Debian Squeeze - Renovating an Infected XP Machine - Part 1

A few days ago, a friend called me to ask if I'd have a look at their home computer.  She told me that it had recently started to slow down markedly, and had become difficult to use.  When I indicated that I was home now and had some time to check it all out, she immediately told me to stay there and she'd be over with the machinery in about 20 min.

Having a look at what she brought over revealed a mixed bag, but a machine that had some good points.  It was oldish, but had a Pentium IV 2.4, 2 Gig of Memory, a Geoforce MX400 AGP video card and a 120 gig HDD, together with a Combo DVD/CD drive.  They had a 15 inch LCD screen, and the OS was Windows XP Home.

Firing everything up, and it waasss slloooowwwwww ......... it just didn't feel right.  So, load some portable tools on a USB stick and do a registry clean and search for spyware / malware.  I copied some tools over from my Mac laptop and started work.

I started to become suspiscious when every registry scan crashed, then every spyware / adware / malware cleaner crashed as well.  Hmmmmm.  And then when I looked at the USB stick next time I mounted it on the Mac, there were two locked, hidden files - the "autorun.inf" and a 600k executable "kalwka.exe" (or something similar).  I deleted them (with much squawking from them) and connected the USB stick to the Windows machine again.  I immediately removed it and had another look - the files were back.  That solves that mystery .... but what to do about it?  I did an internet search, but that revealed nothing.  And there was little point pursuing it further - the machine was infected with somthing that did not wish to be removed.  At the very least, a reformat and new Windows install using the recovery partition (via the supplied floppy disk) was called for.

First step was to call the friend and suggest they change as many passwords as they could think of, in case this beastie had been talking home.  Next, I suggested they come over for dinner in a couple of days and I could tell them of a few possibilities, and in the meantime, maybe they'd like to consider Linux as a replacement on the machine.  I was somewhat pleasantly surprised to get a return phone call with them enthusiastic to check the possibility out, so I prepared the system for our "installfest dinner".

My evil plans for the machine .........

Having seen the video performance, I figured replacing the video card with a newer one was a good idea.  Any AGP card now was going to be way too powerful for the machine, but at least it would be CPU limited, rather than GPU limited as it currently was.  And who knows?  Linux may do something similar to Mac Snow Leopard and use the GPU for general computing power.  End result was an ATI Radeon HD 3650 card, for no other reason than it was cheaper than the nVidia card on offer.

Now for the software ... well I had a 120 Gig HDD to play with, most of which was vacant - so I figured I'd shrink the XP partition and install ntfs RW access so they could find and recover their data.  I have had previous experience with people hiding their data in strange places on Windows, and have no wish to repeat the mistake of blithely deleting said data.  I tried a couple of "parted" based CD distros (which refused to boot), however Parted Magic was the clear winner - wow - what a neat distro.  Most impressed.  So I went ahead and shrank the XP partition to about 30 gig, and created a swap and 90 gig partition for my install distro.

What to install?  I'm a committed Debian / Slackware fan.  Whilst I'd have loved to have done Slackware, Debian is the go - or a derivative.  As it turned out, I tried Mepis - mostly because I believe the basis for this distro is more sound than Ubuntu, but as luck would have it, the DVD drive would not boot Mepis - something I ultimately figured was the fault of the drive - an incompatibility between the drive that burnt the disk, and the drive that read it.

So, in a fit of curiosity I called up the Debian Installer page and downloaded the latest netinstall for Debian testing - (Squeeze at the moment) due to go stable next year some time.  I find it interesting that no matter what I do, I end up coming back to Debian.  The burnt CD booted flawlessly and a standard Debian desktop was soon installed.  Then dinner called, and the evenings adventures turned to food and wine.

Debian Squeeze Pt 3

 Grub
 After I managed to get my Lenny installation back into the Grub menu by using " update-grub ", I spent some time trying to work out WHY Grub in Squeeze didn't seem to correspond with that in Lenny.  Answer - Squeeze uses Grub2 .... well that is pretty obvious.  Instead of a Menu.lst file, there is now a Grub.cfg file that contains the parameters.  Grub.cfg says that the automatically generated part of the file should not be edited, however I see no other way to change the timeout value of the menu splash screen, or which distro is seen as the default.  More research.

grub.cfg notes.

Well, according to the notes, I can edit the file and change the timeout and default boot by a simple edit of two values.  So I opened the file ready to edit it and there at the top it told me to go to " /etc/defaults/grub " and edit the values in there.  Aha! Simple ..... change the timeout value, and put the LINE NO of the entry I want to be the default.  The first line being 0.  In my case, I wanted the 4th entry to be the default, so I set the value to 3.

done!

works a treat!

Debian Squeeze Pt 2

Love Hate
A few days after having Squeeze on my machine, there were a few hates and a few things to love.

• It is just so great to have wireless "just work" without having to worry about any other packages.
• Everything I've thrown at the Gnome multimedia player has "just worked".
• Grub did not cleanly install the first time.  Only Squeeze appeared on the menu, which was a little more flashy than previous, though irritating in other ways.  Still, "update-grub" worked fine and I regained my other inatallations.  For all that though, I still need to edit the menu so will have to investigate that.
• I love the way Gnome automounted any extra partitions it found.

Video
One thing I wanted to do was to install the nVidia video drivers.  Unfortunately, the "Debian way" from the repositories failed for me for some reason, so I reverted to simply installing them using the nVidia installer.  There is a nice tutorial at "Pendrive Linux" that shows how to do this.   Any time a new kernel is installed, this procedure will need to be repeated, so it is worthwhile having the instructions printed next to your computer.

For all that though, I'll re-attempt the "Debian way" at a later stage.

Extreme Tux Racer
A silly game perhaps, but it is still fun for a little diversion.  Unfortunately, I could just not get the thing to work on my machine.  Any time I tried to start it, I got an "out of range" message on a black screen, and that was it.  I had it in my brain that this referred to the video refresh, until it occurred to me that maybe it was the screen resolution.  How to fix it?  Well, it so happens that the configuration settings are in a hidden directory " .etracer " in the user's home directory.  Open this and there is a textfile called "options".  All I did was to open this in an editor, find where the screen resolution was listed (default is 800 x 600 ) and replace these figures with my actual resolution.  Voila!!

Debian Squeeze Pt 1

It was almost the last day of the month (Ubuntu KK released today) and I had plenty of bandwidth left.  I had this new 500 gig HDD I'd installed not doing anything, and my Debian Lenny install, whilst I was really happy with it, was stuck at 8 months ago.  Now 8 months may not seem like much, but in the Linux world it is really, really big.  Not only that, those 8 months had seen the next iteration of the Debian produce mature to at least a good representation of what it would be.  So, it was time to have a look at Debian Testing, aka Squeeze.

Now, I must admit here that I've installed Debian many times, so I do tend to gloss over some details that would infuriate someone new to the craft.  The best grounding I can give is the wonderful tutorial to set up Debain Lenny that is on "howtoforge".

Of course, when I went to search for this article, I came apon a similar one for Slackware 12 which I HAVE to include.  Slackware is wonderful - make no mistake.  If you do not realise this then go stand in front of the mirror and take a good look at yourself...... :)

Back to my Squeeze.

I suppose I should start off with what hardware I have.  Well, it is old.  I have a Gigabyte motherboard that hosts a P4 3.0C intel processor.  I have a sound card add on, an Nvidia 6800 video card and 2 gig of memory, and I recently installed a Dlink Atheros powered WiFi card.  My screen is a 22" Chimei LCD screen.  One final piece of information is that the HDD I am installing to is the slave drive, or "hdb".  Now Windows has a real hissy fit with this configuration - or it has done historically, but Linux is pretty flexible. 

First, where to get a "Squeeze" install CD.  Well you can get a "netinstall" cd from here:

What is a netinstall cd?  A netinstall cd is one that will bootstrap a full Debian install, initially putting the basic files on the system and then going to a repository on the Internet to get the rest.

Another thing I do before installing ANY Linux distro, is pre-prepare the HDD.  How to do this?  easy .. there are several minimalistic distros for just this purpose to partition your drives, Gparted being one.

I am only going to deal with a virgin HDD here .. manipulating one that already has Windows installed becomes more complex.  After booting the CD containing Gparted / Parted Magic or whatever, I look at the HDD I intend installing Linux to.  I make sure there is a partition (about 10 - 15 gig) to install the Operating System to, I give about 20 gig to a second partition for "Home" and then double the system memory to a swap partition.

Now that I have my disk set up, it is time to reboot with the Debian install CD.  Everything goes pretty much as the Lenny install, with a couple of nice touches.  Squeeze instantly recognised the wireless card on my machine and asked which I wished to use - wired eth0 or wireless.  I really liked that Grub installed to BOTH HDD, just in case you made the slave a master. 

Reboot.

A really nice desktop.  I was easily able to mount the partitions in my old HDD and everything was as I expected.

Next?

How to update, install new repositories, install video drivers .. etc etc.

Another post.