Persistent BIOS Virus After Reinstall - Urgent Help Needed

[tahamussa22]

Hello Malwarebytes Community,

I've encountered a perplexing situation where I've reinstalled my laptop due to a suspected virus, but the issues persist. Despite thorough antivirus scans and the use of computer sanitizer, my data surfaced on the dark web, leaving me uneasy. I lack expertise in these matters, and there's no local support available. Seeking your assistance to determine if a persistent threat is still present in my system. Your guidance would be greatly appreciated.

Thank you.

[AdvancedSetup]

Good day @tahamussa22

Have you checked your Digital Footprint for the Web? You can submit your email address here and get a report of what it can find.

https://www.malwarebytes.com/digital-footprint

NOTE: The data could be very old and not relevant today. But it should give you information to help you double-check

 

Please go ahead and run the following and we'll check your system.

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes:

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans:

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 
    

Example image of where to click to attach files when posting your reply

 

Thank you

 

[tahamussa22]

Just now, AdvancedSetup said:

Good day @tahamussa22

Have you checked your Digital Footprint for the Web? You can submit your email address here and get a report of what it can find.

https://www.malwarebytes.com/digital-footprint

NOTE: The data could be very old and not relevant today. But it should give you information to help you double-check

 

Please go ahead and run the following and we'll check your system.

 

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes:

• If you have not done so already - Enable System Protection and create a NEW System Restore Point
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup
• Show-Hidden-Folders-Files-Extensions

Please run the following scans:

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes 
      RESTART the computer
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 
    

Example image of where to click to attach files when posting your reply

 

Thank you

 

hi i found a lot of hiden files and my report in 

https://www.malwarebytes.com/digital-footprint fin my data laked 12 breaches eposed 

here is what you tell me

 FRST.txtAddition.txt

[tahamussa22]

What should i do now ?

[AdvancedSetup]

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

• NOTICE: This script was written specifically for this user, for use on this particular machine.
• Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRSTEnglish.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\User\Desktop\

NOTE. It's important that both files, FRSTEnglish.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed.
               Also, make sure you know the passwords for all websites as cookies may possibly be removed in some cases, but not all cases.
3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[tahamussa22]

what was in the previous files ? is my computer infected with viruses, and bios viruses, and should i be worried ?

what should i do now ?

Fixlog.txt Log-Clear-BrowserCache.txt

[AdvancedSetup]

You're using a hack called KMS to try to activate Windows. It is not fully or properly activated. Only a business should be using an onsite KMS Server to license. Other methods are illegal and often come with malware.

I would highly recommend that you consider reinstalling Windows and DO NOT use any hacks, cracks, or tweaks to attempt to license it.

Purchase a valid license for the Operating System if needed.

 

Clean Install Windows 10 & 11 (2023)
https://answers.microsoft.com/en-us/windows/forum/all/clean-install-windows-10-11-2023/1c426bdf-79b1-4d42-be93-17378d93e587

Also, please review the following topic

Bypass Microsoft Online Account Creation during installation of Windows 11
https://forums.malwarebytes.com/topic/296613-bypass-microsoft-online-account-creation-during-installation-of-windows-11/

 

 

[tahamussa22]

No, I'm not using anything, it was installed automatically with a cracked program.

Please help me to remove it and eliminate any viruses, i can’t work on my laptop now., and  I have studies, so help me with the steps, please.l cause i don’t understand the first links . And tell me more about this virus.

[tahamussa22]

Im sure there is other viruses than what you tell me kms and in bios or others places.

[AdvancedSetup]

The removal is to do a Clean install of Windows.

KMS is no longer present. If that satisfies you then we should be done. Personally I'd do a clean install of Windows, but again the choice is yours.

Cheers

 

Edited February 5 by AdvancedSetup
Updated information

[tahamussa22]

Yes, I understand you, but it wasn't me who entered it. It entered through some program because I bought the computer with activated Windows. It expired days ago, and I don't know why. But are you sure it's the only virus? Because I think and am sure there are many. Have you seen KMS alone? The computer's fan keeps running even though I'm doing normal tasks or not doing anything. And if I install a new Windows, as in the previous links, will there be no virus left, even if it's in the BIOS? Please answer me carefully because I'm scared and don't understand much in this field, and I involve you from the depths of my heart.

[tahamussa22]

And I forgot, every time I start the computer, many CMD windows appear and disappear, and each time my suspicions increase. Will doing a clean install of Windows delete everything because I formatted Windows and got rid of the virus hidden in the BIOS  ?

[AdvancedSetup]

35 minutes ago, tahamussa22 said:

It entered through some program because I bought the computer with activated Windows. It expired days ago

A legal and legitimate installation of Windows Consumer version NEVER expires. Whomever you bought the computer from was using invalid or illegal means to activate it.

Again, my advice is to do a CLEAN install of Windows. ALL of those issues, concerns, and unknown attacks will be gone.

 

Clean Install Windows 10 & 11 (2023)
https://answers.microsoft.com/en-us/windows/forum/all/clean-install-windows-10-11-2023/1c426bdf-79b1-4d42-be93-17378d93e587

Also, please review the following topic

Bypass Microsoft Online Account Creation during installation of Windows 11
https://forums.malwarebytes.com/topic/296613-bypass-microsoft-online-account-creation-during-installation-of-windows-11/

 

[tahamussa22]

It seems that a week ago, I noticed that my Windows license had expired, but now I see it's activated. I swear I didn't install anything to activate it, and my computer has been virus-free for many months. Is this normal?

[tahamussa22]

My computer has many virus* 

how can you check other parts like the bios ?

[AdvancedSetup]

There are over a billion computers out in the world. I've seen listed or named less than a dozen computers with a verified in the wild attack of the BIOS.

If you have one (not obvious symptoms shown) then I'd suggest you go play the lottery as you'd have a much higher chance of winning the lottery than getting a BIOS infection

 

I'm going to proceed and close your topic soon. There are no longer any obvious signs of infection at this time. The KMS hack was removed already.

 

Clean Install Windows 10 & 11 (2023)
https://answers.microsoft.com/en-us/windows/forum/all/clean-install-windows-10-11-2023/1c426bdf-79b1-4d42-be93-17378d93e587

Also, please review the following topic

Bypass Microsoft Online Account Creation during installation of Windows 11

 

 

[tahamussa22]

okay im sorry and thank you very much 

let me do Clean Install Windows and tell you 

but what about this hiden files and other files they have all my logs and ip adress and my informations login internet now they are deleted 

[AdvancedSetup]

You backup ONLY your own personal data that YOU have created. The rest of it you can always reinstall from the vendor.

 

[AdvancedSetup]

We're glad that we were able to assist you.

The following information will help you to keep your computer and data safer as well as improve your overall privacy

1. Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
   https://www.howtogeek.com/780233/best-password-manager/
2. Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
3. Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
4. Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
5. Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/ 
6. Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm 
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak 
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

 

Cybersecurity basics & protection
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity

 

Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/

Hopefully, we've been able to assist you with correcting your system issues.

Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal

 

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you