# Win VIRUS is affecting my LINUX? How to solve it [SOLVED]

## john745

Hullo:

I have a BIG problem.

Let me make you a resume: I have a HD, 50%WinXP, 50%Gentoo.

Being in WinXP, AVG detected that i had the "backdoor virus", so i proceeded to eliminate it. At the end i do not know if i trully deleted it, but i passed several antivirus and those program did not found it again.

I was attemping to install de ServicePack 2 i WinXP, this is a way to prevent the "backdoor virus". So i did the installation, but an error ocurred because i did not had enough HD space. The installation stopped, said that it did a partial actualization and, XP may not be operating correctly -because the actualization was not completed-, after that the PC rebooted.

Now when im trying to enter to my XP part, shortly after to get to the Administrator screen -the blue one, where you put the password to enter to the session- the PC reboot, constanly. So, i can not enter, i tried safe mode, etc...all that i could imagine.

Well, as a solution, my plan was to move some important files to my Gentoo partition -from my WinXP partition- and format the WInXP part, and re-install. I did it. But when i re-started my Linux, i get a message that my JUK -musci program- could not read some files -some files that i moved where of music, BUT the files i was reading in JUK where in my WINXP partition NOT in the linux one- and it may be corrupted files -because of the virus?-

I read how to solute the problem in internet: deleting the JUK carpet in /.kde, i did and i could re-scan the files and hear music. But when i newly rebooted i get the same error!.

Now, is the worst thing. Now when im entering to my Linux partition, in the KDE screen when you put the password of the user(s), after i put it and press Login, the screen constantly re-load, over and over, like  a loop, so i can not get into Linux. When i try to do it in another user account i have, the PC gets freeze.

So, im wondering if is the "virus" that cause me this! Maybe ehen i passed my files to Linux i also pased this "virus" -which i do not know which one is! I supose that is backdoor-.

I have an hypothesis also, maybe i can not eneter to my WinXP part because i do not have enoguh space, only 5mg, and maybe the computer needs come space to do a process and enter?? I do ot know

As can you see, i have nothing, nor windows nor linux works!!!!

Help!

GreetingsLast edited by john745 on Thu Feb 08, 2007 12:33 am; edited 1 time in total

----------

## Roman_Gruber

Hi I would suggest to install a antivirus software for linux. http://packages.gentoo.org/packages/?category=app-antivirus => take fprot.

Download it, install it and get rid of the viruses on your computer.

----------

## Zillode

Windows has problems when booting from a hard disk with less than 100MB on it. You should try a live cd with ntfs-3g support (or do you use fat?) and delete some files from your windows partition.

I don't think that the virus corrupted your linux installation (it is possible, but very unlikely). You should check your config files and filesystem first.

I should backup all the files, clean the windows partition, perform a virusscan, and then reinstall windows

greetzLast edited by Zillode on Sun Feb 04, 2007 5:03 pm; edited 1 time in total

----------

## john745

But how can i do it if i can not enter to my Linux partition???

And im presuming that is the virus that cased this.

----------

## john745

ok, let me try if i can free some space!

----------

## Roman_Gruber

get the gparted live cd, and boot from it. Then look at your config files and your /boot/grub/grub.conf  /etc/init.d/ ....

You could also use the gentoo cd and boot from it.

I would first try to get linux or windows working. Therefor backup your data, and if nothing helps, e.g. reinstall windows then.

----------

## john745

Well, with the space thing: i get free 129mg, and the same problem, it reboot.

Well, let me try with de "liveCD", i will use my Gentoo CD´s that is all what i have! -to see if work, because i can not download anything because my PC does not work-

Well, i prefer to get working Win, because there i have my files

----------

## john745

Ok, this are the result for the live CD

```

gentoo@livecd /boot $ cd grub

gentoo@livecd /boot/grub $ ls

e2fs_stage1_5     iso9660_stage1_5  reiserfs_stage1_5  stage2_eltorito

fat_stage1_5      jfs_stage1_5      splash.xpm.gz      ufs2_stage1_5

ffs_stage1_5      menu.lst          stage1             vstafs_stage1_5

grub.conf.sample  minix_stage1_5    stage2             xfs_stage1_5

```

I only have the sample one?

Which has

```

#

# Sample boot menu configuration file

#

# Boot automatically after 30 secs.

timeout 30

# By default, boot the first entry.

default 0

# Fallback to the second entry.

fallback 1

# For booting GNU/Hurd

title  GNU/Hurd

root   (hd0,0)

kernel /boot/gnumach.gz root=hd0s1

module /boot/serverboot.gz

```

In my init.d i hace

```

gentoo@livecd /etc/init.d $ ls

acpid               dante-sockd   localmount    nfsmount      smartd

alsasound           depscan.sh    mdadm         nscd          spamd

apmd                distccd       mkxf86config  numlock       spind

autoconfig          domainname    modules       partimaged    splash

bittorrent-tracker  esound        net.aol       pcmcia        sshd

bootmisc            famd          net.eth0      portmap       syndaemon

capi                functions.sh  net.eth1      pwgen         syslog-ng

checkfs             gpm           net.eth2      reboot.sh     test

checkroot           halt.sh       net.eth3      rmnologin     urandom

clock               hdparm        net.eth4      rsyncd        vixie-cron

coldplug            hostname      net.lo        runscript.sh  x-setup

consolefont         hotplug       net.ppp0      samba         xdm

crypto-loop         keymaps       netmount      shutdown.sh

cupsd               local         nfs           slmodem

```

Sory, but i dont know much of linux, so i dont know what to see or do

As a strange thing, in the livecd, when i was aked for my user name and password it sya me that was incorrect!

Only pressing enter, without putting anything, i could enter

Greetings

----------

## Roman_Gruber

Here is the problem. You should have a grub.conf file in /boot/grub/grub.conf. Grub needs this file to boot properly. Just make a file and booting linux should work.

It should look something like this. If you don*t have any kernel etc. files take it from the gentoo cd.

```
roman@notebook /boot/grub $ pwd

/boot/grub

roman@notebook /boot/grub $ ls -al

total 427

drwxr-xr-x 2 root root   1024 Jan 16 16:59 .

drwxr-xr-x 4 root root   1024 Feb  2 18:19 ..

-rw-r--r-- 1 root root    197 May 17  2006 default

-rw-r--r-- 1 root root     30 May 17  2006 device.map

-rw-r--r-- 1 root root   7456 Jan 16 16:59 e2fs_stage1_5

-rw-r--r-- 1 root root   7360 Jan 16 16:59 fat_stage1_5

-rw-r--r-- 1 root root   6624 Jan 16 16:59 ffs_stage1_5

-rw-r--r-- 1 root root   1437 Feb  2 18:31 grub.conf

-rw-r--r-- 1 root root   1842 Jan 16 16:59 grub.conf.sample

-rw-r--r-- 1 root root   6624 Jan 16 16:59 iso9660_stage1_5

-rw-r--r-- 1 root root   8064 Jan 16 16:59 jfs_stage1_5

lrwxrwxrwx 1 root root      9 May 17  2006 menu.lst -> grub.conf

-rw-r--r-- 1 root root   6752 Jan 16 16:59 minix_stage1_5

-rw-r--r-- 1 root root   9088 Jan 16 16:59 reiserfs_stage1_5

-rw-r--r-- 1 root root  33856 Jan 16 16:59 splash.xpm.gz

-rw-r--r-- 1 root root    512 Jan 16 16:59 stage1

-rw-r--r-- 1 root root 102908 Jan 16 16:59 stage2

-rw-r--r-- 1 root root 102844 Jan  4 17:40 stage2.old

-rw-r--r-- 1 root root 102908 Jan 16 16:59 stage2_eltorito

-rw-r--r-- 1 root root   6944 Jan 16 16:59 ufs2_stage1_5

-rw-r--r-- 1 root root   6176 Jan 16 16:59 vstafs_stage1_5

-rw-r--r-- 1 root root   8744 Jan 16 16:59 xfs_stage1_5

roman@notebook /boot/grub $ cat grub.conf

# Welcher Eintragg standardmaessig gebootet werden soll

#Windows

#default 0

#Linux

default 2

# Wieviele Sekunden gewartet werrden soll, bevor der Standardeintrag gebootet wird

timeout 30

# Ein netter, fettes Hindergrundbild um die ganze Sache ein wenig zu wuerzen

splashimage=(hd0,0)/boot/grub/splash.xpm.gz

# Zum Starten der Windows-Partition

title=Windows XP SP2 German

rootnoverify (hd0,1)

makeactive

chainloader +1

title= (stable) Kernel-2.6.18-gentoo-r5_32_Kernel_Cleaning

root(hd0,0)

kernel /boot/Kernel-2.6.18-gentoo-r5_32_Kernel_Cleaning vga=791 idebus=333

title= /boot/Kernel-2.6.18-gentoo-r6_V8

root(hd0,0)

kernel /boot/Kernel-2.6.18-gentoo-r6_V8 vga=791 idebus=333

title= (usb stick geht nicht mounten) /boot/Kernel-2.6.18-gentoo-r6_V7_I2C

root(hd0,0)

kernel /boot/Kernel-2.6.18-gentoo-r6_V7_I2C vga=791 idebus=333

title= (OK, lm_sensors not working) /boot/Kernel-2.6.18-gentoo-r6_V6_I2C

root(hd0,0)

kernel  /boot/Kernel-2.6.18-gentoo-r6_V6_I2C vga=791 idebus=333

# kernel /boot/... pci=assign-busses   brauchte ich frueher um PCMCIA SLOT zu erkennen!

#/lib/modules .. liegen die Module vom Kernel!!

title=(NOT-Kit-Working) Genkernel 2.6.17-r8 GENTOO

root(hd0,0)

kernel /boot/kernel-genkernel-x86_64-2.6.18-gentoo-r4 init=/linuxrc ramdisk=16384 real_root=/dev/hda5 vga=791 splash=silent

initrd /boot/initramfs-genkernel-x86_64-2.6.18-gentoo-r4

title= vanilla 2.6.19.2_V1

root(hd0,0)

kernel /boot/Kernel-2.6.19.2_V1

roman@notebook /boot/grub $ 

```

----------

## Roman_Gruber

Look in the gentoo handbook, to get starting with the grub.conf.

----------

## john745

uhm, well i have some questions

1.- Why if could enter yesterday to linux today i could not? I mean, actually gentoo boots -i think- because i enter to the KDE envoirement

2.- In the liveCD, using the console i do not see ANY of my files that i had in gentoo, my home is empty

```

gentoo@livecd ~ $ ls

Desktop

```

3.- What you tell me to do is something like this?

```

 Grub

Set up Gentoo's entry in your grub.conf as is described in the Handbook, then add these lines

File: grub.conf

# For booting Windows NT or Windows95

title Windows

rootnoverify (hd0,0)

makeactive

chainloader  +1

# For loading DOS if Windows NT is installed

# chainload /bootsect.dos

```

4.- About WinXP, any suggestion?

Sorry for my obstination, but i cant believe that from one day to another gentoo becames a mess!

----------

## Roman_Gruber

Can you boot into gentoo?? YES => What do you want to know then?

Thanks.

----------

## Roman_Gruber

 *Quote:*   

> 
> 
> 2.- In the liveCD, using the console i do not see ANY of my files that i had in gentoo, my home is empty
> 
> 

 

Thats easy, because you have to mount your homepartiton or root partition to the /home folder 

e.g. mount /dev/hda7 /mnt/Daten => see 

```
man mount
```

 man gives an information about an command, here the mount command.

----------

## shakti

 *Gromlok wrote:*   

> 
> 
> 2.- In the liveCD, using the console i do not see ANY of my files that i had in gentoo, my home is empty
> 
> ```
> ...

 

When you boot with the live cd none of your partitions get mounted so you only see whats on the cd. This counts for grub too, booting from life cd and looking at /boot actually shows you /boot on the cd not your hd.

 *Gromlok wrote:*   

> 
> 
> 3.- What you tell me to do is something like this?
> 
> ```
> ...

 

my grub.conf its called menu.lst I dont thing you have a problem with grub if it worked before, leave grub alone (unless you reinstall xp, then reinstall grub as xp overwrites your mbr)

 *Gromlok wrote:*   

> 
> 
> 4.- About WinXP, any suggestion?
> 
> Sorry for my obstination, but i cant believe that from one day to another gentoo becames a mess!

 

The problem most likely lies between the chair and the keyboard not within gentoo. About XP, get an x-box and delete XP

----------

## john745

Ok, let go by parts:

1)Gentoo boots, this mean, it ENTERS to KDE envoriment, BUT in the screen where i must put my user login/password to enter to the KDE, after i do that, this page -the screen of login/pass- reloads, if i do it again -writting my user name /pass- it reloads again and again. So, it boots but i do not know why i cant enter.

2)This is strange -or maybe im an idiot, quite probably- In the livecd boot, i enter to the terminal -or console- i change to "root", mount my partition where i have installed gentoo. Shortly after that, the livecd Desktop gets blank and all i get is the terminal screen, in which any function works, for ex "ls". I make sure that actually i mounted, beacuse in this "range of time" between i mount the partition and the desktop gets blank -and useless- i manage to enter to the root carpet and see my files. So it was mounted.

What i did was:

mount /dev/hda7 /mnt/ (in root)

What this means?......is "corrupted" gentoo?.or is my fault because who "lies between the chair and the keyboard" is me.   :Wink:  lol

Greetings

----------

## shakti

can you list step by step what you do and what the output is?

after you boot Live cd: 

```

mount -t auto /dev/hda7 /mnt/gentoo

mount

ls /mnt/gentoo/

```

if hda7 indeed is your root partition and it is empty then we have a big problem  :Smile:  ,but just the fact that you get kdm up and running tells us that this is not the case, maybe hda7 is not root? Anyhow let me know what the above does.

Also can you log into console? Do Ctrl+Alt+F1 at the kdm login screen, and try to log on as user and root.

----------

## john745

Hullo

Well, let me put aht im doing right now. It may be cutted beacuse probably the "blanck screen" will appears and i may not write all

Here we go> -it appears that my root was hd5!-

```

gentoo@livecd ~ $ sudo su -

livecd ~ # mount -t auto /dev/hda5 /mnt/gentoo

livecd ~ # mount

tmpfs on / type tmpfs (rw)

/dev/hdd on /mnt/cdrom type iso9660 (ro)

/dev/loop/0 on /mnt/livecd type squashfs (ro)

proc on /proc type proc (rw,nodiratime)

sysfs on /sys type sysfs (rw)

udev on /dev type tmpfs (rw,nosuid)

devpts on /dev/pts type devpts (rw)

cachedir on /mnt/livecd/lib/splash/cache type tmpfs (rw)

tmpfs on /mnt/livecd/lib/firmware type tmpfs (rw)

tmpfs on /mnt/livecd/usr/portage type tmpfs (rw)

tmpfs on /mnt/livecd/var/lib/xkb type tmpfs (rw)

usbfs on /proc/bus/usb type usbfs (rw,devmode=0664,devgid=85)

/dev/hda7 on /mnt/gentoo type ext3 (rw)

livecd ~ # ls /mnt/gentoo/

bin         opt                             stage3-x86-2006.0.tar.bz2.DIGESTS

boot        portage-latest.tar.bz2          stage3-x86-2006.0.tar.bz2.asc

dev         portage-latest.tar.bz2.gpgsig   sys

etc         portage-latest.tar.bz2.md5sum   tmp

portage-latest.tar.bz2.umd5sum  usr

home        proc                            var

lib         root                            winXP

lost+found  sbin

mnt         stage3-x86-2006.0.tar.bz2

```

oh god, it has not stopped yet!!

Let continue

```

total 6400

-rw-r--r--  1 root root       0 Feb 17  2006 .keep

-rw-r--r--  1 root root  832894 Feb 22  2006 System.map-genkernel-x86-2.6.15-gentoo-r5

lrwxrwxrwx  1 root root       1 Feb 22  2006 boot -> .

drwxr-xr-x  1 root root     252 Feb 17  2006 grub

-rw-r--r--  1 root root 4035800 Feb 22  2006 initramfs-genkernel-x86-2.6.15-gentoo-r5

-rw-r--r--  1 root root 1683424 Feb 22  2006 kernel-genkernel-x86-2.6.15-gentoo-r5

```

the grub.conf

```

default 0

timeout 30

title=Gentoo Linux 2.6.15

root (hd0,4)

kernel /boot/2.6.15-gentoo root/dev/hda7

```

Now, is something wrong? what must i do???Last edited by john745 on Tue Feb 06, 2007 12:34 am; edited 1 time in total

----------

## john745

somebody? help! i have all my info there

----------

## Incabulos

Your root ( / ) filesystem appears to be /dev/hda7. The line for this in your grub.conf therefore seems correct.

```

# mount 

/dev/hda7 on /mnt/gentoo type ext3 (rw) 
```

Your boot ( /boot ) filesystem appears to be /dev/hda5, there is no info about this anywhere, though this is what your grub.conf is reporting:

```

root (hd0,4) 
```

This means /dev/hda5 in the context of your system. This also means that your 'kernel' option should be a full path relative to '/boot' rather than '/' however.  There was also a needed '=' sign missing in your 'root' option.

Try using the following in grub.conf:

```
title=Gentoo Linux 2.6.15

root (hd0,4)

kernel /2.6.15-gentoo root=/dev/hda7
```

----------

## gnoobie

there is also a command you can try in windows if you boot with a cd or floppy etc

chkdsk c: /r

----------

## john745

Hullo

Well i did the thing of the grib.conf, and nothigh changed.

About the chkdsk, it does not work>

```

livecd grub # man chkdsk

No manual entry for chkdsk

```

 :Shocked: 

But i notice something, when Linux was loading, in the screen where you have the green *, or the red [!!] ones. I noticed a message -in yellow- saying that "The filesystem could not be corrected [!!]"

Maybe i have some corruoted filesystem, but why and which ones?

Also i tried something, in the KDE screen, where th screen get loaded every time i put my passwod, i swithched to another screen with ctrl + shift + f2.

After that i did "startx", and a message appears saying that the deviec could not be loaded because there was not suficient space in the divice!!

But, after that i logged as a SU and did the startx, and i could not be loaded because i was running in other session -thats what i undersood- bur i did the "ps" and killed all the "x" process. I did not start the startx!

I giving those "childish" details for if yuo find something relevant!!

Greetings, and thank you (help)[/quote]

----------

## madisonicus

 *Gromlok wrote:*   

> Well i did the thing of the grib.conf, and nothigh changed.

 Exactly what thing did you do?  I'm going to suggest too that you check your spelling in your grub.conf since ... well... yeah...

 *Gromlok wrote:*   

> About the chkdsk, it does not work>
> 
> ```
> livecd grub # man chkdsk
> 
> ...

  *gnoobie wrote:*   

> there is also a command you can try in windows if you boot with a cd or floppy etc
> 
> chkdsk c: /r

 

----------

## defenderBG

why do u try logging from the live cd???

when u come to the kde log in than click: "choose session" > "console login"

on the promt write your username, password, when u get authentified, just write:

startx

than atleast u will be able to tell us what the problem with kde is.

and btw... before startx, write:

df -h

and give the output...

ps: is this really for that part of the forum? 

pps: ADVERTISMENT: Vote for me and make me a MOD and I will change the world for u  :Very Happy: 

----------

## john745

Well, to problem is partially soluted.

You were right, i did the "df" command and nituce that mi partition was 100% used -i supose that is because i passes my files from win to linux-. Thou, Linux did not warm me about my storage capacity. 

I guess that that in win is the same problem.

Greetings, and thank you for your help.

PD: i have another question, i my home/user folder, my files just use like 3GB, but the "hidden files" -just selected that option in KDE- use 22GB........thats grotesque..........for ex, the ".local" file uses 20gb, when i see there is a backup of the files that i deleted in the trash. But when i re-trashed -because i deleted one time- the files -the backup- appears again in ./local/share/trash folder. How to solve this?

----------

## Dralnu

 *Gromlok wrote:*   

> Well, to problem is partially soluted.
> 
> You were right, i did the "df" command and nituce that mi partition was 100% used -i supose that is because i passes my files from win to linux-. Thou, Linux did not warm me about my storage capacity. 
> 
> I guess that that in win is the same problem.
> ...

 

CAREFULLY rm them.

man rm

make sure of what you are deleting, too.

----------

