Text 6947, 162 rader
Skriven 2006-08-09 22:00:00 av MARTIN ATKINS (1:123/140)
     Kommentar till en text av WAYNE CHIRNSIDE
Ärende: Memory
==============
-=> WAYNE CHIRNSIDE wrote to MARTIN ATKINS <=-


 ->  ->  WC> Booting to the Knoppix live CD, RAMDRIVE.

 ->  -> So much for your BIOS virus theory.

 ->  WC> Uh, that's what I was *currently* running when you asked.
 ->  WC> I zero'd the drive, booted to the CD in an effort to clean up the
 ->  WC> infestation.

 -> You've been running Knoppix CD from day one so logic should have
 -> told you that there was nothing wrong with the BIOS.

 WC> Knoppix from day one *on the hard drive*.

Then the situation is the same. How did you come up with the
silly idea that you had a BIOS virus?

 WC> You can boot Knoppix from the CD as an *option*
 WC> I however had it on the hard drive.

Presumably before you stuffed it up.

 -> The DMI
 -> thing only happened when you tried to boot the DOS 5.0 disk
 -> so logic should have told you that it was a DOS disk problem.

 WC> No to both.
 WC> I had DOS and Windows on a slave drive but as  it's slave it's
 WC> *never* been online in this machine.

Then how did you come up with the idea that that disk had been 
infected? In the cold light of day can't you see how ridicules
that notion is. 

 ->  ->  -> You should know that DOS is deaf dumb blind and stupid.

 ->  ->  WC> So it appears aren't I.

 -> I'm not disputing that there may have been some kind of nasty on the
 -> disk. I'm questioning your approach to the problem _after_ you zeroed
 -> the H/D.

 WC> Nope.
 WC> It survived that attempt.

"It" did not. You started playing with fdisk, didn't understand
what you were seeing and decided it was a virus. 

 WC> Looking at notes I wrote during the experience it appears
 WC> the drive geometry was altered.
 WC> The two anomolies were a 0 block partition at the end of the drive

Like this.

Nr AF  Hd Sec  Cyl  Hd Sec  Cyl     Start      Size ID
 2 00 254  63 1023 254  63 1023   33672240  122629248 05
 5 00 254  63 1023 254  63 1023    9446220   14378175 05
 6 00 254  63 1023 254  63 1023   23824395    6249285 05
 7 00 254  63 1023 254  63 1023   30073680    9108855 05
 8 00 254  63 1023 254  63 1023   39182535   13092975 05
 9 00 254  63 1023 254  63 1023   52275510     498015 05
10 00 254  63 1023 254  63 1023   52773525   69855723 05
11 00   0   0    0   0   0    0          0          0 00

Normal.

Again due to you lack of knowledge you decided it was a virus.

 WC> and a extended at the beginning of the drive.

It shows the extended partition as /dev/hda5. That is _not_
the beginning of the drive.

Like this.

  Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1        2096    16836088+   b  W95 FAT32
/dev/hda2            2097        9730    61314624    5  Extended
/dev/hda5            2097        2684     4723078+  83  Linux
/dev/hda6            2685        3579     7189056   83  Linux
/dev/hda7            3580        3968     3124611   83  Linux
/dev/hda8            3969        4535     4554396   83  Linux
/dev/hda9            4536        5350     6546456   83  Linux
/dev/hda10           5351        5381      248976   82  Linux swap / Solaris
/dev/hda11           5382        9730    34927830   83  Linux


 WC> These only showed up in fdisk expert mode when you displayed
 WC> inits as sectors

Like this.

Nr AF  Hd Sec  Cyl  Hd Sec  Cyl     Start      Size ID
 1 80   1   1    0 254  63 1023         63   33672177 0b
 2 00 254  63 1023 254  63 1023   33672240  122629248 05
 3 00   0   0    0   0   0    0          0          0 00
 4 00   0   0    0   0   0    0          0          0 00
 5 00 254  63 1023 254  63 1023         63    9446157 83
 6 00 254  63 1023 254  63 1023         63   14378112 83
 7 00 254  63 1023 254  63 1023         63    6249222 83
 8 00 254  63 1023 254  63 1023         63    9108792 83
 9 00 254  63 1023 254  63 1023         63   13092912 83
10 00 254  63 1023 254  63 1023         63     497952 82
11 00 254  63 1023 254  63 1023         63   69855660 83

So much for your virus.

 ->  WC> These were.
 ->  WC> DMI event logging prompt on boot.
 ->  WC> DOS label command failing to alter or clear volume label.

You cannot use DOS to change anything in a primary partition
while a extended partition exists. You must first delete
all the partitions in the extended then delete the extended
before you can use DOS to alter it.

 -> I have a resonable memory and that was going on _before_ you
 -> dd'ed the drive.

 WC> And after.
 WC> I *attempted to dd the drive.
 WC> It *appeared* to work.
 WC> Now explain how  Lilo showed up after zeroing the drive
 WC> anbd before installing anything?

Because it is alive in the MBR but not functoning.

 ->  WC> Make that four things.
 ->  WC> Lilo kept returning having morphed repeatedly in it's configuration
 ->  WC> during attempts to clear the drive.

 -> You may have removed LILO from the partition but you didn't remove
 -> it from the MBR. It was still resident but of course it quickly failed.

 WC> I would have thought two passes with dd zeroing the drive and a pass
 WC> with Maxtors low level formatting tool would have taken care of that.

No not neccassaraly. The MBR could still remain intact.

 -> Some where about "L" i should think.

 ->  WC> You might be a bit obsessive too if you were in a motorcycle accident,
 ->  WC> lost 2 1/2 inches of your lubar spine, were bedridden and your only
way
 ->  WC> out into the world was a

 WC>  PC crippled by malicious software.

 ->  WC> Did you have a bad problem with such at one time?

 -> Yes.

 WC> I too once had a RAM problem but rather quickly pinpointed it.
 WC> It was a clash between a stick and on MB SMT RAM.
 WC> Jumpered of the 4 Meg on MB and all was well.

Well at least we know this time it is not the RAM.
 
--- MultiMail/Linux v0.47
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)