Subject: Re: [netatalk-admins] Corruption of files on server

From: Mitch McNeel <[email-masked]>
Date: Fri, 11 Dec 1998 13:29:56 -0800

Forgot to attach the /var/adm/messages file...

messages:Dec  7 08:38:49 prometheus afpd[56]: afp_openfork:
ad_open: Resource temporarily unavailable
messages:Dec  7 08:44:16 prometheus afpd[104]: afp_alarm:
child timed out
messages:Dec  7 08:48:24 prometheus afpd[410]: afp_alarm:
child timed out
messages:Dec  7 08:56:04 prometheus afpd[283]: afp_alarm:
child timed out
messages:Dec  7 11:53:26 prometheus afpd[387]: afp_openfork:
ad_open: I/O error
messages:Dec  7 15:36:54 prometheus afpd[387]: afp_openfork:
ad_open: I/O error
messages:Dec  7 15:41:20 prometheus afpd[1421]:
afp_openfork: ad_open: Resource temporarily unavailable
messages:Dec  8 09:43:13 prometheus afpd[447]: afp_alarm:
child timed out
messages:Dec  8 11:05:42 prometheus afpd[6376]:
afp_openfork: ad_open: Resource temporarily unavailable
messages:Dec  8 11:05:57 prometheus afpd[6376]:
afp_openfork: ad_open: Resource temporarily unavailable
messages:Dec  8 11:33:39 prometheus afpd[7383]: afp_read:
ad_read: Invalid argument
messages:Dec  8 12:52:41 prometheus afpd[6759]: afp_read:
ad_read: Destination address required
messages:Dec  8 15:42:59 prometheus afpd[6760]: afp_alarm:
child timed out
messages:Dec  8 15:47:36 prometheus afpd[6727]:
afp_openfork: ad_open: I/O error
messages:Dec  8 16:24:51 prometheus afpd[8148]:
afp_openfork: ad_open: I/O error
messages:Dec  8 16:42:22 prometheus afpd[6727]:
afp_openfork: ad_open: I/O error
messages:Dec  8 17:16:42 prometheus afpd[8148]: afp_read:
ad_read: Invalid argument
messages:Dec  8 17:37:41 prometheus afpd[8557]: afp_alarm:
child timed out
messages:Dec  9 11:39:56 prometheus afpd[13353]: afp_alarm:
child timed out
messages:Dec  9 13:26:58 prometheus afpd[14319]: afp_alarm:
child timed out
messages:Dec  9 14:23:16 prometheus afpd[14443]: afp_alarm:
child timed out
messages:Dec  9 15:26:13 prometheus afpd[14663]: afp_alarm:
child timed out
messages:Dec 10 09:57:09 prometheus afpd[20518]:
afp_openfork: ad_open: I/O error
messages:Dec 10 13:40:25 prometheus afpd[20951]: afp_alarm:
child timed out
messages:Dec 10 14:53:33 prometheus afpd[20101]:
afp_openfork: ad_open: I/O error
messages:Dec 10 15:04:40 prometheus afpd[20101]:
afp_openfork: ad_open: I/O error
messages:Dec 10 15:32:49 prometheus afpd[21387]:
afp_openfork: ad_open: I/O error
messages:Dec 10 15:33:05 prometheus afpd[21387]:
afp_openfork: ad_open: Resource temporarily unavailable
messages:Dec 10 15:56:48 prometheus afpd[20101]:
afp_openfork: ad_open: I/O error
messages:Dec 10 16:48:48 prometheus afpd[20327]: afp_alarm:
child timed out
messages:Dec 11 09:23:19 prometheus afpd[26759]: afp_alarm:
child timed out
messages:Dec 11 10:25:29 prometheus afpd[26817]:
afp_openfork: ad_open: I/O error
messages:Dec 11 11:11:08 prometheus afpd[27352]: afp_alarm:
child timed out
messages:Dec 11 12:47:25 prometheus afpd[26970]: afp_alarm:
child timed out
messages.0:Nov 30 07:58:18 prometheus afpd[22939]:
afp_alarm: child timed out
messages.0:Nov 30 08:38:30 prometheus afpd[23269]:
afp_openfork: ad_open: I/O error
messages.0:Nov 30 10:11:07 prometheus afpd[23258]:
afp_openfork: ad_open: I/O error
messages.0:Nov 30 10:28:01 prometheus afpd[23118]:
afp_openfork: ad_open: I/O error
messages.0:Nov 30 10:58:33 prometheus afpd[23035]:
afp_openfork: ad_open: File exists
messages.0:Nov 30 12:16:20 prometheus afpd[23435]:
afp_openfork: ad_open: I/O error
messages.0:Nov 30 17:37:23 prometheus afpd[23353]:
afp_openfork: ad_open: I/O error
messages.0:Nov 30 18:00:21 prometheus afpd[23258]:
afp_alarm: child timed out
messages.0:Nov 30 18:00:36 prometheus afpd[23435]:
afp_alarm: child timed out
messages.0:Nov 30 18:00:56 prometheus afpd[23120]:
afp_alarm: child timed out
messages.0:Nov 30 18:01:01 prometheus afpd[23142]:
afp_alarm: child timed out
messages.0:Nov 30 18:01:36 prometheus afpd[23035]:
afp_alarm: child timed out
messages.0:Nov 30 18:01:56 prometheus afpd[9583]: afp_die:
asp_shutdown: Connection timed out
messages.0:Dec  1 08:43:29 prometheus afpd[28318]:
afp_openfork: ad_open: I/O error
messages.0:Dec  1 15:01:14 prometheus afpd[45]: afp_alarm:
child timed out
messages.0:Dec  1 15:30:15 prometheus afpd[204]: afp_alarm:
child timed out
messages.0:Dec  1 16:07:51 prometheus afpd[345]: afp_alarm:
child timed out
messages.0:Dec  1 16:22:46 prometheus afpd[394]: afp_alarm:
child timed out
messages.0:Dec  1 16:37:12 prometheus afpd[452]: afp_alarm:
child timed out
messages.0:Dec  2 08:48:58 prometheus afpd[5185]: afp_alarm:
child timed out
messages.0:Dec  2 09:23:33 prometheus afpd[5421]:
afp_openfork: ad_open: I/O error
messages.0:Dec  2 09:31:59 prometheus afpd[5165]:
afp_openfork: ad_open: I/O error
messages.0:Dec  2 09:34:05 prometheus afpd[5165]:
afp_openfork: ad_open: I/O error
messages.0:Dec  2 10:32:02 prometheus afpd[199]: afp_alarm:
child timed out
messages.0:Dec  2 13:19:42 prometheus afpd[5427]: afp_read:
ad_read: Invalid argument
messages.0:Dec  2 13:48:33 prometheus afpd[5747]: afp_alarm:
child timed out
messages.0:Dec  2 14:40:42 prometheus afpd[6632]: afp_alarm:
child timed out
messages.0:Dec  2 15:23:20 prometheus afpd[5421]:
afp_openfork: ad_open: I/O error
messages.0:Dec  2 16:33:14 prometheus afpd[6828]: afp_alarm:
child timed out
messages.0:Dec  3 07:52:55 prometheus afpd[10752]:
afp_openfork: ad_open: I/O error
messages.0:Dec  3 08:35:05 prometheus afpd[11177]:
afp_alarm: child timed out
messages.0:Dec  3 14:36:40 prometheus afpd[11121]:
afp_openfork: ad_open: I/O error
messages.0:Dec  3 14:45:57 prometheus afpd[12386]:
afp_alarm: child timed out
messages.0:Dec  3 14:57:14 prometheus afpd[12481]:
afp_openfork: ad_open: File exists
messages.0:Dec  3 15:27:45 prometheus afpd[11245]:
afp_openfork: ad_open: File exists
messages.0:Dec  3 16:40:05 prometheus afpd[12806]:
afp_alarm: child timed out
messages.0:Dec  4 10:56:08 prometheus afpd[16484]:
afp_openfork: ad_open: I/O error
messages.0:Dec  4 11:51:10 prometheus afpd[16310]:
afp_openfork: ad_open: I/O error
messages.0:Dec  4 12:29:41 prometheus afpd[16484]:
afp_openfork: ad_open: I/O error
messages.0:Dec  4 12:40:47 prometheus afpd[16542]:
afp_openfork: ad_open: I/O error
messages.0:Dec  4 14:42:24 prometheus afpd[16627]:
afp_openfork: ad_open: Resource temporarily unavailable
messages.0:Dec  4 15:47:54 prometheus afpd[12541]: afp_read:
ad_read: Invalid argument
messages.0:Dec  4 16:16:08 prometheus afpd[16484]:
afp_openfork: ad_open: I/O error
messages.1:Nov 23 11:13:40 prometheus afpd[15797]:
afp_openfork: ad_open: Not owner
messages.1:Nov 23 12:32:39 prometheus afpd[15538]:
afp_alarm: child timed out
messages.1:Nov 23 13:11:12 prometheus afpd[15797]:
afp_openfork: ad_open: I/O error
messages.1:Nov 23 15:21:42 prometheus afpd[16620]:
afp_alarm: child timed out
messages.1:Nov 23 16:17:39 prometheus afpd[16390]:
afp_openfork: ad_open: I/O error
messages.1:Nov 24 08:26:44 prometheus afpd[20786]:
afp_alarm: child timed out
messages.1:Nov 24 08:44:03 prometheus afpd[20999]: afp_read:
ad_read: Invalid argument
messages.1:Nov 24 09:29:13 prometheus afpd[20880]:
afp_openfork: ad_open: I/O error
messages.1:Nov 24 10:10:41 prometheus afpd[20846]:
