Check your Dreambox 500s for Gemini TimeBomb Manually

[khalidomar]

You can check your Dreambox 500s for Gemini TimeBomb manually via telnet. Here is how:

1. Telnet to your Dreambox
   

   Run console and type:
   
   [B]telnet dreambox-ip[/B]
   
   [COLOR="Green"]Example: telnet 10.0.0.254[/COLOR]

2. Login as root (default password is dreambox)
3. Change directory to /lib/modules/2.6.9/extra
   

   Type:
   
   [B]cd /lib/modules/2.6.9/extra[/B]

4. List directory contents
   

   Type:
   
   [b]ls -l[/b]

5. Find the file head.ko and check its size; if the size is anything but "308509" then your box has the TimeBomb and you should consider flashing it with a different image immediately!

If you have Windows Vista or 7, then probably you don't have telnet client installed by default. To install it: Go to Control Panel -> Programs and Features -> Turn Windows features on or off, scroll down to Telnet Client and check the box near it and Hit OK and wait a few seconds

And following the famous adage: A picture is worth a thousand words!, I have created the animation below to demonstrate the process.

Good Luck!

[norad]

Re: Check your Dreambox 500s for Gemini TimeBomb Manually

my box have 320916 dec 12 2009 head.ko its ok?

[khalidomar]

Re: Check your Dreambox 500s for Gemini TimeBomb Manually

my box have 320916 dec 12 2009 head.ko its ok?

Do you have DM500s with Gemini 4.31 or above? if so then yes, your box has the timebomb and you should install a different image!

You may want to try this tool to make sure: http://www.satlover.com/forum/dreamb...mb-tester.html (Pay attention to the second screenshot in the post, it shows a similar file size as yours so definitly your is infected)

[faccione]

Re: Check your Dreambox 500s for Gemini TimeBomb Manually

Do you have DM500s with Gemini 4.31 or above? if so then yes, your box has the timebomb and you should install a different image!

You may want to try this tool to make sure: http://www.satlover.com/forum/dreamb...mb-tester.html (Pay attention to the second screenshot in the post, it shows a similar file size as yours so definitly your is infected)

The link posted in the thread linked above has been removed.
Trojan/backdoor detected.

[khalidomar]

Re: Check your Dreambox 500s for Gemini TimeBomb Manually

The link posted in the thread linked above has been removed.
Trojan/backdoor detected.

OK, I did not notice that, anyway, here is the screenshot I was referring to:

It maybe a trojan, but it still does a good job identifying the timebomb. Isn't that the whole idea of a trojan

[norad]

Re: Check your Dreambox 500s for Gemini TimeBomb Manually

if the line have now 308509 november 22 2008 also is infected yes or not please respond only if is infected or not infected am not very praticol of english

[khalidomar]

Re: Check your Dreambox 500s for Gemini TimeBomb Manually

if the line have now 308509 november 22 2008 also is infected yes or not please respond only if is infected or not infected am not very praticol of english

308509 = not infected

[gaivan]

Re: Check your Dreambox 500s for Gemini TimeBomb Manually

if the line have now 308509 november 22 2008 also is infected yes or not please respond only if is infected or not infected am not very praticol of english

your box is not infected norad but stay away from new gemini images.