Server Refused To Boot: Files Removed

[rajeshbahl]

Some unauthorised person got the root password of our sco openserver server. After doing some "work" the system was shutdown.Now when ever the system is rebooted, it started giving error:-

could not exec /etc/init (PID 1), status 0x00000009

We booted the machine from a generic kernel boot floppy.On mounting the root filesystem (of course it did not mount in the first instance but did after running fsck on the root filesystem)we found that the /etc and /usr/lib directories were not present on the hard disk.We made links from /opt/K/SCO/5.0.5Eb/etc files to /etc directory.Also made links from /opt/K/SCO/Unix/5.0.5Eb/usr/lib files to /usr/lib files.

Now whenever the server is booted, it detects the hardware properly and just hangs after that.

Can any one suggest some method to recover from this situation keeping in view there is no root backup available?

Thanking In Advance

Rajesh K. Bahl

 

[patw]

There's probably more missing files, or even critical binaries overwritten with garbage.

I take it there are no emergency restore diskettes available?

The situation probably needs a local consultant on site. Try Tony Lawrences

http://www.pcunix.com

site for a list of SCO experts in your area.

If you are up to it, perhaps getting a new hard drive and re-instaling SCO from scratch on it, then installing the old drive as the 2nd HD and mounting it will let you recover any user data or surviving configuration data you may need.

Then run out and get one of the 'Super-tar' backup and recovery programs and get bit-verifed automatic backups every night.

30 day demos at

http://www.microlite.com

or

http://www.lone-tar.com.

Good luck.
Pat Welch, UBB Computer Services
Caldera Authorized Partner
Unix/Linux/Windows/Hardware Sales/Support
(209) 745-1401 Fax: (413) 714-2833