Being stalked by individual using un-detectable un-removable malware...

[Drybones_]

Need help literally hit a brick wall here... Being stalked by an individual who was breaking into my home address and such Believe it's my father he won't leave me alone and won't stop harassing me I have been doxed multiple times. He owns a computer store and is possibly stalking thousands of other people I believe also... He is very tech orientated so he probably designed the malware on his own... He's tried for years to project his mental illness onto me. Getting tired of the childish loser prankster want to get rid of him for good... Malware persists after reinstalls etc and is also being injected onto my mobile phone I believe... Multiple google accounts have been hacked... Have reported him to police without much luck Please help...

[Porthos]

@Drybones_

Although I will not be directly assisting you, a malware removal expert will be along to assist after you do the following.

Let's get the info to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

Let's go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process

Then follow each step in the order provided. Unless otherwise asked, please attach all logs

 

Please make the following system changes: Please pay close attention the the instructions in all of the following links.

• If you have not done so already - Enable System Protection and create a NEW System Restore Point  <<<<< Important.
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads.. Make sure to turn it back on once the scans are completed
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed
• Disable-Fast-Startup   Windows 8 and newer only <<<<< Important.
• Show-Hidden-Folders-Files-Extensions

Please run the following scans: Please pay close attention the the instructions in all of the following links.

1. Click the following link and run a  Scan with AdwCleaner
2. Click the following link and run a  Scan with Malwarebytes
      RESTART the computer <<<<< Important.
3. Click the following link and run a  Scan with Farbar Recovery Scan Tool 

Example image of where to click to attach files when posting your reply

Then be patient for the next expert to take your case. <<<<< Important.

 

Thank you

[Drybones_]

Please be aware that malware might be designed to have killswitches and such as it seems it keeps removing itself and injecting itself at certain times to avoid detection. Here are my scan logs however

 

Thanks

AdwCleaner[S00].txt Malwarebytes Scan Report 2024-09-21 232509.txt FRST_22-09-2024 00.56.31.txt Shortcut_22-09-2024 00.56.31.txt Addition_22-09-2024 00.56.31.txt

[JSntgRvr]

Welcome 
 
I'll be helping you with your computer.
 
Please read this post completely before beginning. If there's anything that you do not understand, please don't hesitate to ask before proceeding.
 
Please take note of the guidelines for this fix:

• Please note that I am a volunteer. I do have a family, a career, and other endeavors that may prevent immediate responses that meet your schedule. Do note that the differences in time zones could present a problem as well. Your patience and understanding will be greatly appreciated.
• First of all, the procedures we are about to perform are specific to your problem and should only be used on this specific computer.
• Do not make any changes to your computer that include installing/uninstalling programs, deleting files, modifying the registry, nor running scanners or tools of any kind unless specifically requested by me.
• Please read ALL instructions carefully and perform the steps fully and in the order they are written.
• If things appear to be better, let me know. Just because the symptoms no longer exist as before, does not mean that you are clean.
• Continue to read and follow my instructions until I tell you that your machine is clean.
• If you have any questions at all, please do not hesitate to ask before performing the task that I ask of you, and please wait for my reply before you proceed.
• Scanning with programs and reading the logs do take a fair amount of time. Again, your patience will be necessary. 

Let's begin... 

The following Fix will empty these folders:

• Windows Temp
• Users' Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Discord cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin
• Hosts file will be reset

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns, please ask before running this fix.

The system will be rebooted after the fix has run.

FRST64 was saved as C:\Users\rayra\Downloads\FRST64(1).exe

• Download the enclosed file  Fixlist.txt
• Save it in the same location FRST64 is saved. 
• Start FRST (FRST64) with Administrator privileges
• This time around Press the Fix button and wait
• When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please attach this file in your next reply.

Dr.Web CureIt!

Please download the Dr.Web CureIt! anti-virus utility
https://free.drweb.com/

You will need to send them an email to obtain a link to download the scanner, please do so

• The downloaded file will normally have a unique name such as:  q7a9tr4p.exe
• Close all open applications and locate the downloaded file and double-click to run it
• The program will take a moment to launch and bring up the License and Update screen
• Place a check mark to agree to the terms and then click on the Continue button
• Click the underlined link Select objects for scanning
• On the top left click the Scanning objects that should automatically check all objects
• Click the small wrench and make sure there is a check on Automatically apply actions to threats
• Then click the large button on bottom right Start scanning
• Once the scan has completed there will be a link named Open report click that and a log named cureit.log should open in Notepad
• The log is saved in the folder named Doctor Web in the top of your user profile folders
• Please attach that log on your next reply

