How do I create a LiveHD?

[Semi-Hex]

My flash drive is infected, so Unetbootin is out, maybe cd's also which i've created in the past, something that creates a partition onto devices.
Whatever it is it chokes my bandwidth and mangles my downloads, Linux, Windows, LiveCD, doesn't matter.
To create a clean environment for myself I wiped the HD and would like to create a clean Linux Mint CD.
I'm using a manufacturer (Linux Mag) Backtrack 4 which should be clean.
I partitioned, as 1 large partition, and formatted the HD to ext3, DL'd the Linux Mint 10 KDE 64bit to the HD.
Now i need to burn, I think, and then install.
From the position I'm in, I thought of LiveHD
I don't want to DL the .iso again it took me 5 hours on the final attempt, 3 other attempts mangled by the infector.

Or would it be easier to use gparted on BT4 to resize and create a new partition and install BT4 temporarily until I burn the Mint disc?
Where can I find the other checksums for your .iso since md5 is fakable? Is that likely?

[JasonLG]

My flash drive is infected, so Unetbootin is out, maybe cd's also which i've created in the past, something that creates a partition onto devices.
Whatever it is it chokes my bandwidth and mangles my downloads, Linux, Windows, LiveCD, doesn't matter.
To create a clean environment for myself I wiped the HD and would like to create a clean Linux Mint CD.
I'm using a manufacturer (Linux Mag) Backtrack 4 which should be clean.
I partitioned, as 1 large partition, and formatted the HD to ext3, DL'd the Linux Mint 10 KDE 64bit to the HD.
Now i need to burn, I think, and then install.
From the position I'm in, I thought of LiveHD
I don't want to DL the .iso again it took me 5 hours on the final attempt, 3 other attempts mangled by the infector.

Or would it be easier to use gparted on BT4 to resize and create a new partition and install BT4 temporarily until I burn the Mint disc?
Where can I find the other checksums for your .iso since md5 is fakable? Is that likely?

1. If your USB drive is infected with a virus, format it in a Live environment, problem solved. A Windows virus has no effect on a Linux system and will be erased just like all the rest of the data during a reformat.

2. I highly doubt that the virus in question is going to inject it's self into a live Linux CD, an environment where it is pretty much inert and useless and then spoof the md5. If you've found a virus that can do that and then effect a Linux system it's pretty amazing and I'm sure that a few people will want to study it. My guess is that it's of the Windows variety and is harmless to a Linux system.

3. Refer to this article on Linux malware. http://en.wikipedia.org/wiki/Linux_malware Coming from I Windows I understand you paranoia but you have pretty much nothing to fear as far as malware in Linux.

4. You said that you have downloaded a LiveCD/DVD that's md5 checks out. If you want a good running system where you don't have to worry about viruses then install it and forget about Windows.

[Semi-Hex]

1. If your USB drive is infected with a virus, format it in a Live environment, problem solved.

When booting from the device the infection is copied to RAM, HD

A Windows virus has no effect on a Linux system and will be erased just like all the rest of the data during a reformat.

The infector doesn't care what OS you are running, it still infects bootable devices and runs in RAM.

2. I highly doubt that the virus in question is going to inject it's self into a live Linux CD, an environment where it is pretty much inert and useless and then spoof the md5. If you've found a virus that can do that and then effect a Linux system it's pretty amazing and I'm sure that a few people will want to study it.

Your right it can't alter a clean CD, but injecting into RAM it can infect any writable bootable device including CD's or DVD's you burn.
Since you can reverse a malware sample using Einsteins spooky action at a distance, just to verify you have these skills, can you tell me the size of my compressed sample and the size of the uncompressed sample in sectors prefferred?

My guess is that it's of the Windows variety and is harmless to a Linux system.

You should be careful insulting the intelligence of malware authors, they may become offended. Furthermore, stay away from casino's, guessing will cost you a lot of money.

3. Refer to this article on Linux malware. http://en.wikipedia.org/wiki/Linux_malware Coming from I Windows I understand you paranoia but you have pretty much nothing to fear as far as malware in Linux.

Myths and legends keep the unaware ignorant.

4. You said that you have downloaded a LiveCD/DVD that's md5 checks out. If you want a good running system where you don't have to worry about viruses then install it and forget about Windows.

Finally back to my original issue. A known clean BT4 is running in the only CD drive and the Linux Mint .iso is residing on the HDD. The usb flash drive is infected, so I would like to deal with that at another time, after I create a clean chain.

I hope I haven't excessively insulted your intelligence that you may refuse to continue being helpful.

[SimonTS]

I will start by saying that I'm not convinced this isn't simply a wind-up. This "Infector" of yours sounds like nothing I have ever heard of, but I will write this as if it is real;-

If it is as virulent as you state then you will have to destroy your existing USB stick as you won't be able to clean it without risking re-infection.
The same probably goes for your burned CDs, but there are live images out there which contain virus checkers / cleaners, so you may be able to work-around with one of them.
You can install BT4 to your hard-drive. It's not easy, but it can be done. If you want to them follow the guide below;-
http://www.itsolutionskb.com/2009/04/ho ... tep-guide/

[JasonLG]

1. I didn't say boot off the USB. I said boot off a Live CD/DVD a wipe the drive from there.

2. The virus in question most defiantly does cares what OS it's running on.

3. Einsteins spooky action? What are you talking about? English is obviously not you native language because that question was pure gibberish.

4. It's not because malware authors haven't been insulted enough that there are no real viable viruses in the wild that effect Linux it's because A. Linux is more secure then Windows and B. Most viruses are written to make money(keyloggers and botnets) and with 1-5% of the desktop market (depending on who you believe) it's just not worth the effort.

I don't know how much simpler I can put it so I'll do my best to explain it like I was talking to a child. Here is step by step on what you should do.

1. Boot from the BT4 disc.

2. Wipe the USB drive in BT4.

3. Scan the Mint .iso in BT4.

4. Then once you verify that the Mint .iso is clean make a Live system on the USB with the the Mint .iso.

5. Reboot and install Mint to your hard drive from the USB.

Although I'm pretty sure you're not going to follow my advice because my guess is that there is no infected system and you're a troll just trying to pick a fight.

[Semi-Hex]

I will start by saying that I'm not convinced this isn't simply a wind-up.

I don't understand the couched meaning behind "wind-up".

This "Infector" of yours sounds like nothing I have ever heard of, but I will write this as if it is real;-

The infected bootable devices can't be viewed with a disk hex editor, at least the ones I've used, and their aren't many for linux. But Thanks for placating my delusions.

If it is as virulent as you state then you will have to destroy your existing USB stick as you won't be able to clean it without risking re-infection.
The same probably goes for your burned CDs, but there are live images out there which contain virus checkers / cleaners, so you may be able to work-around with one of them.

I have a stack of CD's and DVD's burned of backups and now it is all suspect, sigh.
It is pretty virulent and it does not depend on users OS in order to infect. Once loaded into RAM it takes control of the network. It's uncompressed size is just over 2 megabytes (5000+ sectors) residing in it's own partition on the HDD. On the USB stick, it takes up less space in it's own partition, slightly more than 1 megabyte. For the USB to infect the HDD the HDD must be mounted rw, and chown by the current user. It doesn't appear to create an MBR to run, as far as I can tell. It may be considered a worm from the behavior I describe, exception for the stealth rootkit stuff once in RAM.
The only thing I am worried about regarding the flash stick, I saw some code on a blog that writes data to bad sectors which can't be seen by the OS. Since the Flash stick handles bad sectors autonomously I can't say if they can be used to execute anything, just a thought though.
[

You can install BT4 to your hard-drive. It's not easy, but it can be done. If you want to them follow the guide below;-
http://www.itsolutionskb.com/2009/04/ho ... tep-guide/

Installing BT4 looks like the simpler solution. I'm using gparted to alter the partition structures as I post this, I just hope the data I have already downloaded to extricate myself out of the loop remains viable when it's done.

[Semi-Hex]

[quote=JasonLG]1. I didn't say boot off the USB. I said boot off a Live CD/DVD a wipe the drive from there.[/quote]
So, DD'n the flash drive should be enough to destroy it's presence on the flash drive while BT4 is running? I'll have to disconnect the HDD when I initiate that procedure.

[quote=JasonLG]2. The virus in question most defiantly does cares what OS it's running on.[/quote]
I've been playing with Linux for a few years now and this wizzes on Linux as equally as Windows. Maybe it just doesn't care about MAC's, LOL, they cost too much for me to check.

[quote=JasonLG]3. Einsteins spooky action? What are you talking about?[/quote]
Two particles over a distance resonate identical behavior. (Ex. Striking particle A causes particle B to react as if struck.) What I had in mind, a single particle existing in two locations at the same time. I've been watching too much Michio Kaku on the science Channel.

[quote=JasonLG]4. It's not because malware authors haven't been insulted enough that there are no real viable viruses in the wild that effect Linux it's because A. Linux is more secure then Windows and B. Most viruses are written to make money(keyloggers and botnets) and with 1-5% of the desktop market (depending on who you believe) it's just not worth the effort.[/quote]
My point was that your intelligence and mine may be limited, but someone else's may not be.

[quote=JasonLG]I don't know how much simpler I can put it so I'll do my best to explain it like I was talking to a child. Here is step by step on what you should do.

1. Boot from the BT4 disc.

2. Wipe the USB drive in BT4.

3. Scan the Mint .iso in BT4.

4. Then once you verify that the Mint .iso is clean make a Live system on the USB.

5. Reboot and install Mint to your hard drive from the USB.

Although I'm pretty sure you're not going to follow my advice because my guess is that there is no infected system and you're a troll just trying to pick a fight.[/quote]
Since you dote on me I have no choice but to feel loved.
It was simpler than I thought,
Thank you.

[JasonLG]

Let me start by saying that I think you're full of it when it comes to your alleged malware infection and your self-asserted computer experience/skills. What you describe is a highly suspect and unlikely situation. That tell me that it didn't happen. And the fact that the very simple solution to the alleged infection escaped you tells me that your not as computer savoy as you let on.

1. Yes, zeroing the drive destroys all data.(which would include the virus)

2. Regardless zeroing the drives will get rid of it.

3. Not sure what quantum entanglement has to do with anything.

4. It would be a lot of work for little reward.

[Semi-Hex]

Let me start by saying that I think you're full of it when it comes to your alleged malware infection and your self-asserted computer experience/skills. What you describe is a highly suspect and unlikely situation. That tell me that it didn't happen. And the fact that the very simple solution to the alleged infection escaped you tells me that your not as computer savoy as you let on.

1. Yes, zeroing the drive destroys all data.(which would include the virus)

2. Regardless zeroing the drives will get rid of it.

3. Not sure what quantum entanglement has to do with anything.

Before zeroing the drive I should probably backup the infected partition so an analysis can be done to verify my claims.
Something like dd if=/dev/sda* of=~/disk1.img
Might be better if I were to create an image of the entire USB (2GB).

4. It would be a lot of work for little reward.

I don't know how you can determine what is of value for malware authors and crackers, maybe you assume too much.
Can we determine it's possible benefit based on my explanation of what I believe are the malware's features, of course.
A. What value is there for a malware that resides in it's own partition?
B. What value would there be for malware to use a unique x86 compatible file system?
C. What value is there in a malware that is crossplatform ready?
D. What value is there for a malware that can make copies of itself and write them to all bootable media?

The question you have, but haven't asked, that makes this possible malware seem implausible:
How does it load into RAM at boot time if it doesn't exist in a boot partition?
If this malware can do this, then it would be pretty amazing, for sure.

[JasonLG]

Let me start by saying that I think you're full of it when it comes to your alleged malware infection and your self-asserted computer experience/skills. What you describe is a highly suspect and unlikely situation. That tell me that it didn't happen. And the fact that the very simple solution to the alleged infection escaped you tells me that your not as computer savoy as you let on.

1. Yes, zeroing the drive destroys all data.(which would include the virus)

2. Regardless zeroing the drives will get rid of it.

3. Not sure what quantum entanglement has to do with anything.

Before zeroing the drive I should probably backup the infected partition so an analysis can be done to verify my claims.
Something like dd if=/dev/sda* of=~/disk1.img
Might be better if I were to create an image of the entire USB (2GB).

4. It would be a lot of work for little reward.

I don't know how you can determine what is of value for malware authors and crackers, maybe you assume too much.
Can we determine it's possible benefit based on my explanation of what I believe are the malware's features, of course.
A. What value is there for a malware that resides in it's own partition?
B. What value would there be for malware to use a unique x86 compatible file system?
C. What value is there in a malware that is crossplatform ready?
D. What value is there for a malware that can make copies of itself and write them to all bootable media?

The question you have, but haven't asked, that makes this possible malware seem implausible:
How does it load into RAM at boot time if it doesn't exist in a boot partition?
If this malware can do this, then it would be pretty amazing, for sure.

You're full of cr@p. I'm done feeding the troll.

[Semi-Hex]

It appears to be an HPA partition, so the assumption I made:
[quote=Semi-Hex]B. What value would there be for malware to use a unique x86 compatible file system?[/quote]
Is incorrect at the present. Until I can see the 1's and 0's I would be over reaching.

It only loads the code into RAM at boot, which must be some function of the HPA design.
If it is an HPA then there aren't very many programs that can copy it.

[karashata]

Just in case it might be useful, here's some info about HPAs: http://www.thinkwiki.org/wiki/Hidden_Protected_Area

I can't say I've ever heard of a virus like this, if it really is a virus, it's somewhat surprising it's never been heard of since something like that should be nearly unstoppable...

[JasonLG]

Just in case it might be useful, here's some info about HPAs: http://www.thinkwiki.org/wiki/Hidden_Protected_Area

I can't say I've ever heard of a virus like this, if it really is a virus, it's somewhat surprising it's never been heard of since something like that should be nearly unstoppable...

Don't feed the troll. Semi-Hex is full of it.

A HPA is hidden by the bios and unaccessible by the OS. That's the point, to protect it from Malware. As you said if what he/she describes were true it would be a super-virus and pretty much unstoppable. A virus like that would have made the tech news. More evidence that he/she is lying.