Hi folks, i'm embarrassed to say but I've just gotten a virus that's taken out my Desktop Windows 7 machine down. Had all updates installed, and was running Eset Smart Security, www.eset.com I said on Twitter today that I noticed TCp/IP ping requests triggering my Firewall. I denied these access, then all of a sudden a mysterious setup.exe was trying to communicate witha remote computer. I denied this access as well then became concerned. So i then ran an in-depth scan of the local disk. It found two viruses, but could not clean them. I then rebooted my computer and it gets to the User Account log-in screen, freezes half-way throughthe startup chime, then reboots. This then just loops. Thankfully I have the machine imaged from about 2 months back, all media etc is on external drives and documents are backed up on external drives and Dropbox. It's more about getting a working system back up and running now as I had servers configured etc on this Windows install. I have two images on external drives that I created using Image For Windows by Terabyte, but how do I restore these without sighted help? And even then with sighted help if it becomes necessary? Is there a boot disk for Image For Windows so I can get in and select the image files to restore, and if so how to I get this? i still have my seriel etc in a file on DropboxI need as close to step by step as you can manage. i will then take this information, collate it and create a document ont he blindsys admins web site. As we really need to have this sortive of thing documented. ,smiles> for Image For Windows. Regards, Barry.
right, it is almost midnight but I will have a go at this. I am presuming you have another computer. if not, you will need sighted help I think. if you don't already have it, get the image for linux iso from the terrabyte unlimited web site. a trial will do but a real one works better. 2. burn this with the included makedisk program. While it is a standard iso and will burn with anything, the makedisk program is better since it will ask you for your image for linux key during the process so you won't have to deal with this when the cd boots on your infected computer. 3. perform whatever bios magic or hotkey you have to do to get the infected machine to boot from cd and boot from the ifl cd you just burned. by default, the cd will boot up and get an ip address from dhcp with a hostname of "ifl" when the cd stopps spinning, hit esc to get out of the menu which lets you run the program connect to samba shares etc since you can't read it anyway. 5. type sshd and press enter this will start the ssh server on the ifl cd which you can connect to from another machine. YOu can do this without ssh through a serial console as well but computers with serial ports are a lot less common and usb to serial converters are iffy for this type of stuff. log in as root with either no password or ifl as the password, can't remember. notes: if you burn the iso without using the make disk program, the first screen when the cd boots will ask you for your ifl product key and will not speak. every purchase of image for windows also comes with licenses for image for dos and image for linux. I have tried making their boot disks for dos but could never get a screen reader going through autoexec.bat or anything. I am happy to help with this if you want. Hunt me up on twitter bmoore123 or skype brian.moore Brian. Contact me on skype: brian.moore follow me on twitter: http://www.twitter.com/bmoore123 On 22/12/2011 6:52 PM, Barry Toner wrote:
Hi folks,
i'm embarrassed to say but I've just gotten a virus that's taken out my Desktop Windows 7 machine down. Had all updates installed, and was running Eset Smart Security,
www.eset.com
I said on Twitter today that I noticed TCp/IP ping requests triggering my Firewall. I denied these access, then all of a sudden a mysterious setup.exe was trying to communicate witha remote computer. I denied this access as well then became concerned. So i then ran an in-depth scan of the local disk. It found two viruses, but could not clean them. I then rebooted my computer and it gets to the User Account log-in screen, freezes half-way throughthe startup chime, then reboots. This then just loops.
Thankfully I have the machine imaged from about 2 months back, all media etc is on external drives and documents are backed up on external drives and Dropbox. It's more about getting a working system back up and running now as I had servers configured etc on this Windows install. I have two images on external drives that I created using Image For Windows by Terabyte, but how do I restore these without sighted help? And even then with sighted help if it becomes necessary?
Is there a boot disk for Image For Windows so I can get in and select the image files to restore, and if so how to I get this? i still have my seriel etc in a file on DropboxI need as close to step by step as you can manage. i will then take this information, collate it and create a document ont he blindsys admins web site. As we really need to have this sortive of thing documented. ,smiles> for Image For Windows.
Regards, Barry. _______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins
Hi Brian, I'm going through lots of mails now and just seen this. Thank you for the below and I'll catch ya offlist. This looks great and will be nice to have contact with someone who's successfully restored without eyes. BTW. I've also got myself a copy of GRML which while backup was the motivation, seems it has other useful sys admin tools and built-in speech in the way of the Speakup screen reader. Regards, Barry. -----Original Message----- From: blind-sysadmins-bounces@lists.hodgsonfamily.org [mailto:blind-sysadmins-bounces@lists.hodgsonfamily.org] On Behalf Of Brian Moore Sent: Friday, December 23, 2011 4:56 AM To: Blind sysadmins list Subject: Re: [Blind-sysadmins] Windows 7/Image For Windows/Viruses right, it is almost midnight but I will have a go at this. I am presuming you have another computer. if not, you will need sighted help I think. if you don't already have it, get the image for linux iso from the terrabyte unlimited web site. a trial will do but a real one works better. 2. burn this with the included makedisk program. While it is a standard iso and will burn with anything, the makedisk program is better since it will ask you for your image for linux key during the process so you won't have to deal with this when the cd boots on your infected computer. 3. perform whatever bios magic or hotkey you have to do to get the infected machine to boot from cd and boot from the ifl cd you just burned. by default, the cd will boot up and get an ip address from dhcp with a hostname of "ifl" when the cd stopps spinning, hit esc to get out of the menu which lets you run the program connect to samba shares etc since you can't read it anyway. 5. type sshd and press enter this will start the ssh server on the ifl cd which you can connect to from another machine. YOu can do this without ssh through a serial console as well but computers with serial ports are a lot less common and usb to serial converters are iffy for this type of stuff. log in as root with either no password or ifl as the password, can't remember. notes: if you burn the iso without using the make disk program, the first screen when the cd boots will ask you for your ifl product key and will not speak. every purchase of image for windows also comes with licenses for image for dos and image for linux. I have tried making their boot disks for dos but could never get a screen reader going through autoexec.bat or anything. I am happy to help with this if you want. Hunt me up on twitter bmoore123 or skype brian.moore Brian. Contact me on skype: brian.moore follow me on twitter: http://www.twitter.com/bmoore123 On 22/12/2011 6:52 PM, Barry Toner wrote:
Hi folks,
i'm embarrassed to say but I've just gotten a virus that's taken out my Desktop Windows 7 machine down. Had all updates installed, and was running Eset Smart Security,
www.eset.com
I said on Twitter today that I noticed TCp/IP ping requests triggering my Firewall. I denied these access, then all of a sudden a mysterious setup.exe was trying to communicate witha remote computer. I denied this access as well then became concerned. So i then ran an in-depth scan of the local disk. It found two viruses, but could not clean them. I then rebooted my computer and it gets to the User Account log-in screen, freezes half-way throughthe startup chime, then reboots. This then just loops.
Thankfully I have the machine imaged from about 2 months back, all media etc is on external drives and documents are backed up on external drives and Dropbox. It's more about getting a working system back up and running now as I had servers configured etc on this Windows install. I have two images on external drives that I created using Image For Windows by Terabyte, but how do I restore these without sighted help? And even then with sighted help if it becomes necessary?
Is there a boot disk for Image For Windows so I can get in and select the image files to restore, and if so how to I get this? i still have my seriel etc in a file on DropboxI need as close to step by step as you can manage. i will then take this information, collate it and create a document ont he blindsys admins web site. As we really need to have this sortive of thing documented. ,smiles> for Image For Windows.
Regards, Barry. _______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins
_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins __________ Information from ESET Smart Security, version of virus signature database 6738 (20111223) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 6782 (20120110) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 6782 (20120110) __________ The message was checked by ESET Smart Security. http://www.eset.com
Hi Brian, I'm going through lots of mails now and just seen this. Thank you for the below and I'll catch ya offlist. This looks great and will be nice to have contact with someone who's successfully restored without eyes. BTW. I've also got myself a copy of GRML which while backup was the motivation, seems it has other useful sys admin tools and built-in speech in the way of the Speakup screen reader. Regards, Barry. -----Original Message----- From: blind-sysadmins-bounces@lists.hodgsonfamily.org [mailto:blind-sysadmins-bounces@lists.hodgsonfamily.org] On Behalf Of Brian Moore Sent: Friday, December 23, 2011 4:56 AM To: Blind sysadmins list Subject: Re: [Blind-sysadmins] Windows 7/Image For Windows/Viruses right, it is almost midnight but I will have a go at this. I am presuming you have another computer. if not, you will need sighted help I think. if you don't already have it, get the image for linux iso from the terrabyte unlimited web site. a trial will do but a real one works better. 2. burn this with the included makedisk program. While it is a standard iso and will burn with anything, the makedisk program is better since it will ask you for your image for linux key during the process so you won't have to deal with this when the cd boots on your infected computer. 3. perform whatever bios magic or hotkey you have to do to get the infected machine to boot from cd and boot from the ifl cd you just burned. by default, the cd will boot up and get an ip address from dhcp with a hostname of "ifl" when the cd stopps spinning, hit esc to get out of the menu which lets you run the program connect to samba shares etc since you can't read it anyway. 5. type sshd and press enter this will start the ssh server on the ifl cd which you can connect to from another machine. YOu can do this without ssh through a serial console as well but computers with serial ports are a lot less common and usb to serial converters are iffy for this type of stuff. log in as root with either no password or ifl as the password, can't remember. notes: if you burn the iso without using the make disk program, the first screen when the cd boots will ask you for your ifl product key and will not speak. every purchase of image for windows also comes with licenses for image for dos and image for linux. I have tried making their boot disks for dos but could never get a screen reader going through autoexec.bat or anything. I am happy to help with this if you want. Hunt me up on twitter bmoore123 or skype brian.moore Brian. Contact me on skype: brian.moore follow me on twitter: http://www.twitter.com/bmoore123 On 22/12/2011 6:52 PM, Barry Toner wrote:
Hi folks,
i'm embarrassed to say but I've just gotten a virus that's taken out my Desktop Windows 7 machine down. Had all updates installed, and was running Eset Smart Security,
www.eset.com
I said on Twitter today that I noticed TCp/IP ping requests triggering my Firewall. I denied these access, then all of a sudden a mysterious setup.exe was trying to communicate witha remote computer. I denied this access as well then became concerned. So i then ran an in-depth scan of the local disk. It found two viruses, but could not clean them. I then rebooted my computer and it gets to the User Account log-in screen, freezes half-way throughthe startup chime, then reboots. This then just loops.
Thankfully I have the machine imaged from about 2 months back, all media etc is on external drives and documents are backed up on external drives and Dropbox. It's more about getting a working system back up and running now as I had servers configured etc on this Windows install. I have two images on external drives that I created using Image For Windows by Terabyte, but how do I restore these without sighted help? And even then with sighted help if it becomes necessary?
Is there a boot disk for Image For Windows so I can get in and select the image files to restore, and if so how to I get this? i still have my seriel etc in a file on DropboxI need as close to step by step as you can manage. i will then take this information, collate it and create a document ont he blindsys admins web site. As we really need to have this sortive of thing documented. ,smiles> for Image For Windows.