Edited September 22 by JSntgRvr
typo

[Drybones_]

Thankyou so much for taking your time to investigate JSntgRvr :)

Apologies for having so much installed and thank you for taking your time to investigate

I did try to analyze my network traffic and did install wireshark just before you replied to my post I do apologize hope it doesn't cause any confusion at all!

attached is the logs:

 

Fixlog.txt cureit.log

[Drybones_]

I must add my system is running noticeably slower since tonight :S? Unsure if it's the suspected possible rootkit causing this... It's usually a symptom I got in the past along with lower bandwidth via audio and picture quality would always decrease. Things would sound very bad and sometimes my audio driver would be tampered with. Noticed like a 100fps drop in cs2 and some lag on my desktop when selecting multiple shortcuts. I am certain I'm being stalked by my father by malware he actually created himself... I was watching a video earlier today and I noticed edge randomly open with a bing search "help with windows 11" this is typically the narcissistic behavior he has displayed in the past along with doing things like disable my audio devices/network adapter (he completely rendered my system unusable when I was using linux) Pretty sure it's bios malware or something I do hope you guys come back with some results as this has been going on for numerous years now :| being literally stalked by this man/group of people he/they're also hacking my mobile constantly the suspected person (my father) has like 20/30 years of IT knowledge and programming under his belt... Also owns a computer shop and I think he's spying on hundreds of his customers. He is using modified versions of pegasus by the looks and exploiting SS7 Goldeneye to hack mobiles.

[Drybones_]

There is a chance he has been looking at this post and he's injected something ever since you replied to me as things are CERTAINLY stuttering and such now. Back to a garbage running PC once again... I'm definitely being spied on... This man has access to all my google accounts and more everything is being compromised with keyloggers and such... Literally sick don't know what to do this person is constantly trying to control my life. Obsessed stalker behavior...  He's playing mind games with me and such changing passwords to my accounts I'm freaking tired of this loser 20 years of my life he has done nothing but act like a child pulling narcissistic pranks doing anything he can to irritate anyone then brag about it with gaslighting and such he has dropped himself in the muck several times with statements like "This is way over your head consult a professional" immediately attacking any reddit post etc I had made in the past too making me sound unwell when he is the one projecting his mental illness onto me

[JSntgRvr]

There are no infected objects detected and the script ran well. Using a computer that has not been compromised, change all your passwords, including your router's. See if that stops the harassing.

[Drybones_]

Theres clearly a rootkit that is undetectable that you've missed out... Can you do further analysis? I've noticed HUGE slowdowns on my machine... Further analysis is needed Like I say this stalker is designing his own stalkerware to stalk me... Please help...

[JSntgRvr]

Lets try another scanner:
Please run the following ESET Online Scanner and perform a Full Scan
 
Click the following link to save the installer for ESET Online Scanner
https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get started.
• When presented with the initial ESET screen, click on "Get Started". Read and accept the Terms of use
• On the "Before we start..." screen chose if you want to send anonymous data and if you want to provide feedback or not, then click Continue
• When prompted for scan type, Click on the Full Scan button
• Enable  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click the Start scan button.
• Have patience.  The entire process may take a few hours or more.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log and give it a name and location you remember.
• If something was removed and you know it is a false postive, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to turn off the offer for “periodic scanning”.
• Enable "Delete application data on closing" - You do not need to submit feedback unless you want to. Simply ignore and close the program.
  

 
Note: If you do need to do a File Restore from ESET please follow the directions below
[KB2915] Restore files quarantined by the ESET Online Scanner version 3
https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner
 
Please attach the ESET scan log you saved at the end to your next reply

[Drybones_]

I decided to do a reinstall and flash as it looks like it's a BIOS level rootkit. if infected again (when... as stalker is extremely persistent) Can I possibly show BIOS malware to police as proof against the stalker in court? Is there anything I can do to gather proof/evidence?

[JSntgRvr]

Your computer uses a Unified Extensible Firmware Interface (UEFI), which is a specification that defines an architecture for the platform firmware used for booting a computer's hardware and its interface for interaction with the operating system.  It will be very difficult to infect this type of platform, if not possible.

Thanks for the feedback.

Once the system is reinstalled, there should be no more problems.

A few final recommendations:
 
The following information will help you to keep your computer and data safer as well as improve your overall privacy

• Recommend using a Password Manager for all websites, etc. that require a password. Never use the same password on more than one site.
  https://www.howtogeek.com/780233/best-password-manager/
• Make sure you're backing up your files https://forums.malwarebytes.com/topic/136226-backup-software/
• Keep all software up to date - PatchMyPC - https://patchmypc.com/home-updater#download     https://patchmypc.com/about-us
• Keep your Operating System up to date and current at all times - https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2
• Further tips to help protect your computer data and improve your privacy: https://forums.malwarebytes.com/topic/258363-tips-to-help-protect-from-infection/
• Please consider installing the following Content Blockers for your Web browsers if you haven't done so already. This will help improve overall security

Malwarebytes Browser Guard

•   Google Chrome: https://chrome.google.com/webstore/detail/malwarebytes-browser-guar/ihcjicgdanjaechkgeegckofjjedodee
•   Microsoft Edge: https://support.malwarebytes.com/hc/en-us/articles/4413298736787-Install-Malwarebytes-Browser-Guard-on-Microsoft-Edge-browser
•   Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/malwarebytes/

uBlock Origin

• Google Chrome: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm
• Microsoft Edge: https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak
• Mozilla Firefox: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin

Cybersecurity basics & protection
 
Everything you need to know about cybercrime
https://www.malwarebytes.com/cybersecurity
 
Further reading if you'd like to keep up on the malware threat scene: Malwarebytes Blog  https://blog.malwarebytes.com/
 
Please review the following to help you better protect your computer and privacy
 
Tips to help protect from infection
 
Hopefully, we've been able to assist you with correcting your system issues.
 
Thank you for using Malwarebytes. Please tell your friends and family if they too need assistance with malware removal.

Regards.

[Drybones_]

I think I still have malware... Computer is still slow in some applications and such plus noticing someone literally press keys and such while I'm gaming. Also still same symptoms as above I think I might have a really nasty rootkit that's extremely difficult to find possibly wrote over hardware firmware or something

[Drybones_]

The second I uploaded those logs to you earlier... That's when my PC got attacked more deeply it seems they've been watching what I was doing and they've injected something onto my hardware using those logs I believe

[JSntgRvr]

Open Malwarebytes Antimalware. Click on the Scanner Bar. Then on Advanced Scans. Click on Configure Scans, then put a checkmark on Scan For Rootkits. Select the C: drive. then click on the Start Custom Scan

 

• Once the scan is completed, make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.

[Drybones_]

Out of nowhere just before my USB devices deactivated and stopped working even with a quick unplug and plug back in the devices still did not work... It took a restart to fix the issue but I believe it is the attacker trying to mess with me. Scan found nothing. I'm doing some research myself into wireshark and such clearly need to dig deep here as this is something quite nasty/serious

Malwarebytes Scan Report 2024-09-23 183736.txt

[JSntgRvr]

Scan with security check and attach the report:

 

[Drybones_]

thankyou

Attached are the logs

SecurityCheck.txt

[JSntgRvr]

That log is clear.

Do you experience problems with the USB ports frequently?

 

Edited September 23 by JSntgRvr

[Drybones_]

Nope literally just today, although when I was using linux it seemed the rootkit/backdoor infected deeper parts of my PC and then I was literally witnessing certain USB devices get disabled completely (was literally to try and mess with me) I also witnessed something happen to my Ethernet adapter and stopped me completely from accessing any website I even witnessed the stalker block me from accessing my modem at the time 192.168.1.1 they also drove past mine shouting up (must be nice having no internet). This is a very deeprooted rootkit by the looks. Is it possible for malware to be installed on a USB device or something that can then infect the BIOS and hijack it?

[Drybones_]

They have possibly had physical access to my USB devices as there was numerous break-ins from the stalker... He kept molding the lock and creating a key from the mold and breaking in when he knew I wasn't in... He also hacked my CCTV at my old address

[Drybones_]

It's literally a brand new motherboard I only purchased not long ago, I sent the possibly malware ridden one in for RMA so it's probably being investigated by Asrock. They might come back with some news (this is the motherboard where usb slots were disabled and network adapter was also disabled)

[JSntgRvr]

There is no evidence of rootkits in your system. All your logs are clear.

[Drybones_]

Hello again.

I did another reinstall and no malware now by the looks.. it seems like I was right my USB devices are indeed injecting malware onto my computer it seems like a really hidden bitcoin miner or something that was actively spying on me. GPU heats were rising to about 47/50C idle. Now are sitting around 30C and windows is very snappy and responsive. Looks like I'm replacing all my USB devices 

[Drybones_]

I will add it seems like it was injecting onto my bios also as my old system wasn't recoverable I had to RMA the board as it didn't have flashback capabilities. This new board does and it seems we are all clean now