infections which can survive a reinstall of Windows

Haydon · Dec 25, 2022

From a parallel thread (that I did not want to derail)

Ghot said:
It's very rare, but there are infections which can survive a reinstall of Windows. This is what we need to check for.

Let's discuss, I like to know more about Frankenstein viruses

FreeBooter · Dec 25, 2022

If it's not hardware firmware infection then with full format malware cannot survive.

cereberus · Dec 25, 2022

FreeBooter said:
If it's not hardware firmware infection then with full format malware cannot survive.

It depends how you do it - a "reset my pc" can still get virus infected e.g. if the recovery partition is infected in some way. Rare but not impossible.

The only sure fire way to reinstall is to boot from a usb drive created on a clean pc, then install from that deleting all partitions.

FreeBooter · Dec 25, 2022

cereberus said:
It depends how you do it - a "reset my pc" can still get virus infected e.g. if the recovery partition is infected in some way. Rare but not impossible.

The only sure fire way to reinstall is to boot from a usb drive created on a clean pc, then install from that deleting all partitions.

When you select to delete everything when you reset your PC that does full format.

SlicEnDicE · Dec 25, 2022

cereberus said:
The only sure fire way to reinstall is to boot from a usb drive created on a clean pc, then install from that deleting all partitions.

Not even this is enough. Low level format of the full disk is needed to ensure that also all the nastiest bugs are gone.

Rootkits are very nasty too, only way to get rid of those is to either replace the chip or re-flash it. Some rootkits does so much damage that it is best to replace your whole computer. Luckily those are very rare.

cereberus · Dec 25, 2022

FreeBooter said:
When you select to delete everything when you reset your PC that does full format.

The problem with "reset my pc" is that it rebuilds the os from the (allegedly) well protected winsxs folders on the C drive.

It has been known for these folders to become infected. I know it is extremely unlikely.

I am only going on reports of this on web - how much are they are true or an exaggeration, I cannot say. I have never experienced it personally.

However, why take the risk when using a usb drive created from a clean pc is truly guaranteed?

cereberus · Dec 25, 2022

SlicEnDicE said:
Not even this is enough. Low level format of the full disk is needed to ensure that also all the nastiest bugs are gone.

Rootkits are very nasty too, only way to get rid of those is to either replace the chip or re-flash it. Some rootkits does so much damage that it is best to replace your whole computer. Luckily those are very rare.

You can run diskpart clean all from usb drive. When you say chip - chip on drive (drives can be replaced) or chip on mobo?

SlicEnDicE · Dec 25, 2022

cereberus said:
You can run diskpart clean all from usb drive. When you say chip - chip on drive (drives can be replaced) or chip on mobo?

Chip on anything that has a "brain" --> HDD, MB, GPU, Soundcard, Modem, Router...anything really...even your fridge, if it is internet connected.

Haydon · Dec 25, 2022

SlicEnDicE said:
Rootkits are very nasty too, only way to get rid of those is to either replace the chip or re-flash it. Some rootkits does so much damage that it is best to replace your whole computer. Luckily those are very rare.

MalwareBytes has a setting 'Scan for rootkits'. The default setting is OFF but you can turn it ON, and MalwareBytes would then scan for rootkits as part of a normal scan routine, i.e. without doing a restart.

Windows Defender has an 'off-line scan' that restarts the computer. I seem to remember (without being able to find a reference) that at least part of the reason for the restart was to find rootkits that start before Windows does, and to find other hard to find malware.

SEDE and others, care to discuss?

man00 · Dec 25, 2022

Give these guys a call, removes 99.99% of viruses and will even remove windows 95

SlicEnDicE · Dec 25, 2022

The thing with rootkits is that if it is well designed, you don't even know you have it, even with using all the scanners in the world.

flashh4 · Dec 25, 2022

Back when i went through Malware school to become a Malware Specialist this was the code we were taught !

Refresh your PC
Reset your PC

The first will re-install your operating system, but keep your personal files and settings, the second will both re-install your operating system and remove your personal files and settings. The second is the safer (but less convenient) option.

When an infection infects your computer, it does so by installing malicious files and processes and registry settings, so if you reset your computer to how it was when your OS was first installed, you will by default remove any changes that an infection might have made.

Now technically it is possible to infect the firmware on your computer, and since this boots before your OS, then it will survive a reset. However, infecting firmware is extremely difficult to do, and usually requires hands-on access, so unless you have allowed someone to have unsupervised access to your machine, it is highly unlikely that you will ever contract one.

From time to time you might read of some "new" method to infect firmware remotely, but I've been helping people remove infections on other forums for 20 years now, and I've yet to see anyone with a real firmware infection.

Don't use a "smartphone" myself, so can't say what's possible with them, or what reset options are available. I expect it will depend on what make of phone, and what OS it's running, but I would imagine that a phone reset would operate in a similar manner to Windows, and be equally effective at removing infections.

The one last thing to consider, is whether you have multiple devices which are synced, in which case if more than one of your devices has been infected, then after a reset your machine can become re-infected when it syncs with one of the other infected devices.

Haydon · Dec 25, 2022

SlicEnDicE said:
The thing with rootkits is that if it is well designed, you don't even know you have it, even with using all the scanners in the world.

Like a rootkit that does not pop up windows, does not steal cpu cycles, does not do anything but phoning home, perhaps? But even merely phoning home can be detected?

TairikuOkami · Dec 25, 2022

Haydon said:
But even merely phoning home can be detected?

Indeed, rootkits are not designed to work by themselves, they still need malware/drivers, like superfish by Lenovo or Intel ME and AMD PSP. So while rootkits are bad, they are harmless, if they stay dormant or blocked by the security restrictions.

flashh4 said:
Back when i went through Malware school to become a Malware Specialist this was the code we were taught !

Refresh your PC

Reset your PC

That will not do much, if the recovery image is infected and "clean" stock install is bundled with nasties.

Haydon · Dec 25, 2022

TairikuOkami said:
Indeed, rootkits are not designed to work by themselves, they still need malware/drivers, like superfish by Lenovo or Intel ME and AMD PSP. So while rootkits are bad, they are harmless, if they stay dormant or blocked by the security restrictions.

That will not do much, if the recovery image is infected and "clean" stock install is bundled with nasties.

MalwareBytes used to advertise 'behavioral analysis' that goes like this: a 'ghost' phones home which gets flagged as unusual behavior and the 'ghost' gets investigated.

That sounds good, but that also means that the 'ghost' does not get investigated as long as it remains quiet!

Haydon · Dec 25, 2022

I did a bit of reading and much of it is above my level of understanding, but the link below appears to be on topic, scary

"... circumvent operating system reinstall, but also hard disk replacement. The only way to remove such malware -- assuming victims know they have been compromised in the first place -- is to flash the firmware, a process not often conducted by typical users."

Fancy Bear LoJax campaign reveals first documented use of UEFI rootkit in the wild

The exploit can be used to patch and tamper with firmware in targeted attacks.

www.zdnet.com

SlicEnDicE · Dec 25, 2022

Haydon said:
assuming victims know they have been compromised in the first place -- is to flash the firmware, a process not often conducted by typical users."

Exactly! Can be nasty to find and nasty to get rid of. Most scanners can't even detect them unless used specialized equipment in offline mode and know what checksum a firmware dump should produce.

SlicEnDicE · Dec 25, 2022

~~Sorry, typed the above message on mobile and for some reason the quote and my text ended up in same quote box. Can't edit the message on mobile to fix this.~~

Never mind...

Haydon · Dec 27, 2022

Here is another link for masochists

What Is Firmware Malware and How Can You Prevent Infections?

Firmware malware is an increasing threat to your device's security. Learn more about firmware malware and how it spreads.

www.makeuseof.com

zbook · Dec 27, 2022

These were / are notable malware reported in Wikipedia:

Timeline of computer viruses and worms - Wikipedia

en.wikipedia.org

This is a link for malware after a clean install:

Malware That Can Survive OS Reinstalls Strikes Again, Likely for Cyberespionage

Antivirus provider Kaspersky discovered the malware, dubbed MoonBounce, on a computer's UEFI firmware.

www.pcmag.com

infections which can survive a reinstall of Windows

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Similar threads