Saturday, November 21, 2009

Debian Squeeze - Renovating an Infected XP Machine - Part 1

A few days ago, a friend called me to ask if I'd have a look at their home computer.  She told me that it had recently started to slow down markedly, and had become difficult to use.  When I indicated that I was home now and had some time to check it all out, she immediately told me to stay there and she'd be over with the machinery in about 20 min.

Having a look at what she brought over revealed a mixed bag, but a machine that had some good points.  It was oldish, but had a Pentium IV 2.4, 2 Gig of Memory, a Geoforce MX400 AGP video card and a 120 gig HDD, together with a Combo DVD/CD drive.  They had a 15 inch LCD screen, and the OS was Windows XP Home.

Firing everything up, and it waasss slloooowwwwww ......... it just didn't feel right.  So, load some portable tools on a USB stick and do a registry clean and search for spyware / malware.  I copied some tools over from my Mac laptop and started work.

I started to become suspiscious when every registry scan crashed, then every spyware / adware / malware cleaner crashed as well.  Hmmmmm.  And then when I looked at the USB stick next time I mounted it on the Mac, there were two locked, hidden files - the "autorun.inf" and a 600k executable "kalwka.exe" (or something similar).  I deleted them (with much squawking from them) and connected the USB stick to the Windows machine again.  I immediately removed it and had another look - the files were back.  That solves that mystery .... but what to do about it?  I did an internet search, but that revealed nothing.  And there was little point pursuing it further - the machine was infected with somthing that did not wish to be removed.  At the very least, a reformat and new Windows install using the recovery partition (via the supplied floppy disk) was called for.

First step was to call the friend and suggest they change as many passwords as they could think of, in case this beastie had been talking home.  Next, I suggested they come over for dinner in a couple of days and I could tell them of a few possibilities, and in the meantime, maybe they'd like to consider Linux as a replacement on the machine.  I was somewhat pleasantly surprised to get a return phone call with them enthusiastic to check the possibility out, so I prepared the system for our "installfest dinner".

My evil plans for the machine .........

Having seen the video performance, I figured replacing the video card with a newer one was a good idea.  Any AGP card now was going to be way too powerful for the machine, but at least it would be CPU limited, rather than GPU limited as it currently was.  And who knows?  Linux may do something similar to Mac Snow Leopard and use the GPU for general computing power.  End result was an ATI Radeon HD 3650 card, for no other reason than it was cheaper than the nVidia card on offer.

Now for the software ... well I had a 120 Gig HDD to play with, most of which was vacant - so I figured I'd shrink the XP partition and install ntfs RW access so they could find and recover their data.  I have had previous experience with people hiding their data in strange places on Windows, and have no wish to repeat the mistake of blithely deleting said data.  I tried a couple of "parted" based CD distros (which refused to boot), however Parted Magic was the clear winner - wow - what a neat distro.  Most impressed.  So I went ahead and shrank the XP partition to about 30 gig, and created a swap and 90 gig partition for my install distro.

What to install?  I'm a committed Debian / Slackware fan.  Whilst I'd have loved to have done Slackware, Debian is the go - or a derivative.  As it turned out, I tried Mepis - mostly because I believe the basis for this distro is more sound than Ubuntu, but as luck would have it, the DVD drive would not boot Mepis - something I ultimately figured was the fault of the drive - an incompatibility between the drive that burnt the disk, and the drive that read it.

So, in a fit of curiosity I called up the Debian Installer page and downloaded the latest netinstall for Debian testing - (Squeeze at the moment) due to go stable next year some time.  I find it interesting that no matter what I do, I end up coming back to Debian.  The burnt CD booted flawlessly and a standard Debian desktop was soon installed.  Then dinner called, and the evenings adventures turned to food and wine.

No comments:

Post a Comment