init.d/haldaemon
.M...... c /etc/rc.d/init.d/keytable
S.5....T /usr/lib/python2.4/site-packages/jack_CDTime.pyc
S.5....T /usr/lib/python2.4/site-packages/jack_TOC.pyc
S.5....T /usr/lib/python2.4/site-packages/jack_TOCentry.pyc
S.5....T /usr/lib/python2.4/site-packages/jack_misc.pyc
S.5....T /usr/lib/python2.4/site-packages/jack_mp3.pyc
..5....T /lib/modules/2.6.11-6mdk/modules.alias
.......T /lib/modules/2.6.11-6mdk/modules.ccwmap
..5....T /lib/modules/2.6.11-6mdk/modules.dep
.......T /lib/modules/2.6.11-6mdk/modules.ieee1394map
..5....T /lib/modules/2.6.11-6mdk/modules.inputmap
..5....T /lib/modules/2.6.11-6mdk/modules.isapnpmap
..5....T /lib/modules/2.6.11-6mdk/modules.pcimap
..5....T /lib/modules/2.6.11-6mdk/modules.symbols
..5....T /lib/modules/2.6.11-6mdk/modules.usbmap
missing c /etc/default/useradd
..5....T c /etc/login.defs
..?..... /usr/bin/newgrp
.......T c /etc/modules.conf
.M...... c /etc/rc.d/init.d/harddrake
S.5....T c /etc/sysconfig/harddrake2/previous_hw
missing /usr/X11R6/lib/X11/fonts/75dpi/encodings.dir
S.5....T c /etc/bashrc
S.5....T c /etc/printcap
S.5....T c /etc/profile
.M....G. /var/log/lastlog
S.5....T /usr/share/fonts/ttf/decoratives/fonts.cache-1
S.5....T c /etc/hotplug/blacklist
.M...... /etc/init.d/hotplug
.M...... /etc/X11/wmsession.d
S.5....T c /usr/share/config/kdeglobals
S.5....T c /usr/share/config/kdesktoprc
.......T c /usr/share/config/kickerrc
S.5....T c /usr/share/config/konquerorrc
..?..... /usr/share/mdk/kde/root-interface/dummy
..?..... /usr/share/mdk/kde/root-interface/emaildefaults
..?..... /usr/share/mdk/kde/root-interface/kab2kabcrc
..?..... /usr/share/mdk/kde/root-interface/kaccessrc
..?..... /usr/share/mdk/kde/root-interface/kalarmdrc
..?..... /usr/share/mdk/kde/root-interface/kcmaudiocdrc
..?..... /usr/share/mdk/kde/root-interface/kcmbellrc
..?..... /usr/share/mdk/kde/root-interface/kcmdisplayrc
..?..... /usr/share/mdk/kde/root-interface/kcmemailrc
..?..... /usr/share/mdk/kde/root-interface/kcmfontinstrc
..?..... /usr/share/mdk/kde/root-interface/kcmfontinstuirc
..?..... /usr/share/mdk/kde/root-interface/kcminitrc
..?..... /usr/share/mdk/kde/root-interface/kcminputrc
..?..... /usr/share/mdk/kde/root-interface/kcmlaptoprc
..?..... /usr/share/mdk/kde/root-interface/kcmmidirc
..?..... /usr/share/mdk/kde/root-interface/kcmnspluginrc
..?..... /usr/share/mdk/kde/root-interface/kcmsambarc
..?..... /usr/share/mdk/kde/root-interface/kconf_updaterc
..?..... /usr/share/mdk/kde/root-interface/kcontrolrc
..?..... /usr/share/mdk/kde/root-interface/kcookiejarrc
..?..... /usr/share/mdk/kde/root-interface/kdeglobals
..?..... /usr/share/mdk/kde/root-interface/kdeprintrc
..?..... /usr/share/mdk/kde/root-interface/kfmclientrc
..?..... /usr/share/mdk/kde/root-interface/kickerrc
..?..... /usr/share/mdk/kde/root-interface/kinetdrc
..?..... /usr/share/mdk/kde/root-interface/kio_ftprc
..?..... /usr/share/mdk/kde/root-interface/kio_httprc
..?..... /usr/share/mdk/kde/root-interface/kioslaverc
..?..... /usr/share/mdk/kde/root-interface/klaunchrc
..?..... /usr/share/mdk/kde/root-interface/klipperrc
..?..... /usr/share/mdk/kde/root-interface/kmail.eventsrc
..?..... /usr/share/mdk/kde/root-interface/kmailrc
..?..... /usr/share/mdk/kde/root-interface/knewsticker_appletrc
..?..... /usr/share/mdk/kde/root-interface/knewstickerappletrc
..?..... /usr/share/mdk/kde/root-interface/knotifyrc
..?..... /usr/share/mdk/kde/root-interface/konq_history
..?..... /usr/share/mdk/kde/root-interface/konquerorrc
..?..... /usr/share/mdk/kde/root-interface/konsolerc
..?..... /usr/share/mdk/kde/root-interface/kpgprc
..?..... /usr/share/mdk/kde/root-interface/krfbrc
..?..... /usr/share/mdk/kde/root-interface/krootwarningrc
..?..... /usr/share/mdk/kde/root-interface/ksmserverrc
..?..... /usr/share/mdk/kde/root-interface/ktalkannouncerc
..?..... /usr/share/mdk/kde/root-interface/ktalkdrc
..?..... /usr/share/mdk/kde/root-interface/ktaskbarrc
..?..... /usr/share/mdk/kde/root-interface/kuriikwsfilterrc
