Possible virus in Ubuntu boot? Help appreciated.

[theozzlives]

You know it's beyond me why people ask for help, then don't do as advised. If you have a Linux expert, have him fix it.

[ZehnTech]

First off, Ozzlives, there's no need to be rude. If you don't have anything worth saying, don't waste my time. Second, I wasn't asking for obvious solutions, I was introducing a problem to see if anyone else had encountered it and what the problem might be. Go be a troll elsewhere.

pbulteel,

Thanks for a helpful, productive answer that engages my problem. Three of the four computers shut down within minutes of each other if not simultaneously. The other was off already.

We discovered one solution that can fix the problem if anyone else encounters it, Juntu can be used to delete the old system restore files. One of our windows 7 machines has been operating normally since system restore was turned off and the old restore files manually deleted.

[theozzlives]

I've been silent up to now because you were given sound advise. Advise that you ignored. If you and your Linux expert can fix it, let us help people that need help. I'm glad you got most of your boxes up and running.

[rookcifer]

So, let me get it straight, the OP is alleging that some virus entered his network and wiped out all of his Windows *and* Linux boxes simultaneously. Sorry, but I am skeptical that a virus would work on both platforms at once. There must be another explanation, but not enough info was given to make any determination as to what really is going on.

[jrusso2]

So, an update. We went into my computer with a juntu recovery CD. The startup file contained only an exit line, somehow. We rewrote the file, the linux machine booted up but my desktop file is gone.

The windows machines still only run in safemode. No antivirus I've run can find anything. Tried mbam, avast, spybot even.

The problems still occured when disconnected from the network. This is pretty f*ed. Haha.

Backed up my pertinent data and am reinstalling Jaunty now. I'll let you know if it happens again.

Probably not a virus but some kind of Trojan. I can see how this could erase stuff in /home but wondering how it got to the boot up files.

Its an interesting case. One of the more interesting ones I have seen here. Maybe you should check the logs and see if there is a clue in there.

[phillw]

There area couple of CRITICAL flaws in Microsoft O/S (They call them CRITICAL) - A drive by could quite easily have nuked all the windows machines. It looks quite grim.

http://www.microsoft.com/technet/sec.../ms09-sep.mspx

But, said beastie should have zero effect on a secure (i.e. not running as a server, so not listening for incomming connections) machine.
I hadn't realised things were quite that bad, but the windows ones do, indeed, look pretty darn serious.
The only thing I can think of is if the linux box was connected to a compromised system and thus the attacker could easily tunnel over onto the Linux box.

Just my tuppance worth.

Do report back what you find, it's of interest to me and should be to others - people do run linux/windows systems.

Hope you sort out your headache soon.

Regards,

Phill.

[The Cog]

I agree with phillw - I can't add anything useful, but I'm very interested to hear more as you discover it.

[sasho_zl]

4 machines shutting down in minutes of each other and running different OS?! Dude, check your electricity...

[bobince]

+1 on the power suggestion. A hard power-down can certainly result in corrupted files causing a failure to boot on Windows. The chances of a 'virus' doing this simultaneously to machines running different OSs seems minimal.

[some-what-Gnu-2-networks]

Did the Ubuntu computer have Wine installed? It appears that this was a mainly Windows network making it seem likely that Wine was installed.