Is there any way to inspect the initrd modules on my computer?

[cousinlucky]

What ever it is that is infecting my computer it places itself in the initrd modules so that it can initiate upon start-up. Is there any way to inspect these modules? Thank You!

[HROAdmin26]

Inspect? Verify integrity?

Boot from LiveCD, checksum them, then compare to known good values?

[hazel]

The initrd image is actually a gzipped archive. You can copy it to your home directory, gunzip it and have a look at its contents; I did that because I was curious. It turned out to be a simple root partition more or less, with the usual directories and some programs and scripts.

[cousinlucky]

Thank You, Hazel! I was afraid to touch any zipped files in the root directory. Whatever is in my computer even intiates when I have a disk inserted at start-up. I'm at a loss to figure out how it does that.

[hazel]

Thank You, Hazel! I was afraid to touch any zipped files in the root directory. Whatever is in my computer even intiates when I have a disk inserted at start-up. I'm at a loss to figure out how it does that.

You certainly should not unzip anything in the root directory. That's why I suggested copying it to your home directory and unzipping the copy.

Your BIOS determines the order in which disks are inspected at startup. There's a key that will get you into the BIOS (it varies from one computer to another but usually it's DEL or F4). You have to press it quickly before Linux actually boots. Then you can edit the BIOS features. One of them gives the boot disk order; typically this will be CDROM, floppy, hard drive. If you have it set up to boot from the hard drive before the floppy, then it will only use the floppy if the hard drive boot fails for some reason. Some people set up their BIOS's to do this because it makes the boot process faster.

[cousinlucky]

Thanks again, Hazel!