Re: Need Advice on Spyware Removal for Debian

Top Page
Attachments:
Message as email
+ (text/plain)
Delete this message
Reply to this message
Author: JD Austin
Date:  
To: plug-discuss
Subject: Re: Need Advice on Spyware Removal for Debian
Kevin wrote:

>On Tue, 2004-11-30 at 09:17, Mark Phillips wrote:
>
>
>>mark@latitude610:~$ cat /etc/hosts
>>
>>
>
>Looks good.
>
>
>
>>mark@latitude610:~$ cat /etc/resolv.conf
>>
>>
>
>Looks good.
>
>
>
>>I will check the sites that cause the problem.....I have to wait for it
>>to happen!
>>
>>
>
>Whoa. Maybe I missed this in your initial post, but I thought this was
>happening consistently. If it comes and goes, that might indicate
>upstream DNS poisoning. If/when you see it again, try changing the
>nameservers in /etc/resolv.conf to something off the Cox network. Just
>a thought.
>
>...Kevin
>
>---------------------------------------------------
>PLUG-discuss mailing list -
>To subscribe, unsubscribe, or to change you mail settings:
>http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
>


I've never encountered spyware or viruses that affect Linux at all.
This could be a dns injection issue where cox's name server has been
compromised.
There used to be exploit's in bind that would allow people to change the
memory cached dns records.
Since you're running Linux you could always run your own dns server.
Back when I had @home I switched to my own dns server and it made a huge
difference (@home's dns was really slow).

JD


--
JD Austin
Twin Geckos Technology Services LLC
email:
http://www.twingeckos.com
phone/fax: 480.344.2640

---------------------------------------------------
PLUG-discuss mailing list -
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss