Re: virus dans lilo
On 11 Sep, 2002, Vincent Renardias wrote : Tous ceux que j'ai vu fonctionnent sur le meme principe: - si le MBR en place n'est pas celui de Windows -- Alerte. c'est super comme philosophie, y'a que windows qui fonctionne sur les PC ou quoi ? William. clef-PGP : http://william.wu.free.fr/wu.asc -- Be careful of reading health books, you might die of a misprint. -+- Mark Twain -+-
Re: virus dans lilo
[EMAIL PROTECTED] (Panard) wrote: Bonjour! Voilà, je viens d'installer la debian woody, mais lorsque le veux booter, lilo me sort un message comme quoi il y a un virus dans ma partition, et quel est ce message ? ce qui est purement impossible vu que j'ai juste installer, j'ai rien toucher d'autre !
Re: virus dans lilo
Ne serais-ce pas tous simplement l'antivirus de la carte mére (Bios) qui t'affiche ce message ? - Original Message - From: Tuyen DINH [EMAIL PROTECTED] To: MailingList debian-user-french@lists.debian.org Sent: Thursday, September 12, 2002 9:38 AM Subject: Re: virus dans lilo [EMAIL PROTECTED] (Panard) wrote: Bonjour! Voilà, je viens d'installer la debian woody, mais lorsque le veux booter, lilo me sort un message comme quoi il y a un virus dans ma partition, et quel est ce message ? ce qui est purement impossible vu que j'ai juste installer, j'ai rien toucher d'autre ! -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: virus dans lilo
En réponse à Pelluet [EMAIL PROTECTED]: Oui il suffisait de désactiver l'antivirus de la carte mère, thanks à tous ! _ __ _ _ ( )(_)(_) (__) ___ () _ _/ \ () || _ \ | ( / |||_| | ___ ___ _____ | | _/ ||___/ ___\ / \ ___\ |/ /| \_/|| / | | | / | ||| _ /) || |___/ | | |___/ |\/ / | () _ [EMAIL PROTECTED] - http://www.inzenet.org Ne serais-ce pas tous simplement l'antivirus de la carte mére (Bios) qui t'affiche ce message ? - Original Message - From: Tuyen DINH [EMAIL PROTECTED] To: MailingList debian-user-french@lists.debian.org Sent: Thursday, September 12, 2002 9:38 AM Subject: Re: virus dans lilo [EMAIL PROTECTED] (Panard) wrote: Bonjour! Voilà, je viens d'installer la debian woody, mais lorsque le veux booter, lilo me sort un message comme quoi il y a un virus dans ma partition, et quel est ce message ? ce qui est purement impossible vu que j'ai juste installer, j'ai rien toucher d'autre ! -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: virus dans lilo
On Thursday 12 Sep 2002, Panard wrote: En réponse à Pelluet [EMAIL PROTECTED]: Magnifique ta signature, en plus tu quote en haut (comme un goret diraient certains que je connais...) ayez pitié des pauv' gens en rtc... merci. -- jean-michel
virus dans lilo
Bonjour! Voilà, je viens d'installer la debian woody, mais lorsque le veux booter, lilo me sort un message comme quoi il y a un virus dans ma partition, ce qui est purement impossible vu que j'ai juste installer, j'ai rien toucher d'autre ! Panard
Re: virus dans lilo
On Wed, 11 Sep 2002 14:13:37 +0200 (MEST) Panard [EMAIL PROTECTED] wrote: Voilà, je viens d'installer la debian woody, mais lorsque le veux booter, lilo me sort un message comme quoi il y a un virus dans ma partition, ce qui est purement impossible vu que j'ai juste installer, j'ai rien toucher d'autre ! Ca m'étonnerait que lilo sache ce qu'est un virus, regardes dans ton bios si tu n'as pas une option pour vérifier qu'il n'y a pas de virus sur la mbr, mais je pensais que les bios qui ont cette option bloquent plutôt l'écriture d'un nouvelle mbr. Alain
Re: virus dans lilo
On Wed, Sep 11, 2002 at 02:13:37PM +0200, Panard wrote: Bonjour! Voilà, je viens d'installer la debian woody, mais lorsque le veux booter, lilo me sort un message comme quoi il y a un virus dans ma partition, ce qui est purement impossible vu que j'ai juste installer, j'ai rien toucher d'autre ! Tu n'aurais pas par hasard laisser activer la protection anti-virus sur la MBR dans le BIOS ? Si c'est le cas, désactive-la et lilo pourra aller écrire la MBR comme il l'entend. Fred
Re: virus dans lilo
On Wed, 11 Sep 2002, Alain Tesio wrote: On Wed, 11 Sep 2002 14:13:37 +0200 (MEST) Panard [EMAIL PROTECTED] wrote: Voilà, je viens d'installer la debian woody, mais lorsque le veux booter, lilo me sort un message comme quoi il y a un virus dans ma partition, ce qui est purement impossible vu que j'ai juste installer, j'ai rien toucher d'autre ! Ca m'étonnerait que lilo sache ce qu'est un virus, regardes dans ton bios si tu n'as pas une option pour vérifier qu'il n'y a pas de virus sur la mbr, mais je pensais que les bios qui ont cette option bloquent plutôt l'écriture d'un nouvelle mbr. Tous ceux que j'ai vu fonctionnent sur le meme principe: - si le MBR en place n'est pas celui de Windows -- Alerte. -- Vincent RENARDIAS Directeur Technique StrongHoldNET / http://www.strongholdnet.com
virus and LILO ?
