Andy Paton's most Technical Adventure

Install of Gentoo AMD64 on a Sun Java Workstation W1100z http://uk.sunsolve.sun.com/handbook_pub/Systems/W1100z/W1100z.html Install of Gentoo 2004.2 AMD64 Universal CDROM, with a stage 3 install and KDE. Due to time limits I was unable to a Stage 1 or test audio and NVIDIA drivers. Boot from Live CD Gentoo 2004.2 AMD64. livecd root # lspci 0000:00:06.0 PCI bridge: Advanced Micro Devices [AMD] AMD-8111 PCI (rev 07) 0000:00:07.0 ISA bridge: Advanced Micro Devices [AMD] AMD-8111 LPC (rev 05) 0000:00:07.1 IDE interface: Advanced Micro Devices [AMD] AMD-8111 IDE (rev 03) 0000:00:07.2 SMBus: Advanced Micro Devices [AMD] AMD-8111 SMBus 2.0 (rev 02) 0000:00:07.3 Bridge: Advanced Micro Devices [AMD] AMD-8111 ACPI (rev 05) 0000:00:07.5 Multimedia audio controller: Advanced Micro Devices [AMD] AMD-8111 AC97 Audio (rev 03) 0000:00:0a.0 PCI bridge: Advanced Micro Devices [AMD] AMD-8131 PCI-X Bridge (rev 12) 0000:00:0a.1 PIC: Advanced Micro Devices [AMD] AMD-8131 PCI-X APIC (rev 01) 0000:00:

Sunday 2nd October, just surfed the web and closed down Firefox, and noticed that my network activity lights are still going. Now, I'm paranoid when it comes to my computer. Sygate firewall is installed on the W2K box, so checked its logs and c:\winnt\system32\drives\npt.sys was sending constant requests to the network (port 53 DNS). npt.sys was described as “NPF Driver – Time Extensions”, I doubled checking with Google, npt.sys looked a valid W2K program. Out comes Ethereal network sniffer, simultaneously I logging into my IPCOP firewall and run tcpdump (filtering out ssh traffic). Both programs identify that my PC is sending out DNS requests for “urx.your-getting-rapped.co.uk”.(unresolvable) I do not like this and reboot, just in case it will go away on its own. It doesn't! I run free AVG AV, I download the latest virus definitions and scan the windows directory. No virus found! The DNS requests are happening every second, so I decide to shut down all non-essent