Debian Squeeze - Renovating an Infected XP Machine - Part 1

A few days ago, a friend called me to ask if I'd have a look at their home computer.  She told me that it had recently started to slow down markedly, and had become difficult to use.  When I indicated that I was home now and had some time to check it all out, she immediately told me to stay there and she'd be over with the machinery in about 20 min.

Having a look at what she brought over revealed a mixed bag, but a machine that had some good points.  It was oldish, but had a Pentium IV 2.4, 2 Gig of Memory, a Geoforce MX400 AGP video card and a 120 gig HDD, together with a Combo DVD/CD drive.  They had a 15 inch LCD screen, and the OS was Windows XP Home.

Firing everything up, and it waasss slloooowwwwww ......... it just didn't feel right.  So, load some portable tools on a USB stick and do a registry clean and search for spyware / malware.  I copied some tools over from my Mac laptop and started work.

I started to become suspiscious when every registry scan crashed, then every spyware / adware / malware cleaner crashed as well.  Hmmmmm.  And then when I looked at the USB stick next time I mounted it on the Mac, there were two locked, hidden files - the "autorun.inf" and a 600k executable "kalwka.exe" (or something similar).  I deleted them (with much squawking from them) and connected the USB stick to the Windows machine again.  I immediately removed it and had another look - the files were back.  That solves that mystery .... but what to do about it?  I did an internet search, but that revealed nothing.  And there was little point pursuing it further - the machine was infected with somthing that did not wish to be removed.  At the very least, a reformat and new Windows install using the recovery partition (via the supplied floppy disk) was called for.

First step was to call the friend and suggest they change as many passwords as they could think of, in case this beastie had been talking home.  Next, I suggested they come over for dinner in a couple of days and I could tell them of a few possibilities, and in the meantime, maybe they'd like to consider Linux as a replacement on the machine.  I was somewhat pleasantly surprised to get a return phone call with them enthusiastic to check the possibility out, so I prepared the system for our "installfest dinner".

My evil plans for the machine .........

Having seen the video performance, I figured replacing the video card with a newer one was a good idea.  Any AGP card now was going to be way too powerful for the machine, but at least it would be CPU limited, rather than GPU limited as it currently was.  And who knows?  Linux may do something similar to Mac Snow Leopard and use the GPU for general computing power.  End result was an ATI Radeon HD 3650 card, for no other reason than it was cheaper than the nVidia card on offer.

Now for the software ... well I had a 120 Gig HDD to play with, most of which was vacant - so I figured I'd shrink the XP partition and install ntfs RW access so they could find and recover their data.  I have had previous experience with people hiding their data in strange places on Windows, and have no wish to repeat the mistake of blithely deleting said data.  I tried a couple of "parted" based CD distros (which refused to boot), however Parted Magic was the clear winner - wow - what a neat distro.  Most impressed.  So I went ahead and shrank the XP partition to about 30 gig, and created a swap and 90 gig partition for my install distro.

What to install?  I'm a committed Debian / Slackware fan.  Whilst I'd have loved to have done Slackware, Debian is the go - or a derivative.  As it turned out, I tried Mepis - mostly because I believe the basis for this distro is more sound than Ubuntu, but as luck would have it, the DVD drive would not boot Mepis - something I ultimately figured was the fault of the drive - an incompatibility between the drive that burnt the disk, and the drive that read it.

So, in a fit of curiosity I called up the Debian Installer page and downloaded the latest netinstall for Debian testing - (Squeeze at the moment) due to go stable next year some time.  I find it interesting that no matter what I do, I end up coming back to Debian.  The burnt CD booted flawlessly and a standard Debian desktop was soon installed.  Then dinner called, and the evenings adventures turned to food and wine.

Debian Squeeze Pt 3

 Grub
 After I managed to get my Lenny installation back into the Grub menu by using " update-grub ", I spent some time trying to work out WHY Grub in Squeeze didn't seem to correspond with that in Lenny.  Answer - Squeeze uses Grub2 .... well that is pretty obvious.  Instead of a Menu.lst file, there is now a Grub.cfg file that contains the parameters.  Grub.cfg says that the automatically generated part of the file should not be edited, however I see no other way to change the timeout value of the menu splash screen, or which distro is seen as the default.  More research.

grub.cfg notes.

Well, according to the notes, I can edit the file and change the timeout and default boot by a simple edit of two values.  So I opened the file ready to edit it and there at the top it told me to go to " /etc/defaults/grub " and edit the values in there.  Aha! Simple ..... change the timeout value, and put the LINE NO of the entry I want to be the default.  The first line being 0.  In my case, I wanted the 4th entry to be the default, so I set the value to 3.

done!

works a treat!

Debian Squeeze Pt 2

Love Hate
A few days after having Squeeze on my machine, there were a few hates and a few things to love.

• It is just so great to have wireless "just work" without having to worry about any other packages.
• Everything I've thrown at the Gnome multimedia player has "just worked".
• Grub did not cleanly install the first time.  Only Squeeze appeared on the menu, which was a little more flashy than previous, though irritating in other ways.  Still, "update-grub" worked fine and I regained my other inatallations.  For all that though, I still need to edit the menu so will have to investigate that.
• I love the way Gnome automounted any extra partitions it found.

Video
One thing I wanted to do was to install the nVidia video drivers.  Unfortunately, the "Debian way" from the repositories failed for me for some reason, so I reverted to simply installing them using the nVidia installer.  There is a nice tutorial at "Pendrive Linux" that shows how to do this.   Any time a new kernel is installed, this procedure will need to be repeated, so it is worthwhile having the instructions printed next to your computer.

For all that though, I'll re-attempt the "Debian way" at a later stage.

Extreme Tux Racer
A silly game perhaps, but it is still fun for a little diversion.  Unfortunately, I could just not get the thing to work on my machine.  Any time I tried to start it, I got an "out of range" message on a black screen, and that was it.  I had it in my brain that this referred to the video refresh, until it occurred to me that maybe it was the screen resolution.  How to fix it?  Well, it so happens that the configuration settings are in a hidden directory " .etracer " in the user's home directory.  Open this and there is a textfile called "options".  All I did was to open this in an editor, find where the screen resolution was listed (default is 800 x 600 ) and replace these figures with my actual resolution.  Voila!!