ftp'ing .doc files from drive c

[jselman]

ok, got a situation here. wife has a laptop running XP and apparently she has the sasser virus.

I changed the boot order on her laptop and booted under Knoppix.

is there a way I can see the MS Word docs, etc she has on drive c? Mainly wanting to ftp these files off the drive then wipe the drive clean.

any sugguestions would be appreciated.

thanks,
jim

[Markus]

They should be somewhere under /mnt/hda1 , as in:
mount /mnt/hda1
cd /mnt/hda1/Doc<tab>/user_name/My<tab>

You could also try to just disinfect it: http://www.f-secure.com/v-descs/sasser_b.shtml

[jselman]

thanks for the info...been awhile since I went to linux command line and forgot the mount command...

egads once I mounted/cd, the /windows directory is gone.

it may be time just to punt and wipe this drive.

[Markus]

egads once I mounted/cd, the /windows directory is gone.

How do you mean gone? Gone as in deleted by a virus or just hidden? Does XP actually use windows or winnt for the directory?

If you need help with mounting and fstab check out: http://www.tuxfiles.org/linuxhelp/dirs.html or ask away.

[CrashedAgain]

They should be somewhere under /mnt/hda1 , as in:
mount /mnt/hda1
cd /mnt/hda1/Doc<tab>/user_name/My<tab>

You could also try to just disinfect it: http://www.f-secure.com/v-descs/sasser_b.shtml

shouldn't that be

mount /dev/hda1

Isn't there a "hda1" icon on the Knoppix desktop? If you click on it , Konqueror should open showing hda1 root directory. I will default mount read only, which is OK, you don't want to write to it anyway.

Here's another thought...(thinking can be a dangerous thing!). Perhaps you can use cfdisk to make a partition on the laptop HD, move all the files you want to keep into it, the repair or reformat the win O/S.
When you do get it back up running, you really should partition the HD into at least 2 partitions & keep your data separate from the O/S to make life easier "for the next time".