afp_openfork: ad_open: I/O error
messages.1:Nov 25 09:32:44 prometheus afpd[27778]: afp_read:
ad_read: Invalid argument
messages.1:Nov 25 09:40:41 prometheus afpd[28003]: afp_read:
ad_read: Invalid argument
messages.1:Nov 25 10:57:50 prometheus afpd[27573]:
afp_alarm: child timed out
messages.1:Nov 25 14:30:26 prometheus afpd[28179]: afp_read:
ad_read: Invalid argument
messages.1:Nov 25 15:40:41 prometheus afpd[27959]:
afp_alarm: child timed out
messages.1:Nov 26 17:45:27 prometheus afpd[3916]: afp_alarm:
child timed out
messages.1:Nov 27 09:43:01 prometheus afpd[26904]:
afp_alarm: child timed out
messages.1:Nov 27 16:20:14 prometheus afpd[27575]:
afp_alarm: child timed out
messages.1:Nov 27 16:20:19 prometheus afpd[9471]: afp_alarm:
child timed out
messages.1:Nov 27 16:20:24 prometheus afpd[9517]: afp_alarm:
child timed out
messages.1:Nov 27 16:20:29 prometheus afpd[8953]: afp_alarm:
child timed out
messages.1:Nov 27 16:20:36 prometheus afpd[9559]: afp_alarm:
child timed out
messages.1:Nov 27 16:20:39 prometheus afpd[3670]: afp_alarm:
child timed out
messages.1:Nov 27 16:20:48 prometheus afpd[3706]: afp_alarm:
child timed out
messages.1:Nov 28 12:53:50 prometheus afpd[15066]:
afp_alarm: child timed out
messages.2:Nov 16 07:57:59 prometheus afpd[4937]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 08:23:23 prometheus afpd[4982]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 08:30:04 prometheus afpd[4939]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 11:09:56 prometheus afpd[5246]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 11:37:50 prometheus afpd[5246]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 11:41:17 prometheus afpd[5089]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 13:40:28 prometheus afpd[5089]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 13:55:34 prometheus afpd[5200]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 14:01:43 prometheus afpd[5246]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 14:01:49 prometheus afpd[5246]:
afp_openfork: ad_open: File exists
messages.2:Nov 16 14:02:35 prometheus afpd[5246]:
afp_openfork: ad_open: I/O error
messages.2:Nov 16 14:03:10 prometheus afpd[5246]:
afp_openfork: ad_open: File exists
messages.2:Nov 17 10:46:42 prometheus afpd[11891]:
afp_alarm: child timed out
messages.2:Nov 17 10:57:54 prometheus afpd[11976]:
afp_openfork: ad_open: I/O error
messages.2:Nov 17 13:01:36 prometheus afpd[11976]:
afp_openfork: ad_open: I/O error
messages.2:Nov 17 14:49:51 prometheus afpd[11976]:
afp_openfork: ad_open: I/O error
messages.2:Nov 17 15:00:43 prometheus afpd[12052]:
afp_openfork: ad_open: I/O error
messages.2:Nov 17 16:44:07 prometheus afpd[11986]:
afp_openfork: ad_open: Resource temporarily unavailable
messages.2:Nov 17 17:05:26 prometheus afpd[11986]: afp_die:
asp_shutdown: Connection timed out
messages.2:Nov 18 12:55:50 prometheus afpd[19876]:
afp_openfork: ad_open: File exists
messages.2:Nov 18 14:28:17 prometheus afpd[19931]:
afp_openfork: ad_open: I/O error
messages.2:Nov 19 09:00:08 prometheus afpd[25808]:
afp_alarm: child timed out
messages.2:Nov 19 09:52:40 prometheus afpd[11938]:
afp_alarm: child timed out
messages.2:Nov 19 09:58:09 prometheus afpd[21075]: afp_read:
ad_read: Invalid argument
messages.2:Nov 19 10:49:51 prometheus afpd[26193]:
afp_alarm: child timed out
messages.2:Nov 19 14:30:37 prometheus afpd[26256]:
afp_openfork: ad_open: I/O error
messages.2:Nov 19 15:48:07 prometheus afpd[25799]: afp_read:
ad_read: Invalid argument
messages.2:Nov 19 15:51:01 prometheus afpd[27415]: afp_read:
ad_read: Invalid argument
