Jump to content

Believe to have Bios Rootkit


Recommended Posts

Have good reason to believe that current laptop is infected, my phone and other laptop have been infected and I have had to send the other laptop to repair, and my phone to be flashed. 

Current laptop is windows 8 Lenovo z50, have done Lenovo reset from the Lenovo button, when running the laptop a large amount of GB is already used, battery life is terrible and does not charge past 58%, and then drops to 5% in a few minutes after unplugging (however the laptop is 3 years old), I have tried installing Mbam anti Rootkit, it installed successfully but doesn’t update (failed to resolve host) and the internet connection is working. 

Have also installed GMER and it starts to scan, but then crashes.

I would just like help in detecting if there is a Rootkit, and possible ways to remove it or would I have to get the bios flashed?

Any help would be greatly appreciated! Thank you.

Link to post
Share on other sites

Rechargeable Lithium Ion batteries may hold a charge for a long time but when used, they don't have a long life.

Replace the battery.  Capability of a battery charge is not the same as that of a Smart Phone and is NOT indicative of malware.  It is indicative of it being time to replace the battery.

There are no BIOS infecting RootKit in the wild.  It's too complicated.  One would have to be a High Value Target ( HVT ) for someone to go through that level of trouble and a high expense to specifically target the model of notebook used by the HVT and then have physical access to the platform and overcome the TPM.

Lenovo z50 battery at Newegg - $29

 

 

Edited by David H. Lipman
Spelling, Grammar and Clarification
Link to post
Share on other sites

Hi David, 

Thank you I will look to replacing the battery.

Is it possible for a Rootkit to survive a Lenovo reset? Could you please also assist why mbam anti Rootkit won’t update and why there’s almost 200gb missing after the reset. I just want to be sure that the laptop is clean because I believe I am being specifically targeted. 

 

Link to post
Share on other sites

Define a " Lenovo reset? "

As in restore it to the condition as it was delivered from the factory ?

If you are specifically using the the stand-alone MBAR, it is best to ask questions about it in;  Malwarebytes Anti-Rootkit BETA Support

Link to post
Share on other sites

The Lenovo Reset button clears the CMOS.  The CMOS and the BIOS are not the same.  The BIOS is the hardware level Firmware that makes the hardware work with a series of input and Output routines and is stored in EEPROM.  It acts as middleware between the hardware and any given OS.  The BIOS is non-volatile memory.  On the other hand the CMOS ( which is the name of the actual circuit technology and not functionality ) is volatile memory.  That being when a DC current is removed volatile memory loses it memory state.  Thus CMOS is backed by a small Lithium battery.  Often a CR-2032.  The CMOS is a RAM scratchpad that stores variables related to the BIOS and its settings that any OS can read accordingly.  The button is used to wipe the CMOS and reset the hardware settings to factory defaults. 

If you choose another Lenovo function and Restore a Factory Image, it will DELETE data and bring the notebook back to a state where it was shipped from the factory.

 

Link to post
Share on other sites

I certainly don't see " 200gb missing " being unallocated. ( BTW:  I think you mean GB not gb as in GigaByte.  Nomenclature is important ).

I do see Lenovo related partitions.\

RE:  https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Can-you-tell-me-what-partitions-these-are/m-p/1201540#M65417

Choose the "Spoiler".

Link to post
Share on other sites

  • Root Admin

The possible battery or other hardware issues aside, please run the following to get some logs so we can see what might be going on with the computer. Use a USB stick if needed to copy/post back to a computer that can access the Internet. If you don't have then you'll need to send this one to the computer shop as well.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

  • If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • If you don't have Malwarebytes 3 installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
  • Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Right-click on the program and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the Terms of use.
  • Wait until the database is updated.
  • Click Scan.
  • When finished, please click Clean.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
  • Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

Link to post
Share on other sites

  • Root Admin

AV: McAfee Anti-Virus and Anti-Spyware

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> csrss.exe
Failed to access process -> services.exe

 

You need to 100% fully disable McAfee antivirus when you run FRST as it's blocking it from scanning your system.

Thanks

 

Link to post
Share on other sites

  • Root Admin

McAfee sometimes does not fully disable itself when you turn off real time protection. Please give it a try and run a new FRST scan. Then look at the log and see if those same errors come up in the new log.

Failed to access process ->

In most cases (unless you have some unexpected rootkit) it is being blocked by your antivirus.

We need a set of clean FRST logs without that: Failed to access process ->  issue.

Thanks

 

Link to post
Share on other sites

  • Root Admin

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.