Solved Trojan found on new PC

RedLad · Feb 2, 2023

I am only getting to read the latest replies, thanks to everyone for the input.

I didn't really intend for people to be going at each other, it all seems to have got a bit opinionated - but hey, I suppose that is what forums are for.

I've decided that I am going to just do a wipe, it will give me more peace of mind. I don't really want to go to Bleeping Computer and things like that to just 'patch it up.' A wipe is best, as @JMedlock83 and @TraderGary also said.

I was going to follow this guide and I have already made a Windows 11 installation USB.

Clean Install Windows 11

This tutorial will show you step by step on how to clean install Windows 11 at boot on your PC with or without an Internet connection and setup with a local account or Microsoft account. Windows 11 has all the power and security of Windows 10 with a redesigned and refreshed look. It also comes...

www.elevenforum.com

For this step about UEFI, I am not too sure what it means.
1 If you have not already, you will need to create a bootable Windows 11 installation USB that supports UEFI mode.

I just created the USB stick by following the guide here - Create Windows 11 Bootable USB Installation Media Tutorial

Would my BIOS already be in this UEFI mode? Sorry for the noob questions!

f14tomcat · Feb 2, 2023

RedLad said:
I am only getting to read the latest replies, thanks to everyone for the input.

I didn't really intend for people to be going at each other, it all seems to have got a bit opinionated - but hey, I suppose that is what forums are for.

I've decided that I am going to just do a wipe, it will give me more peace of mind. I don't really want to go to Bleeping Computer and things like that to just 'patch it up.' A wipe is best, as @JMedlock83 and @TraderGary also said.

I was going to follow this guide and I have already made a Windows 11 installation USB.

Clean Install Windows 11

This tutorial will show you step by step on how to clean install Windows 11 at boot on your PC with or without an Internet connection and setup with a local account or Microsoft account. Windows 11 has all the power and security of Windows 10 with a redesigned and refreshed look. It also comes...

www.elevenforum.com

For this step about UEFI, I am not too sure what it means.
1 If you have not already, you will need to create a bootable Windows 11 installation USB that supports UEFI mode.

I just created the USB stick by following the guide here - Create Windows 11 Bootable USB Installation Media Tutorial

Would my BIOS already be in this UEFI mode? Sorry for the noob questions!

About your UEFI question:

No such thing as a dumb Noob question...........

tap the Windows key to get the start menu up, type SYSTEMINFO. The app is listed on the left. C lick it. The display will conatin a lot of info. Look about half-way down for the line BIOS Mode. It should say UEFI.

Example

RedLad · Feb 2, 2023

f14tomcat said:
About your UEFI question:

No such thing as a dumb Noob question...........

tap the Windows key to get the start menu up, type SYSTEMINFO. The app is listed on the left. C lick it. The display will conatin a lot of info. Look about half-way down for the line BIOS Mode. It should say UEFI.

Example
View attachment 51654

Thanks. Yes, it does have that it as the Bios mode, cheers.

flashh4 · Feb 2, 2023

Sorry Haydon, that wouldn't be very smart on my part to name the ones i know. I hope you understand why !
It's to easy to go the "Dark Side" and find them for a price !
Some info on Rootkits:
If you booted from that drive and the rootkit has something in memory or has patched the operating system, then it absolutely could.
The only way to get rid of a rootkit is to format the hard drive and delete all partitions before reinstalling Windows.
Some root kits can overwrite firmware.
Some types of rootkits target BIOS/various roms/firmware of devices in your computer and not the HD, so it's a theoretical yes.
There are "in the wild" examples of rootkits infecting a special type of enterprise NICs, hardware controllers, etc.
Is it probable you have been infected by one such? No, they're kinda rare and the people who employ these are
typically fishing for something a little bit higher up than Average Joe's porn collection anyway.
The everyday root kit can be removed by using the tools provide & with patience. What i am saying is that not "ALL" rootkits can be removed by
reformatting or wiping it clean !
And that's all i have to say about that !!

No hard feelings on my part, just trying to help !!

Hazel123 · Feb 2, 2023

I think that is one way to tell if it's a rootkit or a bios virus. If you wipe the drive (ie secure wipe with secure erase) - so it's like a new drive - not just formatting it. Clean install windows. And set it up. If it comes back - you have a rootkit or bios virus. Then you need some real help. I'm not sure about this but I think flashing the bios sorts that.

Most times it will not come back and you'll have got rid of it with a drive wipe and clean install.

Haydon · Feb 2, 2023

Not long ago, I started a thread infections which can survive a reinstall of Windows that lets your neck hairs stand on end, but I don't think that that applies to the OP. But the OP may nevertheless want to read it.

Hazel123 · Feb 2, 2023

On that basis - Bleeping Computer will run through a lot of clean up stuff with you and checks and clean up the computer. Had to do it myself once. I did still need to do a clean install afterwards because there were a few changes as a result of all the tests (can't remember the details).

But at least then you'd know it's clean before reinstalling. Personally I wanted to reinstall anyway after the clean up to ensure all my files were as they should be.

Malwarebytes has an option for running a rootkit scan as well

Hazel123 · Feb 2, 2023

However, if you wipe the drive (important so it cleans every sector including the mbr), flash the bios and reinstall, I can't see how anything can survive that! However flashing the bios can cause issues as well. So still maybe easier to get bleeping computer to clean it up first.

Or just wipe the drive, clean install and see if everything operates normally. If it does its probably fine.

I believe bios viruses are very rare though.

RedLad · Feb 3, 2023

Hazel123 said:
I think that is one way to tell if it's a rootkit or a bios virus. If you wipe the drive (ie secure wipe with secure erase) - so it's like a new drive - not just formatting it. Clean install windows. And set it up. If it comes back - you have a rootkit or bios virus. Then you need some real help. I'm not sure about this but I think flashing the bios sorts that.