messages.2:Nov 20 08:37:59 prometheus afpd[1664]:
afp_openfork: ad_open: I/O error
messages.2:Nov 20 13:05:17 prometheus afpd[1684]: afp_alarm:
child timed out
messages.2:Nov 20 13:51:06 prometheus afpd[1664]:
afp_openfork: ad_open: I/O error
messages.2:Nov 20 13:56:14 prometheus afpd[2781]:
afp_openfork: ad_open: I/O error
messages.3:Nov  9 09:43:48 prometheus afpd[26155]:
afp_alarm: child timed out
messages.3:Nov  9 10:12:56 prometheus afpd[25890]:
afp_alarm: child timed out
messages.3:Nov  9 10:51:56 prometheus afpd[26082]:
afp_openfork: ad_open: I/O error
messages.3:Nov  9 13:58:00 prometheus afpd[26223]:
afp_openfork: ad_open: I/O error
messages.3:Nov  9 15:13:24 prometheus afpd[26082]:
afp_openfork: ad_open: I/O error
messages.3:Nov  9 15:51:18 prometheus afpd[25999]:
afp_alarm: child timed out
messages.3:Nov 10 09:30:24 prometheus afpd[2101]: afp_alarm:
child timed out
messages.3:Nov 10 09:31:46 prometheus afpd[2021]:
afp_openfork: ad_open: I/O error
messages.3:Nov 10 09:53:48 prometheus afpd[1968]:
afp_openfork: ad_open: I/O error
messages.3:Nov 10 13:10:23 prometheus afpd[1968]: afp_alarm:
child timed out
messages.3:Nov 10 13:49:01 prometheus afpd[3016]:
afp_openfork: ad_open: I/O error
messages.3:Nov 10 14:16:28 prometheus afpd[3016]: afp_alarm:
child timed out
messages.3:Nov 10 14:23:31 prometheus afpd[3220]:
afp_openfork: ad_open: I/O error
messages.3:Nov 10 15:33:57 prometheus afpd[1979]:
afp_openfork: ad_open: I/O error
messages.3:Nov 10 17:17:56 prometheus afpd[26085]: afp_die:
asp_shutdown: Connection timed out
messages.3:Nov 11 08:06:37 prometheus afpd[8522]:
afp_openfork: ad_open: I/O error
messages.3:Nov 11 09:23:06 prometheus afpd[8553]:
afp_openfork: ad_open: I/O error
messages.3:Nov 11 11:41:18 prometheus afpd[8617]:
afp_openfork: ad_open: I/O error
messages.3:Nov 11 12:06:09 prometheus afpd[8617]:
afp_openfork: ad_open: I/O error
messages.3:Nov 11 13:56:52 prometheus afpd[8553]:
afp_openfork: ad_open: I/O error
messages.3:Nov 12 12:33:39 prometheus afpd[15325]:
afp_alarm: child timed out
messages.3:Nov 12 14:20:15 prometheus afpd[16119]:
afp_alarm: child timed out
messages.3:Nov 12 15:03:50 prometheus afpd[15194]:
afp_openfork: ad_open: I/O error
messages.3:Nov 12 15:19:10 prometheus afpd[15194]:
afp_openfork: ad_open: I/O error
messages.3:Nov 12 16:34:26 prometheus afpd[16131]:
afp_alarm: child timed out
messages.3:Nov 13 07:29:07 prometheus afpd[21181]:
afp_openfork: ad_open: I/O error
messages.3:Nov 13 08:04:54 prometheus afpd[21301]:
afp_openfork: ad_open: I/O error
messages.3:Nov 13 08:06:26 prometheus afpd[21301]:
afp_openfork: ad_open: I/O error
messages.3:Nov 13 08:27:30 prometheus afpd[21339]:
afp_openfork: ad_open: I/O error
messages.3:Nov 13 09:34:07 prometheus afpd[21214]:
afp_openfork: ad_open: I/O error
messages.3:Nov 13 09:53:15 prometheus afpd[21214]:
afp_openfork: ad_open: I/O error
messages.3:Nov 13 11:22:52 prometheus afpd[21214]:
afp_alarm: child timed out
messages.3:Nov 13 11:59:37 prometheus afpd[21899]:
afp_alarm: child timed out
messages.3:Nov 13 13:15:05 prometheus afpd[21301]:
afp_openfork: ad_open: I/O error
messages.3:Nov 13 13:17:17 prometheus afpd[22026]:
afp_openfork: ad_open: I/O error
messages.3:Nov 13 14:48:54 prometheus afpd[21425]: afp_read:
ad_read: Invalid argument
messages.3:Nov 14 07:47:56 prometheus afpd[27690]:
afp_openfork: ad_open: I/O error
messages.3:Nov 14 11:09:33 prometheus afpd[27982]:
afp_openfork: ad_open: I/O error
messages.3:Nov 14 13:15:38 prometheus afpd[27982]:
afp_openfork: ad_open: I/O error
messages.3:Nov 14 13:19:49 prometheus afpd[28032]:
afp_alarm: child timed

---

From: Paul Krohn <[email-masked]>
Date: Fri, 11 Dec 98 15:48:41 -0800

>This brings up an interesting point -- does it really matter if a netatalk
>server is infected with the AutoStart virus?  My netatalk machine is an
>Intel box -- and thus can't run the Worm's code.  If it can't run the Worm,
>it can't infect client Macs in this way.

well, i understand that all that is necessary for the autstart worms to 
work is to be on a mac volume mounted on a mac - i've had worms spread 
via netware and netatalk volumes on intel and sparc hardware, 
respectively. in any case it's only few minutes' work that can save an 
age of misery down the road.

------------
Paul Krohn
San Francisco Examiner Systems Department
110 Fifth Street
San Francisco, CA  94103
415-777-7884
[email-masked] - www.examiner.com

---

From: Mitch McNeel <[email-masked]>
Date: Fri, 11 Dec 1998 16:11:13 -0800

Thanks to all that replied,

        I have narrowed down the problem of that pesky
little worm.  A user infected the server a couple of day
ago.  I found the files DELDB and DB sitting on the server
in the root dir. of the Volumes being mounted.  Anyway, I
have a couple of desktop support people working on getting
me a virus protection program for the MAC desktop.

Anyone have some suggestions????

Thanks again
Mitch

---

From: Harry Zink <[email-masked]>
Date: Sun, 13 Dec 1998 02:52:47 -0800

>Anyway, I

Get Virex 5.9 - better than Norton NAV (which sucks donkey rocks). Better 
support too.

Harry

---

From: Harry Zink <[email-masked]>
Date: Sun, 13 Dec 1998 02:54:49 -0800

>it can't infect client Macs in this way.

Duh!

But your Mac client, that connects to the netatalk volume WILL execute 
and run the worm, and once it is running on the clinet, *THAT*  infected 
system can do what the worm loves to do - infect more volumes, and damage 
files (including those on the server).

What the server runs is irrelevant - as long as Macs connect to it.

Harry

---

From: Harry Zink <[email-masked]>
Date: Sun, 13 Dec 1998 02:55:40 -0800

>netatalk is useful, however, for finding out who IS infected on my network
>-- I can just go into the Unix side and peek at what user created the DELDB
>file in the first place.  Then I smack the user around, for not taking
>proper precautions when they use Zips from clients, etc.

*THAT* is a great feature, and I didn't even think about that 
application...

Harry