the worst possible type of rootkit I have

[Formsey]

Hello. I recently got hacked by some nasty guys. my devices have been compromised, my passwords have been stolen. I have 2 desktop computers and 2 laptops plus 2 more phones also remotely taken over. on all devices there is the same type of rootkit because there are additional users with hypervisor privileges everywhere. I tried zeroing the disks and removing the mbr tables, reinstalling the offline system - no success, the problem returns. it is probably at the hardware level, reprogramming the bios may not solve the case either due to other peripherals. is there any chance to get rid of such an advanced beast or is it left to throw the equipment in the trash?

[AdvancedSetup]

Hello @Formsey and

Unless you're a well known State Level person worth millions to billions of dollars I think we can rule out a magical bios rootkit. Though theoretically possible they're still extremely rare as in so rare you have better odds of winning the lottery than having someone personally attack you with such a sophisticated expensive attack.

If you're willing I'll work with you to do a clean install and reset your router. If you simply want to follow along with the sky is falling then perhaps sell all your equipment and buy all new equipment.

Please let me know what you'd like to do.

Thank you

 

[Formsey]

what if I'm sure of an attack even though I'm not a celebrity or a billionaire? I had a free account on "jfrog artifactory" and there were tons of CVE vulnerabilities and docker containers attack. I think the rootkit is at the hardware level and I don't know how to check the individual components. Look on photos and also thank you for the quick reply.

[Formsey]

I don't want to sell someone infected hardware, I'd just be doing them a favor and backdoor for next victim 😅 I want to fix it something if it's possible and keep my devices

[AdvancedSetup]

Hello  and      @Formsey

 

My screen name is AdvancedSetup and I will assist you with your system issues.
 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow all steps in the provided order and post back all requested logs
• Please attach all log files to your post, unless otherwise requested
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans have been completed.
• Temporarily disable Microsoft SmartScreen to download the software below if needed. Make sure to turn it back on once the scans are completed.
• Searching, detecting, and removing malware isn't instantaneous and there is no guarantee to repair every system.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Do not run online games while the case is ongoing. Do not do any free-wheeling or risky web-surfing.
• Only run the tools I guide you to use. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked, Hacked, or Pirated programs are not only illegal but also can make a computer a malware victim.
• Having such programs installed is the easiest way to get infected. It is the leading cause of ransomware encryption. It is at times also a big source of current Trojan infections.
• If there are any on the system you should uninstall them before we proceed.
• Please be patient and stick with me until I give you the "all clear". We don't want to waste your time, please don't waste ours.
• If your system is running Discord, please be sure to Exit it while this case is ongoing.

 

 

Let's go ahead and run a couple of scans and get some updated logs from your system.

Please make the following changes.

 

• Temporarily disable your antivirus real-time protection or other security software first. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the scans are completed.
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

 

Next, run these steps and post back the logs as an attachment when ready.

[ 1 ]

Malwarebytes for Windows

• If you already have Malwarebytes installed then open Malwarebytes and click on the small gear icon, then click on the "Check for updates" button on the General tab.
• After any updates, click the middle Scan button from the main page. It will automatically run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed, make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let us know in your next reply that the scanner would not run.

[ 2 ]

Malwarebytes AdwCleaner

• Please download Malwarebytes AdwCleaner and save the file to your Desktop or Downloads folder.
• Double-click to run the program - Malwarebytes AdwCleaner guide
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine to finish the cleaning process.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach that log to your next reply.
   
• If No Detections are found, Click Skip Basic Repair
  
  WARNING: Do Not click the Run Basic Repair button unless instructed to by a Malwarebytes support agent or authorized helper

 

RESTART THE COMPUTER Before running Step 3

[ 3 ]

Gather MBST Logs

Please do the following so that we may take a closer look at your system for any possible infections.

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply
  
  WARNING: Do Not click the Repair System under Advanced unless requested to by a Malwarebytes support agent or authorized helper

 

Thank you

 

[AdvancedSetup]

Are you still with us @Formsey

Please post an update

Thanks

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks