[ug-bosug] Windows Virus copied on a Solaris machine....

Tue Nov 27 11:22:28 PST 2007

Dear Anil Gulecha,

I tried the 'mount' command, first WITHOUT the pen drive inserted and
then twice again with the pen drive in the USB port. The following is
the output and I don't see the rmdisk.

$ su
Password:

WITHOUT THE PENDRIVE ON THE USB PORT
turiya# mount
/ on /dev/dsk/c1d0s0
read/write/setuid/devices/intr/largefiles/logging/xattr/one
rror=panic/dev=1980000 on Tue Nov 27 19:43:14 2007
/devices on /devices read/write/setuid/devices/dev=4380000 on Tue Nov
27 19:43:0 1 2007
/system/contract on ctfs read/write/setuid/devices/dev=43c0001 on Tue
Nov 27 19: 43:01 2007
/proc on proc read/write/setuid/devices/dev=4400000 on Tue Nov 27 19:43:01 2007
/etc/mnttab on mnttab read/write/setuid/devices/dev=4440001 on Tue Nov
27 19:43: 01 2007
/etc/svc/volatile on swap read/write/setuid/devices/xattr/dev=4480001
on Tue Nov  27 19:43:01 2007
/system/object on objfs read/write/setuid/devices/dev=44c0001 on Tue
Nov 27 19:4 3:01 2007
/lib/libc.so.1 on /usr/lib/libc/libc_hwcap2.so.1
read/write/setuid/devices/dev=1 980000 on Tue Nov 27 19:43:12 2007
/dev/fd on fd read/write/setuid/devices/dev=4680001 on Tue Nov 27 19:43:14 2007
/tmp on swap read/write/setuid/devices/xattr/dev=4480002 on Tue Nov 27
19:43:16 2007
/var/run on swap read/write/setuid/devices/xattr/dev=4480003 on Tue
Nov 27 19:43 :16 2007
/oasis on oasis read/write/setuid/devices/exec/atime/dev=2d50002 on
Tue Nov 27 1 9:43:20 2007
/zmirror on zmirror read/write/setuid/devices/exec/atime/dev=2d50003
on Tue Nov 27 19:43:20 2007
/home/Sh on /export/home/Sh read/write/setuid/devices/dev=1980000 on
Tue Nov 27 19:50:43 2007

WITH THE PENDRIVE ON PORT
turiya# mount
/ on /dev/dsk/c1d0s0
read/write/setuid/devices/intr/largefiles/logging/xattr/onerror=panic/dev=1980000
on Tue Nov 27 19:43:14 2007
/devices on /devices read/write/setuid/devices/dev=4380000 on Tue Nov
27 19:43:01 2007
/system/contract on ctfs read/write/setuid/devices/dev=43c0001 on Tue
Nov 27 19:43:01 2007
/proc on proc read/write/setuid/devices/dev=4400000 on Tue Nov 27 19:43:01 2007
/etc/mnttab on mnttab read/write/setuid/devices/dev=4440001 on Tue Nov
27 19:43:01 2007
/etc/svc/volatile on swap read/write/setuid/devices/xattr/dev=4480001
on Tue Nov 27 19:43:01 2007
/system/object on objfs read/write/setuid/devices/dev=44c0001 on Tue
Nov 27 19:43:01 2007
/lib/libc.so.1 on /usr/lib/libc/libc_hwcap2.so.1
read/write/setuid/devices/dev=1980000 on Tue Nov 27 19:43:12 2007
/dev/fd on fd read/write/setuid/devices/dev=4680001 on Tue Nov 27 19:43:14 2007
/tmp on swap read/write/setuid/devices/xattr/dev=4480002 on Tue Nov 27
19:43:16 2007
/var/run on swap read/write/setuid/devices/xattr/dev=4480003 on Tue
Nov 27 19:43:16 2007
/oasis on oasis read/write/setuid/devices/exec/atime/dev=2d50002 on
Tue Nov 27 19:43:20 2007
/zmirror on zmirror read/write/setuid/devices/exec/atime/dev=2d50003
on Tue Nov 27 19:43:20 2007
/home/Sh on /export/home/Sh read/write/setuid/devices/dev=1980000 on
Tue Nov 27 19:50:43 2007

WITH THE PENDRIVE ON PORT
turiya# mount
/ on /dev/dsk/c1d0s0
read/write/setuid/devices/intr/largefiles/logging/xattr/onerror=panic/dev=1980000
on Tue Nov 27 19:43:14 2007
/devices on /devices read/write/setuid/devices/dev=4380000 on Tue Nov
27 19:43:01 2007
/system/contract on ctfs read/write/setuid/devices/dev=43c0001 on Tue
Nov 27 19:43:01 2007
/proc on proc read/write/setuid/devices/dev=4400000 on Tue Nov 27 19:43:01 2007
/etc/mnttab on mnttab read/write/setuid/devices/dev=4440001 on Tue Nov
27 19:43:01 2007
/etc/svc/volatile on swap read/write/setuid/devices/xattr/dev=4480001
on Tue Nov 27 19:43:01 2007
/system/object on objfs read/write/setuid/devices/dev=44c0001 on Tue
Nov 27 19:43:01 2007
/lib/libc.so.1 on /usr/lib/libc/libc_hwcap2.so.1
read/write/setuid/devices/dev=1980000 on Tue Nov 27 19:43:12 2007
/dev/fd on fd read/write/setuid/devices/dev=4680001 on Tue Nov 27 19:43:14 2007
/tmp on swap read/write/setuid/devices/xattr/dev=4480002 on Tue Nov 27
19:43:16 2007
/var/run on swap read/write/setuid/devices/xattr/dev=4480003 on Tue
Nov 27 19:43:16 2007
/oasis on oasis read/write/setuid/devices/exec/atime/dev=2d50002 on
Tue Nov 27 19:43:20 2007
/zmirror on zmirror read/write/setuid/devices/exec/atime/dev=2d50003
on Tue Nov 27 19:43:20 2007
/home/Sh on /export/home/Sh read/write/setuid/devices/dev=1980000 on
Tue Nov 27 19:50:43 2007
turiya#

On 11/28/07, Sivasubramanian Muthusamy <isolatedn at gmail.com> wrote:
> Dear Anil Gulecha,
>
> I tried the 'mount' command, first WITHOUT
>
> On 11/27/07, Anil Gulecha <anil.verve at gmail.com> wrote:
> > On 11/27/07, Sivasubramanian Muthusamy <isolatedn at gmail.com> wrote:
> > > Dear Anil Culecha,
> > >
> > > I am trying to mount the USB on the machine with Solaris 10 11/06,
> > > where the USB is mounted on /rmdisk.  If it will help using the mount
> > > command can you please type out the exact command, word by word, and
> > > instruct me as to how this problem can be overcome?
> > >
> >
> > The USB is usually automounted.
> >
> > To test the command... open a terminal (right click on desktop.. open terminal)
> >
> > type 'su' and enter
> > enter root password and enter.
> > You will now get a '#' prompt..
> > Do the above only if you're not already logged in as root
> >
> > Now type 'mount' & enter... look at the o/p
> > Plug in the USB and wait for a few seconds
> > Type 'mount' and enter again.. do you see a new entry in the output
> >
> > Anil
> >
>
>
> --
> Sivasubramanian Muthusamy
> CEO
> Isolated Networks
> Whitefield, 389/1 Perundurai Road
> Erode 638 011
> Tamilnadu India
> http://www.isolatednetworks.com
> email: isolatedn at gmail.com
> ++91 424 4030334
> Mobile Phone number +91 99524 03099
> ++91 424 4030334
>
> DISCLAIMER:
>
> This message (including attachment if any) from Isolated Networks is
> confidential and may be privileged. If you have received this message
> by mistake please notify the sender by return e-mail and delete this
> message from your system. Any unauthorized use, disclosure or
> dissemination of this message in whole or in part is strictly
> prohibited.
>

-- 
Sivasubramanian Muthusamy
CEO
Isolated Networks
Whitefield, 389/1 Perundurai Road
Erode 638 011
Tamilnadu India
http://www.isolatednetworks.com
email: isolatedn at gmail.com
++91 424 4030334
Mobile Phone number +91 99524 03099
++91 424 4030334

DISCLAIMER:

This message (including attachment if any) from Isolated Networks is
confidential and may be privileged. If you have received this message
by mistake please notify the sender by return e-mail and delete this
message from your system. Any unauthorized use, disclosure or
dissemination of this message in whole or in part is strictly
prohibited.