[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Possible LKM Trojan installed



how these trojans survive is by surviving operating system reinstalls. The better trojans hide themselves in several out of the way places on disks and after adjacent areas have got their new files copy themselves back into the areas where no more disk wiping by the installer is about to happen. Trojan file names get changed too whenever this happens too.



On Fri, 24 Aug 2007, Mike Bird wrote:

On Friday 24 August 2007 16:16, Jude DaShiell wrote:
Those trojans trash very many files whenever anyone tries surgery on them.
That was found out in a security lab by security professionals.  If you
can get to a friends computer and download the dban iso file from
http://dban.sf.net and burn that on a single session CD and boot it up on
the infected machine and at the boot prompt type autonuke dban will return
your hard drive to the state it was in before it got its first operating
system.  Once finished, shut the machine down and leave it off for a
minute.  That should clear the memory.  If security professionals had a
hard time, I'm sure I wouldn't have a chance.  dban will take a day to
clear a 300gb disk.  Figure 8 hours for a 100gb disk.

Why do you believe a security erasure is needed rather than simply
starting with a fresh block zero?  If infected, the OP can use a
Debian Installation CD and make new partition tables.

--Mike Bird


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org




Reply to: