Text 6806, 71 rader
Skriven 2006-08-04 17:41:16 av James Bradley (1:134/77.0)
   Kommentar till text 6663 av Wayne Chirnside (1:123/140)
Ärende: Hijacked
================
On or about: 08-01-06  11:08, Wayne Chirnside did engage Ross Cassell
regarding, but not
limited to: Hijacked

 WC> Drive geometry is hacked with, it's subtly wrong.
 WC> The malware has taken a Gig partition yet very little media is
 WC> missing.  ->  WC> This malware sneers at fdisk.
 
 WC> It's clearly malware.
 WC> Clever and devious and so far appearently invulnerable malware at
 WC> that. 

 ->  WC> Call me paranoid but I'm not used to fdisk failing like it has.
 
 ->  WC> I've spent THREE days repartitioning, no joy.
 ->  WC> There's a hidden SU account in a partition that will not die or be
 ->  WC> fdisked away.
 ->  WC> Fdisk, reboot..., it's back :-(
 
 -> But if you boot to the liveCD....

 WC> No joy in partitioning from live CD.
 WC> No joy disabling drives in CMOS.

OK, I'll call you paranoid. <G+D> Did this drive start with a few partitions
when this mess
started? (Sorry, haven't read every message on the bundle.) I had a drive,
(Actually two now.)
that reported much the same as you are seeing with yours. 

Now, I was bunked as I tried to partition mine, but my solution was to change
brands of fdisk. I
used W2Ks, *NT* aware fdisk to kaput it, and it kaputed it. From there the real
(c)fdisk was able
to see most of it, (7M or so, remained orphaned. Cluster size::physical platter
limitation???)
CMOS reported better numbers, and no "+" sign... I'm suspecting - as mine was a
cast off drive -
it lived only as a single "drive letter" for its previous life, and once the
suspect filled it up, the
user solved the problem by throwing it out . Yours, may have been attacked with
a similar
black-hat, but usable because of your partitioning. 

I can only talk through my hat, but I'd suspect your malware might be dynamic
enough to set up
an NT partition. <?> Either that, or it is a massive coincidence.

 WC> Powered down to clear and sure enough there is *no* report in 
 WC> my online banking of that email warning having been sent.
 WC> All the logo's were right, the fraud was quite good.
 WC> Even the information was right as to where to check.
 WC> Just that file attachment and lack of account tampering the email 
 WC> alert claimed to alert me to.

You've contacted your bank, I trust? If they are not cooperative with you to
expose an attacker,
and properly prosecute the 'citizen', plus give you technical support, consider
taking your banking
elsewhere. Now, chances are pretty good, once their tech hears the "L" word,
they'll go pretty
dumb, but it should be worth a chuckle, no? <VBG>



... James

___ Blue Wave/QWK v2.20

--- Maximus 3.01
 * Origin: -=-= Calgary Organization CDN (403) 242-3221 (1:134/77)