Most times it will not come back and you'll have got rid of it with a drive wipe and clean install.

Hi,

When you say secure wipe with secure erase, do you mean just installing Windows again using the USB method and then deleting any partitions at the stage where that option appears to select the drive to install to? Rootkits etc...you have me lost there! Prob no need to worry about that stuff for me, hopefully.

RedLad · Feb 3, 2023

Haydon said:
Not long ago, I started a thread infections which can survive a reinstall of Windows that lets your neck hairs stand on end, but I don't think that that applies to the OP. But the OP may nevertheless want to read it.

Thanks for this

RedLad · Feb 3, 2023

Hazel123 said:
However, if you wipe the drive (important so it cleans every sector including the mbr), flash the bios and reinstall, I can't see how anything can survive that! However flashing the bios can cause issues as well. So still maybe easier to get bleeping computer to clean it up first.

Or just wipe the drive, clean install and see if everything operates normally. If it does its probably fine.

I believe bios viruses are very rare though.

I won't be doing any flash stuff as I don't know anything about it.

I am just planning to wipe the PC, hopefully this weekend.

RedLad · Feb 3, 2023

Is it really worth installing these three pieces of software? Are they not gimmicky? I know Malwarebytes has a good enough reputation as a combo with Windows Defender, but the other two tools people in here have mentioned, I have never heard of these:

Malwarebytes AdwCleaner
Malwarebytes Anti-Rootkit Scanner

Are these totally seperate or all in the standard free Malwarebytes?

Hazel123 · Feb 3, 2023

RedLad said:
Is it really worth installing these three pieces of software? Are they not gimmicky? I know Malwarebytes has a good enough reputation as a combo with Windows Defender, but the other two tools people in here have mentioned, I have never heard of these:

Malwarebytes AdwCleaner
Malwarebytes Anti-Rootkit Scanner

Are these totally seperate or all in the standard free Malwarebytes?

No don't install those - unless an expert advises you to as part of a clean up. The standard malwarebytes actually includes an option to do a rootkit scan but it also warns you it can wreck your operating system!

If you do a clean install and run Malwarebytes and defender and nothing is fine you're probably ok but I would also run another offline antivirus from a usb stick (like the Kaspersky offline one) just to be sure.

RedLad · Feb 3, 2023

Hazel123 said:
No don't install those - unless an expert advises you to as part of a clean up. The standard malwarebytes actually includes an option to do a rootkit scan but it also warns you it can wreck your operating system!

If you do a clean install and run Malwarebytes and defender and nothing is fine you're probably ok but I would also run another offline antivirus from a usb stick (like the Kaspersky offline one) just to be sure.

Wow that is madness. I shall be avoiding it so, thanks!

I think by 'nothing' you meant everything?!

I am going to disconnect my two older sata drives before I do the wipe. Hopefully when I reconnect them after installing Windows 11 and re-scan them with Windows Defender and Malwarebytes they're OK.

When you say Kaspersky offline - do you mean just install a free version of Kaspersky and scan but keep the Internet off? Or is that a totally seperate scanner you are referring to? Maybe that would do for the two sata drives too once I reconnect them.

Hazel123 · Feb 3, 2023

I think by 'nothing' you meant everything?!

Lol yes - I was probably going to say nothing is wrong.

Sorry I meant this. Kaspersky rescue disk. You can download it and burn it to a usb stick. Then you boot from the usb and select to do a scan. It means any viruses can't interfere with it as it's done before the computer boots, and it can detect boot viruses as well I think. It'll probably show clean but it's reassurance

Free Rescue Disk Download | Kaspersky

Download Kaspersky Free Rescue Disk. Rescue your PC in these easy steps.

www.kaspersky.com

Others may have other advice - this is just what I would do. Last time I used it, it was slightly fiddly to connect to the internet to do the antivirus updates, from the usb stick but you can just run it without doing those.

There's some info about it here. You have various scanning options. The entire disk or just the boot sector - or both.

15 Free Bootable Antivirus Tools We Recommend in 2024

A bootable virus scanner can delete viruses from your PC when Windows won't start. Here's a list of our favorite free ways to run a USB virus scan.

www.lifewire.com

f14tomcat · Feb 3, 2023

@Hazel123

Where does MBAM say this?

The standard malwarebytes actually includes an option to do a rootkit scan but it also warns you it can wreck your operating system!

TraderGary · Feb 3, 2023

Kaspersky is headquartered in Moscow, Russia, and has ties to the Russian Military. I wouldn't touch Kaspersky.

Hazel123 · Feb 3, 2023

f14tomcat said:
@Hazel123

Where does MBAM say this?

The standard malwarebytes actually includes an option to do a rootkit scan but it also warns you it can wreck your operating system!

Seems it doesn't any more, but it did used to come with a warning - maybe the warning pops up when you do a root scan? Apologies if it's incorrect.

Hazel123 · Feb 3, 2023

TraderGary said:
Kaspersky is headquartered in Moscow, Russia, and has ties to the Russian Military. I wouldn't touch Kaspersky.

Trend Micro do one too - as an alternative

Rescue Disk

www.trendmicro.com

f14tomcat · Feb 3, 2023

Hazel123 said:
Seems it doesn't any more, but it did used to come with a warning - maybe the warning pops up when you do a root scan? Apologies if it's incorrect.

Long time back, with some of the Beta releases, the rootkit scan would lock the system and/or BSOD. That was solved. It's ok, no apologies needed.

Solved Trojan found on new PC

Active member

My Computer

Well Known Member

My Computer

Active member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Active member

My Computer

Active member

My Computer

Active member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Well Known Member

My Computer

Stock Market Wizard

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well Known Member

My Computer

Similar threads