Member Avatar for jbennet

Well, i kinda left my cousin alone with my linux box when root was logged in (woops) and hes kinda a guru so he did something that causes the printer to print random crap when i move the mouse

i think he catted /dev/mouse to /dev/printer , how do i rectify this?

my speakers have similar odd things happening to them when i move the mouse too (buzzing and popping)

  • 3 Contributors
  • 3 Replies
  • 107 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by Toba

Dani AI

Generated

Short summary and practical recovery notes for (and anyone who finds this thread later):

If raw input from an input device is being sent to a printer or sound device the symptoms you described (garbled printouts and speaker noise when moving the mouse) come from a process streaming the input device into another device node. If you can still get a shell elsewhere, stop the offending process; if not, boot a live/rescue environment and mount the root filesystem read/write so you can investigate.

From a rescue shell, locate processes that have the printer or audio device open by using lsof or fuser against /dev/lp* and /dev/snd/* and terminate them. Check /dev entries with ls -l or stat to confirm they are character device nodes (correct major/minor numbers) and not regular files, FIFOs or symlinks. If device nodes were replaced, either recreate them properly or trigger udev to rebuild them; incorrect nodes can allow data streams to be written persistently at boot.

The PAM login failure indicates authentication files or modules may have been altered. Inspect /etc/pam.d/ and confirm the PAM modules under /lib/security (or your distro equivalent) exist. Verify ownership/permissions on /etc/shadow and /etc/passwd (shadow is normally owned by root:shadow and only readable by root). Check authentication logs (/var/log/auth.log or /var/log/secure) to see which PAM module is failing. If files are missing or corrupted, reinstall the PAM package from your distribution using a chroot from the rescue environment or restore from backups.

Before reinstalling the system, back up /home and any configs, look for unexpected cron jobs, init scripts or setuid binaries placed by the prank, and remove them. As suggested, stopping the active process usually stops the symptoms; and as warned, avoid leaving an unlocked root shell — use sudo and lock your console to prevent repeat incidents.

Recommended Answers

All 3 Replies

Member Avatar for John A

Sounds like you've got quite the cousin there...

All you should have to do is run ps -ax , possibly piping it to more , and then looking for any processes that say "cat ...". Once you've found out the process numbers, simply terminate them with kill .

Of course, it makes it 10 times harder if he added this to your startup scripts, in which case you'll have to check them... (look in /home/you/.bash_profile or something similar for local scripts)

Member Avatar for jbennet

i think he scripted it :(

also it seems he changed did something else. i rebooted my machine and now when i try to login as any user it says PAM ERROR; ACCESS DENIED

im gonna reinstall (/home is on a sperate partition so i wont lose my docs)

grrrrrrrrrrrr (im gonna get my payback by deleting his hand-crafted LFS system hahahha)

Member Avatar for Toba

This is why I never let anyone else use my login. I have a root shell open frequently.... and who knows what could go wrong.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.