Home Messages Index
[Date Prev][Date Next][Thread Prev][Thread Next]
Author IndexDate IndexThread Index

Re: WinXP nailed by THREE trojan/virus when re-installing to make room for Linux

  • Subject: Re: WinXP nailed by THREE trojan/virus when re-installing to make room for Linux
  • From: Roy Schestowitz <newsgroups@xxxxxxxxxxxxxxx>
  • Date: Fri, 17 Feb 2006 02:35:30 +0000
  • Newsgroups: comp.os.linux.advocacy
  • Organization: schestowitz.com / MCC / Manchester University
  • References: <p00av1hiamhgds3urqrk5c50lmhhka0k9n@4ax.com>
  • Reply-to: newsgroups@xxxxxxxxxxxxxxx
  • User-agent: KNode/0.7.2
__/ [Lobo] on Friday 17 February 2006 01:23 \__

> After test driving various flavours of Linux, I finally decided to
> make the leap into linux.
> here's my sad story...... hehehehe
> I have 3 drives:
> #1 80g -- part 1 win98, part 2 mp3's, part 3 blank (used for test
> driving various flavours of linux)
> #2 80g --  part 1 winXP, part 2 & part 3  data, photos, mp3's
> #3 200g: 24,000 mp3's (used to be NTFS but found out linux doesn't
> play nicely with this file system so I converted to EIGHT fat32
> partitions in order to keep my music collection in some semblance of
> order. It's taken me five years to get this collection. This was a
> real treat to do in stages using other drives as temp storage places
> but now left with horrible windows abcdefghijklmnop drive names
> limited to eight characters.... ugghhhhh)
> soooooooooo...... I decided to dump win98, sniff - like losing an old
> friend (sure spun fast with Duron900 w/ 512mb RAM), move winXP and
> data to #1 and make room for several linux distros on #2
> NOTE: will post more on my experiences with linux in future. What I am
> trying to do is see how far I can get with each distro, flying by the
> seat of my pants w/o R'dTFM's. I only have a limited experience with
> linux but know my way around windows pretty good. I'm giving each
> distro my "This Is Starting Piss Me Off" frustration index.. hehehe
> Basically testing for the "intuitive" factor.
> After making a fresh install w/ full format of winXP Home on drive #1,
> I proceeded to activate and fetch the upgrades from Micro$oft. Well,
> you'all know how long that takes w/ installing SP2 disk PLUS an
> additional 58 security updates PLUS IE updates PLUS updates on the
> updates, even w/ HS cable. Well, if you don't know, it takes three
> times as long as the install. So I go for refreshments and take a peak
> at the box now and then to do the mandatory shut downs. I sort of
> noticed that XP was taking longer and longer to shut down but wasn't
> overly concerned.
> After all was done, I toddled into IE to fetch my favourite browser,
> Firefox. I was expecting the usual MS site home page but got nothing
> for a minute. I noticed in the bottom left 'proxy: xxxxx' (I didn't
> write the URL down) and said to myself "That's unusual". MS pops up
> and search for Firefox. IE was slow as molasses but finally got to
> Firefox for download.
> Started download... sloooooooow....sloooooweeeeeeeerrrrrrr.....
> Said to myself "Sumthins not right."
> - modem lights flashing like mad but download going at about 56K
> - stop download.... modem lights still flashing.... WTF!!!!!
> - crank up 'netstat -ano 10' from protected floppy
> - check PID's - connections - the whole scenario is NOT right!!!!
> - ctrl-alt-del.... PID in question is 'Windows-mod.exe'
> - hit stop process - modem lights stop flashing
> F$#^%$#% son of a B - I'M F'KING INFECTED!!!!!
> It's been years since I got an HTD
> - thank the big programmer in the sky for me having the sense to
> physically disable all my other drives before this install (mainly to
> hide my original XP so it will allow another install) as well as LAN
> to other 'puters.
> - check msconfig... there's 'Windows-mod.exe'
> - run regedit... remove crap from run and check for other occurances
> - I also find it in Windows Firewall.... as an ENABLED service....
> - F**K.... that's why Windows Firewall let it through
> - rename 'Windows-mod.exe'
> I cranked the net connections back up (had to switch nics for some
> reason???) and installed Shaw Cable's free anti-virus(F-Secure) with
> firewall(Zone Labs).
> It found 6 virii:
> 'Parite' plus variants of 'SdBot.aay' and 'Worm.Ircbot.Gen'
> After rebooting I found them in restore files (which I normally turn
> off but Windows update keeps turning on again). Those files soon went
> to the trash bin.
> I've always had firewalls and anti-virus so I know the infection did
> not come from my systems. I also did a system wide check after all was
> put back together and came up clean.
> I should complain to Microsot to give me an updated disk for free so I
> can at least install w/o getting infected. In the future all my
> installs of Windows will be with the modem disconected and a local
> copy of firewall and antivirus to install before making an internet
> connection to upgrade.

The story sounds familiar. My sister and I set up Windows XP for my mother a
few months ago and the infection preceded the Windows update.

> So, the questions I now have are:
> Can the same thing occur with linux?


> Is there something like netstat that I can see what is going on?

Yes. Network monitor, among many other (free) packages that provide more
detailed information.

> What is a good firewall for Linux?

The one which is included 'out of the box'. If you run a server and need to
be super-cautious, you could put something on top of that or subtitute the
basic firewall.

> How about anti-virus stuff?


> What are the recommendations for partitioning about 30 gig on hdb for
> 2 or 3 different linux distros? Sizes etc.

In depends on how you organise your data. For example, you may wish to store
media, backups and programs apart.

> Should I pre-make them w/ PM (nice gui) or leave unallocated and
> partition at install?

You could use Partition Magic if you have it installed already. However,
Ubuntu has a multi-lingual installer which includes partitioning tools
('expert' installation). I believe that most distributions nowadays
incorporate this capability, but Fedora Core does not.

> BTW, without AmoroK, I would not even be considering Linux.

SongBird will reach Linux as well, probably in a matter of months. I agree
that AmaroK is a 'killer app', yet it will have some competition in its
native platform pretty soon. With the release of KDE 4 (QT 4) in Q3 of this
year, I imagine that a Windows port of AmaroK will be made available too.

> I hope
> photo stuff will be good too. These are my main interests so if anyone
> can recommend a distro....

There are several photo management tools for Linux, some of which are rather
bloated (if it is a measure of functionality at all). Piccasa is currently
being ported for Linux. Yes, Google are working on this!

As you seem to know your way around the computer and more or less require
KDE, I would recommend SuSE. SuSE comes with Gwenview for photos, but there
are several better programs if photography is important to you.

> Looking forward to the challenges ahead.

Judging by the former part of your messages, you will face only relatively
minute challenges.

Best wishes,


Roy S. Schestowitz      | "Quote when replying in non-real-time dialogues"
http://Schestowitz.com  |    SuSE Linux     |     PGP-Key: 0x74572E8E
  2:20am  up 30 days 21:21,  14 users,  load average: 0.27, 0.29, 0.49
      http://iuron.com - Open Source knowledge engine project

[Date Prev][Date Next][Thread Prev][Thread Next]
Author IndexDate IndexThread Index