HI, ppl, Analysing bad behaviour of my PC, the assumption was done about possible virus activity under w95. (W95 and Linux are sharing the same harddisk). Formating disk did not helped at all, so I am thinking about some kind of bootsector based viruses. Is it theoreticaly possible to be infected by such viruses in case of using LILO? TIA, Eugene Sevinian CRD, YerPhI, 375036, Armenia URL: http://crdlx5.yerphi.am/ Phone: 374-2-344873
Re: virus and LILO ?
Eugene Sevinian wrote: Analysing bad behaviour of my PC, the assumption was done about possible virus activity under w95. (W95 and Linux are sharing the same harddisk). Formating disk did not helped at all, so I am thinking about some kind of bootsector based viruses. Is it theoreticaly possible to be infected by such viruses in case of using LILO? One might wonder about a boot-sector virus. These probably make some assumptions about the layout of stuff in the boot sector, and I'm sure lilo's layout violates those assumptions. There are two ways to install lilo. Either it can be installed directly into the boot sector ( like boot=/dev/hda ) or it can be installed into the boot area of a specific volume ( like boot=/dev/hda3 ). In the first case, just reinstalling lilo should wipe out any boot sector virus by overwriting it. In the second case, we depend upon the standard DOS boot sector code to scan the volume table, notice which one is set as the boot volume, then in turn leap to the next booter (in our case lilo) in that volume block. If a virus wipes out the first stage booter it can be put back by a DOS command, something like: fdisk /mbr which rewrites a standard Master Boot Record. This is the customary and usual way to recover from a boot sector virus. Good luck! -- Charles B. (Ben) Cranston mailto:[EMAIL PROTECTED] http://www.wam.umd.edu/~zben
Re: virus and LILO ?
Re: virus and LILO ?
This is my second day on Debain and my first on vi with mutt. I must confess its a bit of a learning curve and I managed to cc the list but deleted the message. On Thu, May 13, 1999 at 04:54:29PM -0400, Charles B (Ben) Cranston wrote: I just saw a blank message from you to Eugene Sevenian about the lilo stuff. Did you mean to send a message body with it? -- Charles B. (Ben) Cranston mailto:[EMAIL PROTECTED] http://www.wam.umd.edu/~zben
virus trashing LILO?
This is something I saw on Usenet: that a virus can infest the boot sector of a Win95/Linux machine and trash Linux via LOADLIN. Am I being terribly naive in thinking that the same might apply when you boot via LILO? As far as I can remember, my LILO resides on the bootable part of my Linux partition, and handles boot to Win95 from there. Can the MBR be subverted by a virus and wreak havoc on Linux? Regards, /g. -- Gustaf Erikson ---*--- 59*19'N 18*05'E http://www.student.nada.kth.se/~f92-ger/ Schizophrenic Linux user: Debian on Intel, Redhat on Sparc -- TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word unsubscribe to [EMAIL PROTECTED] . Trouble? e-mail to [EMAIL PROTECTED] .
Re: virus trashing LILO?
On Mon, 17 Nov 1997, Gustaf Erikson wrote: This is something I saw on Usenet: that a virus can infest the boot sector of a Win95/Linux machine and trash Linux via LOADLIN. Am I being terribly naive in thinking that the same might apply when you boot via LILO? As far as I can remember, my LILO resides on the bootable part of my Linux partition, and handles boot to Win95 from there. Can the MBR be subverted by a virus and wreak havoc on Linux? Actually, the original information on Usenet seems a bit off. So far as I know, this is how it works: PC hard drives have a boot sector in a defined place on the drive. When the PC boots up, the BIOS goes to the boot sector and runs the code that it finds there. This normally takes care of loading the operating system and so on. Some viruses, however, can infect the boot sector of a hard drive or floppy, and try to spread whenever the system boots (and perhaps do other damage depending on how pathologically malajusted the author is). Usually they will fire up, try to spread, and then start the operating system up themselves so the user doesn't know the virus is there. However, boot sector viruses universally assume a DOS/Win type of environment. (At least, I've never heard of one that knew about Linux.) This usually means that whne the virus tries to infect a boot sector that has LILO installed, the virus screws up the boot sector and the PC suddenly won't boot. This is actually a good way of detecting the presence of such a virus. (A lot of failed Linux installations are due to this sort of problem, and often the newbie never finds out why Linux doesn't work on my PC..) If you've got a boot floppy handy, this is no big deal. You just boot off the floppy, reinstall LILO, and then work on disinfecting the Windows side of things. (Deleting the insecure OS is a good start. :- ) If you don't have a boot floppy, you may have a problem. If the virus mucks with the partition table (whether because the virus was badly written or because the goofball who wrote it actually planned it) then you may have a larger problem, though. Then you may need to restore from backup. (If you don't keep backups, why not?) If you use LOADLIN instead of LILO, the boot sector virus has already run. Generally LOADLIN will work just fine, until the virus does something vicious to your system. LOADLIN starts running as a Windows application, though, and thus could itself be infected by an application virus, with the normal unpredictable results. Sincerely, Ray Ingles (248) 377-7735 [EMAIL PROTECTED] Screwing things up is *easy*. People do it by *accident*. If think you're clever, try *improving* something. - Me -- TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word unsubscribe to [EMAIL PROTECTED] . Trouble? e-mail to [EMAIL PROTECTED] .