Regards, Barry. _______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins
_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins __________ Information from ESET Smart Security, version of virus signature database 6738 (20111223) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 6782 (20120110) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 6782 (20120110) __________ The message was checked by ESET Smart Security. http://www.eset.com
Very interesting, can anyone do a short podcast on using this method. -----Original Message----- From: blind-sysadmins-bounces@lists.hodgsonfamily.org [mailto:blind-sysadmins-bounces@lists.hodgsonfamily.org] On Behalf Of Barry Toner Sent: Tuesday, January 10, 2012 10:17 AM To: Blind sysadmins list Subject: Re: [Blind-sysadmins] Windows 7/Image For Windows/Viruses Hi Brian, I'm going through lots of mails now and just seen this. Thank you for the below and I'll catch ya offlist. This looks great and will be nice to have contact with someone who's successfully restored without eyes. BTW. I've also got myself a copy of GRML which while backup was the motivation, seems it has other useful sys admin tools and built-in speech in the way of the Speakup screen reader. Regards, Barry. -----Original Message----- From: blind-sysadmins-bounces@lists.hodgsonfamily.org [mailto:blind-sysadmins-bounces@lists.hodgsonfamily.org] On Behalf Of Brian Moore Sent: Friday, December 23, 2011 4:56 AM To: Blind sysadmins list Subject: Re: [Blind-sysadmins] Windows 7/Image For Windows/Viruses right, it is almost midnight but I will have a go at this. I am presuming you have another computer. if not, you will need sighted help I think. if you don't already have it, get the image for linux iso from the terrabyte unlimited web site. a trial will do but a real one works better. 2. burn this with the included makedisk program. While it is a standard iso and will burn with anything, the makedisk program is better since it will ask you for your image for linux key during the process so you won't have to deal with this when the cd boots on your infected computer. 3. perform whatever bios magic or hotkey you have to do to get the infected machine to boot from cd and boot from the ifl cd you just burned. by default, the cd will boot up and get an ip address from dhcp with a hostname of "ifl" when the cd stopps spinning, hit esc to get out of the menu which lets you run the program connect to samba shares etc since you can't read it anyway. 5. type sshd and press enter this will start the ssh server on the ifl cd which you can connect to from another machine. YOu can do this without ssh through a serial console as well but computers with serial ports are a lot less common and usb to serial converters are iffy for this type of stuff. log in as root with either no password or ifl as the password, can't remember. notes: if you burn the iso without using the make disk program, the first screen when the cd boots will ask you for your ifl product key and will not speak. every purchase of image for windows also comes with licenses for image for dos and image for linux. I have tried making their boot disks for dos but could never get a screen reader going through autoexec.bat or anything. I am happy to help with this if you want. Hunt me up on twitter bmoore123 or skype brian.moore Brian. Contact me on skype: brian.moore follow me on twitter: http://www.twitter.com/bmoore123 On 22/12/2011 6:52 PM, Barry Toner wrote:
Hi folks,
i'm embarrassed to say but I've just gotten a virus that's taken out my Desktop Windows 7 machine down. Had all updates installed, and was running Eset Smart Security,
www.eset.com
I said on Twitter today that I noticed TCp/IP ping requests triggering my Firewall. I denied these access, then all of a sudden a mysterious setup.exe was trying to communicate witha remote computer. I denied this access as well then became concerned. So i then ran an in-depth scan of the local disk. It found two viruses, but could not clean them. I then rebooted my computer and it gets to the User Account log-in screen, freezes half-way throughthe startup chime, then reboots. This then just loops.
Thankfully I have the machine imaged from about 2 months back, all media etc is on external drives and documents are backed up on external drives and Dropbox. It's more about getting a working system back up and running now as I had servers configured etc on this Windows install. I have two images on external drives that I created using Image For Windows by Terabyte, but how do I restore these without sighted help? And even then with sighted help if it becomes necessary?
Is there a boot disk for Image For Windows so I can get in and select the image files to restore, and if so how to I get this? i still have my seriel etc in a file on DropboxI need as close to step by step as you can manage. i will then take this information, collate it and create a document ont he blindsys admins web site. As we really need to have this sortive of thing documented. ,smiles> for Image For Windows.
Regards, Barry. _______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins
_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins __________ Information from ESET Smart Security, version of virus signature database 6738 (20111223) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 6782 (20120110) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 6782 (20120110) __________ The message was checked by ESET Smart Security. http://www.eset.com _______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins
Very interesting, can anyone do a short podcast on using this method. -----Original Message----- From: blind-sysadmins-bounces@lists.hodgsonfamily.org [mailto:blind-sysadmins-bounces@lists.hodgsonfamily.org] On Behalf Of Barry Toner Sent: Tuesday, January 10, 2012 10:17 AM To: Blind sysadmins list Subject: Re: [Blind-sysadmins] Windows 7/Image For Windows/Viruses Hi Brian, I'm going through lots of mails now and just seen this. Thank you for the below and I'll catch ya offlist. This looks great and will be nice to have contact with someone who's successfully restored without eyes. BTW. I've also got myself a copy of GRML which while backup was the motivation, seems it has other useful sys admin tools and built-in speech in the way of the Speakup screen reader. Regards, Barry. -----Original Message----- From: blind-sysadmins-bounces@lists.hodgsonfamily.org [mailto:blind-sysadmins-bounces@lists.hodgsonfamily.org] On Behalf Of Brian Moore Sent: Friday, December 23, 2011 4:56 AM To: Blind sysadmins list Subject: Re: [Blind-sysadmins] Windows 7/Image For Windows/Viruses right, it is almost midnight but I will have a go at this. I am presuming you have another computer. if not, you will need sighted help I think. if you don't already have it, get the image for linux iso from the terrabyte unlimited web site. a trial will do but a real one works better. 2. burn this with the included makedisk program. While it is a standard iso and will burn with anything, the makedisk program is better since it will ask you for your image for linux key during the process so you won't have to deal with this when the cd boots on your infected computer. 3. perform whatever bios magic or hotkey you have to do to get the infected machine to boot from cd and boot from the ifl cd you just burned. by default, the cd will boot up and get an ip address from dhcp with a hostname of "ifl" when the cd stopps spinning, hit esc to get out of the menu which lets you run the program connect to samba shares etc since you can't read it anyway. 5. type sshd and press enter this will start the ssh server on the ifl cd which you can connect to from another machine. YOu can do this without ssh through a serial console as well but computers with serial ports are a lot less common and usb to serial converters are iffy for this type of stuff. log in as root with either no password or ifl as the password, can't remember. notes: if you burn the iso without using the make disk program, the first screen when the cd boots will ask you for your ifl product key and will not speak. every purchase of image for windows also comes with licenses for image for dos and image for linux. I have tried making their boot disks for dos but could never get a screen reader going through autoexec.bat or anything. I am happy to help with this if you want. Hunt me up on twitter bmoore123 or skype brian.moore Brian. Contact me on skype: brian.moore follow me on twitter: http://www.twitter.com/bmoore123 On 22/12/2011 6:52 PM, Barry Toner wrote:
Hi folks,
i'm embarrassed to say but I've just gotten a virus that's taken out my Desktop Windows 7 machine down. Had all updates installed, and was running Eset Smart Security,
www.eset.com
I said on Twitter today that I noticed TCp/IP ping requests triggering my Firewall. I denied these access, then all of a sudden a mysterious setup.exe was trying to communicate witha remote computer. I denied this access as well then became concerned. So i then ran an in-depth scan of the local disk. It found two viruses, but could not clean them. I then rebooted my computer and it gets to the User Account log-in screen, freezes half-way throughthe startup chime, then reboots. This then just loops.
Thankfully I have the machine imaged from about 2 months back, all media etc is on external drives and documents are backed up on external drives and Dropbox. It's more about getting a working system back up and running now as I had servers configured etc on this Windows install. I have two images on external drives that I created using Image For Windows by Terabyte, but how do I restore these without sighted help? And even then with sighted help if it becomes necessary?
Is there a boot disk for Image For Windows so I can get in and select the image files to restore, and if so how to I get this? i still have my seriel etc in a file on DropboxI need as close to step by step as you can manage. i will then take this information, collate it and create a document ont he blindsys admins web site. As we really need to have this sortive of thing documented. ,smiles> for Image For Windows.
Regards, Barry. _______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins
_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins __________ Information from ESET Smart Security, version of virus signature database 6738 (20111223) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 6782 (20120110) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 6782 (20120110) __________ The message was checked by ESET Smart Security. http://www.eset.com _______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins
participants (3)
-
Barry Toner -
Brian Moore -
Frank Ventura