Subject: Re: Trying to create bootable cd... - msg#00618

Previous Message by Date:

Re: Looking for a keylogger infection...

On 5/17/05, plug_0@xxxxxxxxxxxxxxxxx <plug_0@xxxxxxxxxxxxxxxxx> wrote: ... > Is there a program I should burn to a cd and install to my > friend's computer that will find any keylogger that might > be there? Does anyone know a specific file name to search > for or something that will be in the registry that will > indicate a keylogger is installed? I would first start with a good virus scanner with up to date defs like clamwin. Then scan the system with three different ad-ware/spyware scanner programs. my recommends Microsoft antispyware, spysweeper and TDS-3. The problem with all of this is that there could still be custom spam bots and keyloggers that are under the radar of the people that write all of these programs. Best and safest. Get the data off the box. wipe the disk re-install and then behind a good firewall (or have Linux download and burn a CD) download all the XP patches. Microsoft's site is the first and only site you hit until everything is patched. Did you heard the news report about attaching a fresh XP install with all the security patches and then let some teenagers serf the web for an hour. Results: over 300 identified pieces of ad-ware/spyware on the machine. So much for all the security.

Next Message by Date:

Spam confession

Bless me Tux for I have sinned. I left my SMTP relay open for nearly a day. And a spammer used it! The relay is now closed, and has passed the MAPS scan. I understand what I have done and how it came to happen, and I shall nevermore use SSH to forward port 25 without the proper precautions. _______________________________________ Postfix is very good about not being an open relay, and I'd carefully set things up with SASLauthd so that users had to authenticate to the server before they could relay mail through it. The only way someone can relay mail through the box without authentication is if they're on the box's internal (127.0.0.1) network. This allows daemons to send alert mails and suchlike. I was moving the mail server from one IP address (and site) to another. I wanted to change the address in DNS beforehand so there'd be time for the change to propagate without a service interruption. I set up a system at the new address, then had it forward incoming port 25 traffic to the old address via an SSH portforward. All worked nicely. But I forgot something: SSH forwards to the internal (127.0.0.1) network. Yes, the one that Postfix accepts mail from without authentication. So by forwarding port 25 to the internal network on the mail server, the box at the new address looked like a perfectly ordinary open relay! And one of the many, many spammers who troll for open relays found it. So beware of the unintended consequences of portforwards. Our Kernel, which Art in Ring 0... Aaron

Previous Message by Thread:

Trying to create bootable cd...

I'm installing Linux above the standard cylinder limit and I don't want it to be obvious that it is available on the machine I'm setting up for security reasons. So far I've tried creating a Windows 98 system disk cd with loadlin off another cd and a 98 system disk as the data sources, only the files on the floppy burned to the cd. Groan. I'd rather use freedos if I had it. The kernel and initrd image that Fedora core 3 installed will not fit on a floppy with loadlin and the 98 system files. In the interest of using a free version of dos and being able to upgrade the XP installation to NTFS possibly, anyone know an easy way around this? I want to burn a bootable cd that is at least a 2.88 meg image. I could go the xosl route, but I don't want to. XOSL, at least the versions I've used, don't understand NTFS. I want my friend to be able to boot linux without completely exposing her XP system. Has anyone installed xosl on a Windows XP box? The easiest I can think of is FIPSing the windows partition and changing the part that Windows is on to NTFS so that the dos boot that loadlin requires will not grant access to the Windows part of the drive. I wish there was a way to trick XP into thinking that the rest of the hard drive doesn't exist. I'm halfway worried that NTFS will self destruct with an advanced partitioning scheme. The Linux system is going to host a backup of the Windows XP Home system, if tar is a functional way to back that system up. I used dd to get the XP bootblock off the disk. I'm admittedly concerned if tar doesn't put XP's files back in exactly the same spots on the hard disk that a restoration will fail. I'm thinking image file, though I admittedly wonder how large it will have to be. Is there a way to use dd to get an absolute copy of the fat partition to restore it from later? What do I set the block size and the count to? The Windows swap file and probably the system restore points as well will need to be copied to the exact same locations they were at when they were backed up if I'm not mistaken or Windows XP might self destruct when I try to restore it. Should I turn system restore points off in XP before I back it up? Michael C. Robinson ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/

Next Message by Thread:

XP installation self destruct has me wary...

Microsoft complained when I tried to activate it that it had been activated before. I replaced the hard drive thinking I can't remove a keylogger from it. When I copied a linux kernel onto one of XP's FAT partitions from Linux, that somehow wrecked the XP system. The start bar self destructed entirely. I've been able to run explorer from task manager, so I'm not buying the idea that explorer.exe got corrupted. Is it possible that Microsoft is so paranoid that it's booby trapping XP home now? Does Microsoft record a hardware fingerprint when you install Windows XP the first time so that it will self destruct if you try to install it on different hardware? I installed on the same box, but I changed the hard disk. Is there any way to trick Windows XP into thinking it has been activated? My only thought is that DEP protection had something to do with it. Maybe a combination of disabling Internet Explorer and installing files to a FAT partition from a different OS triggered an auto destruct. Maybe I should create the fat partition after I get Windows XP fully installed. All I can say is that I'm awfully frustrated with the stupid thing. I wish I could talk my friend into 2000, Fedora Core 3, and vmware. 2000 doesn't need to be activated online for one thing. Microsoft should be sued for creating XP. Too bad she can't afford Windows 2000. Michael ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/