..?..... /usr/share/mdk/kde/root-interface/kwinkeramikrc
..?..... /usr/share/mdk/kde/root-interface/kwinrc
..?..... /usr/share/mdk/kde/root-interface/mandrakegalaxyrc
..?..... /usr/share/mdk/kde/root-interface/noatunrc
..?..... /usr/share/mdk/kde/root-interface/uiserverrc
.......T c /usr/share/config/konsolerc
S.5..UGT c /etc/X11/fs/config
.M...... c /etc/rc.d/init.d/xfs
.M....G. /etc/cups
.M....G. /usr/bin/lppasswd
.M...... c /etc/rc.d/init.d/oki4daemon
..?..... /usr/bin/lbp660
..?..... /usr/bin/ml85p
.M...... c /etc/rc.d/init.d/smb
..?..... c /etc/bluetooth/pin
.M...... c /etc/rc.d/init.d/bluetooth
.M...... c /etc/rc.d/init.d/dund
.M...... c /etc/rc.d/init.d/hidd
.M...... c /etc/rc.d/init.d/pand
.M...... c /etc/rc.d/init.d/apmiser
.M...... c /etc/rc.d/init.d/ultrabayd
S.5....T /usr/share/a2ps/afm/fonts.map
S.5....T /usr/share/texmf/ls-R
.M...... c /etc/rc.d/init.d/udev
..?..... c /etc/at.deny
.M...... /etc/rc.d/init.d/atd
missing /var/spool/at/spool
SM5....T c /etc/security/fileshare.conf
.......T /usr/share/pixmaps/gnome-default-dlg.png
.......T /usr/share/pixmaps/gnome-error.png
.......T /usr/share/pixmaps/gnome-info.png
.......T /usr/share/pixmaps/gnome-question.png
.......T /usr/share/pixmaps/gnome-warning.png
S.5....T c /etc/xml/catalog
S.5....T c /usr/share/sgml/docbook/xmlcatalog
.M...... c /etc/rc.d/init.d/acpi
S.5....T c /usr/share/config/kdm/kdmrc
....L... /usr/share/icons/gnome/48x48/mimetypes/gnome-mime-application-pdf.png
S.5....T /usr/share/WindowMaker/menu
.M...... c /etc/rc.d/init.d/syslog
S.5....T c /etc/sysconfig/syslog
S.5....T /usr/X11R6/lib/X11/icewm/menu
S.5....T /usr/X11R6/lib/X11/icewm/preferences
S.5....T c /etc/info-dir
..?..... /usr/bin/sperl5.8.6
.M...... c /etc/rc.d/init.d/hplip
.......T /usr/share/icons/gnome/scalable/emblems/emblem-shared.svg
SM5....T c /etc/qtrc
S.5....T c /etc/sane.d/dll.conf
.......T /usr/share/fonts/default/Type1/adobestd35/fonts.cache-1
.......T /usr/share/fonts/default/Type1/fonts.cache-1
.M...... c /etc/rc.d/init.d/alsa
.M...... c /etc/rc.d/init.d/sound
missing latex2html-2002-2-1-path.patch.bz2
missing latex2html-2002-2-1.tar.bz2
missing latex2html-2002-gsfonts.patch.bz2
missing latex2html-doc-address.patch.bz2
missing latex2html-gs-stderr.patch.bz2
missing latex2html-htmladdimg.patch.bz2
missing latex2html-pdfoutput.patch.bz2
missing latex2html-perlcall.patch.bz2
missing latex2html-perlversion.patch.bz2
missing latex2html.spec
S.5....T /usr/share/fax/hyla.conf
S.5....T c /etc/pam.d/system-auth
..?..... /sbin/pam_timestamp_check
.M...... c /etc/rc.d/init.d/mtink
.M...... /etc/rc.d/init.d/named
..?..... c /etc/rndc.conf
..?..... c /etc/rndc.key
.M...... c /etc/rc.d/init.d/netplugd
.......T c /etc/crontab
missing c /root/.Xdefaults
missing c /root/.bash_logout
missing c /root/.bash_profile
missing c /root/.bashrc
missing c /root/.cshrc
missing c /root/.tcshrc
missing c /root/.vimrc
missing /root/tmp
S.5....T c /etc/modprobe.conf
S.5....T c /etc/modprobe.preload
S.5....T /usr/share/apps/kdeprint/specials.desktop
....L... /usr/share/config
....L... /usr/share/icons/crystalsvg/128x128/mimetypes/pdf.png
....L... /usr/share/icons/crystalsvg/16x16/mimetypes/pdf.png
....L... /usr/share/icons/crystalsvg/32x32/mimetypes/pdf.png
....L... /usr/share/icons/crystalsvg/48x48/mimetypes/pdf.png
....L... /usr/share/icons/crystalsvg/64x64/mimetypes/pdf.png
S.5....T c /etc/mtools.conf
.M...... /proc
.M...... /root
.M...... /var/spool/mail
..?..... /usr/bin/chfn
..?..... /usr/bin/chsh
.......T /usr/share/themes/LighthouseBlue/gtk-2.0/gtkrc
.......T /usr/share/themes/Mist/gtk-2.0/gtkrc
.......T /usr/share/themes/ThinIce/gtk-2.0/gtkrc
..?..... /usr/X11R6/bin/Xwrapper
missing /usr/X11R6/lib/X11/fonts/Speedo/encodings.dir
missing /usr/X11R6/lib/X11/fonts/TTF/encodings.dir
..5....T /usr/X11R6/lib/X11/fonts/TTF/fonts.cache-1
missing /usr/X11R6/lib/X11/fonts/Type1/encodings.dir
..5....T /usr/X11R6/lib/X11/fonts/Type1/fonts.cache-1
.......T c /etc/samba/smb.conf
..?..... /usr/share/samba/scripts/smb-migrate


any help is much appreciated!

Use the Mandriva software installer (urpmi or menu->System->Configutation->Packaging) to install chkrootkit. If it can't find it goto http://easyurpmi.zarb.org and setup your sources first. After you've installed it you can just run it as as root.

However it would be better if you run it from a LiveCD distro such as Knoppix.

Sounds suspicious - you tried to repartition a mounted partition, that could have stuffed things up. How did you try to repartition the drive? From the command line or using Mandriva's GUI tools? What partition did you try to change - the one that Linux is running on (/)?

Boot from a LiveCD distro such as Knoppix and run fsck on the main Linux partition. To find out what device that is run mount before you reboot. Eg. if my mount output has the line I would run once I'd rebooted into the LiveCD.

Hello tkedwards,

I have run chkrootkit via knoppix, it seemed quite alright to me, I think; running chkrootkit outputted nothing infected or found (good sign, I suppose?)
For the drive repartion: I have done it using GUI tools, trying to change the /home partion, but as I mentioned it before, it says that the drive was busy and can't partition it (I don't know whether I did it nevertheless).

Running fsck (also via knoppix) gives me the following: fsck /dev/hda1: fsck 1.32 (09-Nov-2002) e2fsck 1.32 (09-Nov-2002) -dev-hda1: clean, 152076/78544 files, 942635/1523199 blocks
fsck /dev/hda6 --> clean 11791/2981312 files, 35326/7942167 blocks

...for now the computer works fine...but it is like playing jeopardy really, to "guess" or hope whether it "wants" to work properly today or not.

What would you recommend? Doing it the Windoze way and format the entire disk (which I am not really very keen on, as I have my system set up almost the way I want it).

Well if you do reinstall having your /home on a seperate partition means you'll keep all your user settings (but not system settings). I'm really not sure what could be wrong, you'd have to give more specific info about the exact errors you're getting and what you do to get those errors.

...thanks everyone for the help. For the time being my computer seems to work fine (although it is a lot of hoping). Nevertheless it froze at shutdown. For now, I think I leave the subject,...but soon to be returned, I reckon