Hacker uses hyper vdisks on isos…long story.

Corbindallas · Jan 3, 2022

I don’t fully understand the hyper vdisks yet, but I’m getting quickly aquainted. Anyway he/she will then basically make a safe space on my pc, and since I’m still learning about it, don’t know how to stop it or know how to locate the hidden .vhdx images he will hide in my files somewhere, could even be in a zip file from what I understand. So how do I stop this? I want to learn about this because, even though they are using it for bad, I can see what it is really meant to be used for. Anyway thanks for reading my story, and thanks for any help!

glasskuter · Jan 3, 2022

There is not enough to your story. I can't speak for everyone else but for me, I am completely in the dark to understand what you are talking about. If you suspect someone has access to your computer, then the best thing you can do is completely reformat your hard drive and do a clean installation of the operating system.
Tutorial Here.

Corbindallas · Jan 3, 2022

if you need to know more feel free to ask, the more I share the easier the problem gets solved

The-Hive · Jan 3, 2022

@glasskuter Like you I am in the dark but as far as I can work out he means Hyper-V disks which I googled and there is plenty of info on the web.

glasskuter · Jan 3, 2022

I guess the first big questions are -what makes you think you've been hacked and how do you correlate it to a virtual machine. (that's a new one on me)
If you're worried about it, go into your bios and disable hyper-v. Then if you're still worried about it do as I stated - clean install windows.

Slavic · Jan 3, 2022

I would begin from the list of active processes and services. To be sure that VM isn't working on your machine, open the Computer Management, Services and look at the list of services, which names begin from Hyper-V. All of them should have the Manual startup type and not be running. If they are active (running), stop them and switch the startup to Manual or even to Disabled, so they will not be started after system restart.

NavyLCDR · Jan 3, 2022

Open disk manager, do you see only your physical disks there, or do you see a virtual disk. My disk 2 is a .vhdx file mounted as a virtual disk, notice that the icon for the disk is blue:

Do you have a Virtual Machine Manager installed such as VMWare, Hyper-V, etc? Do you see any VMs that you don't recognize, or any disks mounted in the VMs that you don't recognize?

Corbindallas · Jan 3, 2022

he deleted my hard drives last night, I have cloud backups but woke up to formatted hds because I made a change to his vdisk. Anyway specifically I have a 3mb fixed virtual disk that contains a copy of sterelec, boot PE, that is what gives him so much access to my computer… that said the disk will is readonly, but I’m betting it was locked with a pen drive because it can’t be changed, at least with my very limited knowledge in the subject still. Am I allowed to post a pic of it?

NavyLCDR · Jan 3, 2022

Corbindallas said:
he deleted my hard drives last night, I have cloud backups but woke up to formatted hds because I made a change to his vdisk. Anyway specifically I have a 3mb fixed virtual disk that contains a copy of sterelec, boot PE, that is what gives him so much access to my computer… that said the disk will is readonly, but I’m betting it was locked with a pen drive because it can’t be changed, at least with my very limited knowledge in the subject still. Am I allowed to post a pic of it?

Wow. Sounds to me like you just need to wipe your hard drive (or SSD) and do a clean install.

Corbindallas · Jan 3, 2022

That option is on the table, and I agree it is probably the only fix here, but that 3 mb drive isn’t gone, and I deleted every bit of data I could, wiping it DoD style and it is still there mounted as the x drive

idgat · Jan 3, 2022

Screen

Corbindallas said:
That option is on the table, and I agree it is probably the only fix here, but that 3 mb drive isn’t gone, and I deleted every bit of data I could, wiping it DoD style and it is still there mounted as the x drive

Supply screen shots?

Wiping data ? ... User files or system data?

Wipe and re-install ... better still, swap out the drive for a new one and clean install onto that.

And then be careful who you give on-line access to.

NavyLCDR · Jan 3, 2022

Corbindallas said:
That option is on the table, and I agree it is probably the only fix here, but that 3 mb drive isn’t gone, and I deleted every bit of data I could, wiping it DoD style and it is still there mounted as the x drive

Do you have anything plugged into USB ports?

Corbindallas · Jan 3, 2022

That I didn’t think about, I unplugged everything and traded out moniter mouse and keyboard to ones never used on this pc

zbook · Jan 3, 2022

Which antivirus software is in use?

Consider installing Malwarebytes > post scan results

Open administrative command prompt and type or copy and paste (all at one time)

Code:

diskpart
lis dis
lis vol
sel dis 0
det dis
lis par
sel par 1
det par
sel par 2
det par
sel par 3
det par
sel par 4
det par
sel par 5
det par
sel par 6
det par
sel par 7
det par
sel dis 1
det dis
lis par
sel par 1
det par
sel par 2
det par
sel par 3
det par
sel par 4
det par
sel par 5
det par
sel par 6
det par
sel par 7
det par
sel dis 2
det dis
lis par
sel par 1
det par
sel par 2
det par
sel par 3
det par
sel par 4
det par
sel par 5
det par
sel par 6
det par
sel par 7
det par

Post images or share links of the commands with results into this thread.

glasskuter · Jan 3, 2022

Although it hasn't been specifically stated, reading between the lines to all these posts it's finally clear that you gave someone access to your system. When that door is opened, the user (YOU) can not be sure what all the hacker inserted into your system, your attached usb drives, or into your network. Instead of trying to figure it out and trying to deal with this virtual disk you speak of, you should have immediately disconnected from the network and shut the computer down. You can piddle with it until doomsday but you are leaving yourself wide open if you do anything other than a clean install, preferably on a new hard drive. Really good hackers can insert time bombs that can and will come back to haunt you again. If you have other computers on your network I would be concerned about those. If you saved any of your passwords on your hard drive they got access to those as well. You should change them immediately. Check your financials if you used your computer to access accounts.

Sir, I'm not trying to be harsh here. This is just a fact. From all appearances, this guy was no novice hacker, but used sophisticated means to attack your system. There is no easy recovery.

idgat · Jan 4, 2022

glasskuter said:
Although it hasn't been specifically stated, reading between the lines to all these posts it's finally clear that you gave someone access to your system.

Yep, my thoughts entirely (see my above post).

It may well be the the OP did this unknowingly and/or unsuspectingly (an errant email, an inappropriate web site, an injudicious click on a web site link), but from what the OP describes so far, that's about the easiest conclusion to draw.

Even more so, clean install ... and immediately.

jimbo45 · Jan 4, 2022

glasskuter said:
Although it hasn't been specifically stated, reading between the lines to all these posts it's finally clear that you gave someone access to your system. When that door is opened, the user (YOU) can not be sure what all the hacker inserted into your system, your attached usb drives, or into your network. Instead of trying to figure it out and trying to deal with this virtual disk you speak of, you should have immediately disconnected from the network and shut the computer down. You can piddle with it until doomsday but you are leaving yourself wide open if you do anything other than a clean install, preferably on a new hard drive. Really good hackers can insert time bombs that can and will come back to haunt you again. If you have other computers on your network I would be concerned about those. If you saved any of your passwords on your hard drive they got access to those as well. You should change them immediately. Check your financials if you used your computer to access accounts.

Sir, I'm not trying to be harsh here. This is just a fact. From all appearances, this guy was no novice hacker, but used sophisticated means to attack your system. There is no easy recovery.

Hi there.

Just have done with it -- clean re-install as follows - and don't waste your time even THINKING about using "Virus cleansing programs" while running from already a suspect computer -- that's like a Pilot deliberately flying with a mechanically defective plane and saying "I'll repair it when I'm in the Air" !!.

1) no point using an infected computer to "repair itself".

2) disconnect entire computer from LAN, WAN, any other device.

3) get a CLEAN usb stick -- with a stand alone partition manager on it -- GPARTED is brilliant but anything else that works is fine and boot into it.

4) create New partition table on the HDD in the computer. Don't create any other partitions.

5) get a bootable windows install iso (CLEAN) either via physical medium or make one from a DIFFERENT machine on a USB drive - UUPDUMP has decent clean images or even the MCT .

6) Clean install windows. Windows will initialize and partition the HDD.

7) now you can connect again to LAN/WAN internet.

Job done == "Seemples" -- Q.E.D

If you are 100% mega paranpoid then swap the HDD in the old machine before starting -- that's not usually necessary though -- stand alone physical write Hex'00' to the entire disk's data area is perfectly strong enough for consumer use.

Cheers
jimbo

Fabler2 · Jan 4, 2022

Personally, if it was me, and this is so unusual an infection, I wouldn't hesitate but to bin the drive. You can't really know if the drive's firmware is compromised. I'd do it for peace of mind.

jbcarreon123 · Jan 4, 2022

This is something I will do:

1. Disconnect infected machine on Internet, disconnect all network adapters, even Bluetooth.
2. Do an anti-virus scan
3. deep format the drive and Clean Install Windows 10 (or switch temporarily to Linux)
4. Disconnect and replace ALL drives connected to the PC

Extras:
1. Use an different drive (DISCONNECT all drives not essential)
2. Change the IP address of your internet
3. Disconnect all unnecessary devices such as cameras, microphones, PCI cards, and others.

NavyLCDR · Jan 4, 2022

I don't think we are going to know anything about this alleged 3 MB drive that can't be deleted until we see evidence of it with a screenshot of disk management or the results of zbook's code in post #14. I don't even know if it is possible to create a drive only 3 MB in size. And the claim is that it contains Windows PE and sterelec - post #10. Well, I can find a reference to strelec's utility drive on MajorGeeks - but as with any Windows PE, it is over 4 GB. It's impossible to run Windows PE in 3 MB.

Hacker uses hyper vdisks on isos…long story.

New member

My Computer

aka Mama Glass

My Computers

New member

My Computer

The First Three Star Guru

My Computers

aka Mama Glass

My Computers

Well-known member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

New member

My Computer

Well-known member

My Computers

Well-known member

My Computers

New member

My Computer

Well-known member

My Computer

aka Mama Glass

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers