oh shit my linux box has a rootkit!

[ivtec]

Re: oh shit my linux box has a rootkit!

every time i get some error on my ubuntu12.04 just get the cd or stick and reinstall again it's much easier than dealing with the problem that is on my end of thinking, i have my important stuff in an out extra hard drive and some times i download to it as important files come in and that's it,no worry about it.

[Agent24]

Re: oh shit my linux box has a rootkit!

The reallocated sector count remained at 0. When a sector is marked as "pending", and a write is performed on it, one of two things can happen:

a: The write fails, and the sector is remapped. The data is written to a spare sector, and the drive reports success. This causes the pending sector count to decrease, and the reallocated sector count to increase.

b: The write succeeds, and the sector is considered good. The pending sector count decreases, and the reallocated sector count does NOT increase. The data remains in the original sector.

I haven't yet come across a drive that did 'b' - perhaps as you said, it's the high areal density issue. Personally I wouldn't trust the drive after either case though.

But then of course, you can never trust any drive. Only thing to do is backup, and then backup again!

[goontron]

Re: oh shit my linux box has a rootkit!

Why would you make an image when it is infected? Get a new hard drive and install a fresh copy of Linux.

Also, I don't understand why wiping it would fix the 408 reallocated sectors.

its not infected its a bug see this link http://ubuntuforums.org/showthread.php?t=1680428 so i imaged it with the idea of agent24 but not with GNU ddrescue, with Kurt Garloff ddrescue. and i don't understand why wiping it would fix the sectors ether.
sorry for my poor spelling im typing on my phone.

[lti]

Re: oh shit my linux box has a rootkit!

Why would you make an image when it is infected? Get a new hard drive and install a fresh copy of Linux.

Also, I don't understand why wiping it would fix the 408 reallocated sectors.

[cheapie]

Re: oh shit my linux box has a rootkit!

well this looks like a common problem to me http://forums.seagate.com/t5/Desktop...162/m-p/187908 i would say im not alone and that this disk has 4% health left. i'll be lucky to image mint onto a new partition

...and that's why I don't like hard drives over 200GB.

[goontron]

Re: oh shit my linux box has a rootkit!

well this looks like a common problem to me http://forums.seagate.com/t5/Desktop...162/m-p/187908 i would say im not alone and that this disk has 4% health left. i'll be lucky to image mint onto a new partition

[cheapie]

Re: oh shit my linux box has a rootkit!

That's because the process of doing the zero fill causes the pending sectors to be remapped. If this is happening the drive is faulty.

The reallocated sector count remained at 0. When a sector is marked as "pending", and a write is performed on it, one of two things can happen:

a: The write fails, and the sector is remapped. The data is written to a spare sector, and the drive reports success. This causes the pending sector count to decrease, and the reallocated sector count to increase.

b: The write succeeds, and the sector is considered good. The pending sector count decreases, and the reallocated sector count does NOT increase. The data remains in the original sector.

[RJARRRPCGP]

Re: oh shit my linux box has a rootkit!

That's because the process of doing the zero fill causes the pending sectors to be remapped. If this is happening the drive is faulty.

I seen this happen before, even when I couldn't recall sectors being remapped.

[Agent24]

Re: oh shit my linux box has a rootkit!

I've actually had this happen about 4 times now. Wiping the disk fixed it each time. It typically shows up as a few pending sectors that can't be read, but writing new data works fine and can then be read. It seems to happen more often with drives that have higher aerial density, probably because of adjacent patterns interfering.

That's because the process of doing the zero fill causes the pending sectors to be remapped. If this is happening the drive is faulty.

[cheapie]

Re: oh shit my linux box has a rootkit!

It may be bit rot causing false HDD failure reports. To test this, you need to wipe the HDD with zeroes.

I've actually had this happen about 4 times now. Wiping the disk fixed it each time. It typically shows up as a few pending sectors that can't be read, but writing new data works fine and can then be read. It seems to happen more often with drives that have higher aerial density, probably because of adjacent patterns interfering.

[Mrx3750]

Re: oh shit my linux box has a rootkit!

It may be bit rot causing false HDD failure reports. To test this, you need to wipe the HDD with zeroes.

Thought this was a joke post, but amazingly enough, bit rot is a thing.

Still his HDD isn't that old. I doubt it's bit rot.

[RJARRRPCGP]

Re: oh shit my linux box has a rootkit!

It may be bit rot causing false HDD failure reports. To test this, you need to wipe the HDD with zeroes.

[Agent24]

Re: oh shit my linux box has a rootkit!

Use Gnu ddrescue to make an image\clone the drive

[Sparkey55]

Re: oh shit my linux box has a rootkit!

I would try Spinrite on it to recover data.

[Mrx3750]

Re: oh shit my linux box has a rootkit!

I'm going to recommend the freezer trick if you can't get your data off the drive. Basically stick it in the freezer for a couple hours, then quickly hook it up and get your data off it before the condensation appears. Some people say it doesn't work, other people say it does. I had it work for me, but my guess is it's a last ditch effort.

[goontron]

Re: oh shit my linux box has a rootkit!

^ thats happening right now but it locks up every 90mb

[Pentium4]

Re: oh shit my linux box has a rootkit!

Estimated. Is it backed up?

[goontron]

Re: oh shit my linux box has a rootkit!

well tests say only 2047h of life left on the drive

[shovenose]

Re: oh shit my linux box has a rootkit!

short answer: toss the hdd
long answer: http://en.wikipedia.org/wiki/Rkhunter

[goontron]

Re: oh shit my linux box has a rootkit!

sorry for double posing but my HDD is failing too.

smartctl 5.43 2012-06-30 r3573 [x86_64-linux-3.8.0-27-generic] (local build)
Copyright (C) 2002-12 by Bruce Allen, http://smartmontools.sourceforge.net

=== START OF INFORMATION SECTION ===
Model Family:   Seagate Barracuda (SATA 3Gb/s, 4K Sectors)
Device Model:   ST1000DM003-9YN162
Serial Number:  S1D4KTE5
LU WWN Device Id: 5 000c50 0523b2027
Firmware Version: CC9F
User Capacity:  1,000,204,886,016 bytes [1.00 TB]
Sector Sizes:   512 bytes logical, 4096 bytes physical
Device is:    In smartctl database [for details use: -P show]
ATA Version is:  8
ATA Standard is: ATA-8-ACS revision 4
Local Time is:  Wed Aug 14 23:38:34 2013 MDT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status: (0x82)	Offline data collection activity
					was completed without error.
					Auto Offline Data Collection: Enabled.
Self-test execution status:   ( 120)	The previous self-test completed having
					the read element of the test failed.
Total time to complete Offline 
data collection: 		( 584) seconds.
Offline data collection
capabilities: 			 (0x7b) SMART execute Offline immediate.
					Auto Offline data collection on/off support.
					Suspend Offline collection upon new
					command.
					Offline surface scan supported.
					Self-test supported.
					Conveyance Self-test supported.
					Selective Self-test supported.
SMART capabilities:      (0x0003)	Saves SMART data before entering
					power-saving mode.
					Supports SMART auto save timer.
Error logging capability:    (0x01)	Error logging supported.
					General Purpose Logging supported.
Short self-test routine 
recommended polling time: 	 (  1) minutes.
Extended self-test routine
recommended polling time: 	 ( 112) minutes.
Conveyance self-test routine
recommended polling time: 	 (  2) minutes.
SCT capabilities: 	    (0x3081)	SCT Status supported.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME     FLAG   VALUE WORST THRESH TYPE   UPDATED WHEN_FAILED RAW_VALUE
 1 Raw_Read_Error_Rate   0x000f  117  099  006  Pre-fail Always    -    124470440
 3 Spin_Up_Time      0x0003  097  097  000  Pre-fail Always    -    0
 4 Start_Stop_Count    0x0032  100  100  020  Old_age  Always    -    378
 5 Reallocated_Sector_Ct  0x0033  100  100  036  Pre-fail Always    -    408
 7 Seek_Error_Rate     0x000f  058  057  030  Pre-fail Always    -    73026188078
 9 Power_On_Hours     0x0032  098  098  000  Old_age  Always    -    2067
 10 Spin_Retry_Count    0x0013  100  100  097  Pre-fail Always    -    0
 12 Power_Cycle_Count    0x0032  100  100  020  Old_age  Always    -    365
183 Runtime_Bad_Block    0x0032  100  100  000  Old_age  Always    -    0
184 End-to-End_Error    0x0032  100  100  099  Old_age  Always    -    0
187 Reported_Uncorrect   0x0032  099  099  000  Old_age  Always    -    1
188 Command_Timeout     0x0032  100  098  000  Old_age  Always    -    8590065673
189 High_Fly_Writes     0x003a  100  100  000  Old_age  Always    -    0
190 Airflow_Temperature_Cel 0x0022  065  054  045  Old_age  Always    -    35 (Min/Max 31/41)
191 G-Sense_Error_Rate   0x0032  100  100  000  Old_age  Always    -    0
192 Power-Off_Retract_Count 0x0032  100  100  000  Old_age  Always    -    260
193 Load_Cycle_Count    0x0032  100  100  000  Old_age  Always    -    628
194 Temperature_Celsius   0x0022  035  046  000  Old_age  Always    -    35 (0 18 0 0 0)
197 Current_Pending_Sector 0x0012  100  100  000  Old_age  Always    -    8
198 Offline_Uncorrectable  0x0010  100  100  000  Old_age  Offline   -    8
199 UDMA_CRC_Error_Count  0x003e  200  200  000  Old_age  Always    -    0
240 Head_Flying_Hours    0x0000  100  253  000  Old_age  Offline   -    72889889982319
241 Total_LBAs_Written   0x0000  100  253  000  Old_age  Offline   -    1484676142505
242 Total_LBAs_Read     0x0000  100  253  000  Old_age  Offline   -    1190585618478

SMART Error Log Version: 1
No Errors Logged

SMART Self-test log structure revision number 1
Num Test_Description  Status         Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline    Completed: read failure    80%   2067     187881833
# 2 Short offline    Completed: read failure    50%   2066     187881833
# 3 Short offline    Completed: read failure    80%   2066     187881833

SMART Selective self-test log data structure revision number 1
 SPAN MIN_LBA MAX_LBA CURRENT_TEST_STATUS
  1    0    0 Not_testing
  2    0    0 Not_testing
  3    0    0 Not_testing
  4    0    0 Not_testing
  5    0    0 Not_testing
Selective self-test flags (0x0):
 After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.