Solved Rootkit survives restored image

fixer · Apr 13, 2023

My trusty old PC became unbootable and unrepairable. Whether I restored a Macrium image or tried to clean install Win 10 it failed at boot with 'Your device ran into a problem and needs to restart. You can restart'. Same with automatic repair. I have no experience or knowlege of rootkits but from reading up this did fit the bill. I eventually got it up and running by using Partition Wizard to completely zap the SSD boot drive and reinstalling Win 10 from USB. I've always believed nothing can survive a disk image restore but seems that isn't so. Interesting!

FreeBooter · Apr 13, 2023

If you image the the Windows 11 that was infected and restore that image that will restore the malware infection.

Scan your computer with Download Free TDSSKiller - Rootkit Removal | Kaspersky Lab US

fixer · Apr 13, 2023

That's not the situation. I tried restoring three different images, all well predating this problem. The images were not infected.

FreeBooter · Apr 13, 2023

How do you know your computer infected by Rootkit?

If its firmware infection then no formatting will help remove the infection.

fixer · Apr 13, 2023

I'm not certain it was a rootkit but as completely zapping the boot drive with bootable Partition Wizard has enabled me to reinstall Windows from USB it obviously wasn't a firmware infection either. It was the SSD itself that was infected and that infection, whatever it was, survived three image restores. As for TDSSKiller, as it was impossible to boot the computer at all how would I have been able to run that?

Anyway, the problem is resolved and I'm not asking for help with it. Just thought members might be interested in this situation where an infected drive has survived multiple image restores.

SIW2 · Apr 13, 2023

what is the zap that partition wizard does ?

fixer · Apr 13, 2023

It offers three different ways to blank a drive. I tried filling it with zeros and ones but that didn't work so I selected a process it describes as DoD, very slow. That succeeded with the seven pass option.

SIW2 · Apr 13, 2023

I tried filling it with zeros and ones but that didn't work so I selected a process it describes as DoD, very slow. That succeeded with the seven pass option.

Lot of writes to the disk. There are tools that use the ssd security erase which is very fast and less damaging.

Manufacturers have their own tools available and, for example, parted magic has one that is not manufacturer dependent. Aomei part assist includes something similar, though I haven't yet used that one.

As far as I can make out, the tools send a command to the disk controller to run it's own security erase/block erase function.

Micron:
The ATA SECURITY ERASE command not only deletes data but also returns an
SSD to its fresh-out-of-box (FOB) performance state. This can be useful when running
performance and benchmark tests. See Micron's Differences in Personal vs. Enterprise
SSD Performance technical marketing brief for more information. Writing all zeros or
any data pattern across an entire SSD is not a proper or secure method of erasing data
from an SSD. The ATA SECURITY ERASE command should be used for this purpose.
Some engineers and scientists have detected stray electrons in NAND cells after an erase, and Micron acknowledges this possibility. However, because a block erase operation raises every NAND cell to an identical erase voltage regardless of the cell’s previous state, Micron contends that it is impossible to determine the previous state of the cell based on leftover, stray signals

Try3 · Apr 13, 2023

The OP has already done it.

All the best,
Denis

Haydon · Apr 13, 2023

There is a therapy, but not a diagnosis.

FreeBooter · Apr 13, 2023

Like i said formatting will not clean firmware from Rootkit infection.

UEFI Rootkit cyber attack - first-ever discovered | ESET

UEFI rootkits, the hackers’ Holy Grail, were long feared but none was ever seen in the wild – until now.

www.eset.com

ThrashZone · Apr 13, 2023

fixer said:
My trusty old PC became unbootable and unrepairable. Whether I restored a Macrium image or tried to clean install Win 10 it failed at boot with 'Your device ran into a problem and needs to restart. You can restart'. Same with automatic repair. I have no experience or knowlege of rootkits but from reading up this did fit the bill. I eventually got it up and running by using Partition Wizard to completely zap the SSD boot drive and reinstalling Win 10 from USB. I've always believed nothing can survive a disk image restore but seems that isn't so. Interesting!

Hi,
Winpe usb recovery media should work regardless of infection
Reflect prompts people to create it when opening reflect.
Boot to the winpe media delete partitions and restore system image easier than falling off a log.

fixer · Apr 13, 2023

SIW2 said:
Lot of writes to the disk. There are tools that use the ssd security erase which is very fast and less damaging.

I have since had a look at the SSD in HD Sentinel - status OK health 98%. However a bit puzzled by the report -

"The drive tried to examine and reallocate data sector(s) 2 times. The examined data area is perfect." Why would it be trying to reallocate a data area that is perfect? Maybe that's where this bug was hidden, who knows?

Anyway, thanks for the comments and suggestions.

ThrashZone · Apr 13, 2023

Hi,
98% is hardly perfect
Seems it has bad cells.

fixer · Apr 13, 2023

ThrashZone said:
Boot to the winpe media delete partitions and restore system image easier than falling off a log.

That's exactly what I did - how else could I have restored a boot drive image!

ThrashZone · Apr 13, 2023

fixer said:
That's exactly what I did - how else could I have restored a boot drive image!

Hi,
In the os
All it does is restart and attempt to restore a system image
Since you didn't list the process is why I stated the correct process.

Try3 · Apr 13, 2023

fixer said:
Whether I restored a Macrium image or tried to clean install Win 10 it failed at boot with 'Your device ran into a problem and needs to restart. You can restart'. Same with automatic repair. ... I eventually got it up and running by using Partition Wizard to completely zap the SSD boot drive and reinstalling Win 10 from USB.

I find your experience interesting and I hope that somebody can explain it.

But I do not understand why you made the leap from a disk fault to diagnosing a rootkit.
Surely a disk fault [overcome by zapping] would explain all the symptoms you reported.

I do appreciate that some rootkits are disk-based whilst others are in the firmware.
Rootkit - Wikipedia
So, if you had a rootkit at all, it would have been a disk-based variant.

All the best,
Denis

fixer · Apr 13, 2023

ThrashZone said:
Hi,
In the os
All it does is restart and attempt to restore a system image
Since you didn't list the process is why I stated the correct process.

If you had read the thread you would know that the system wasn't bootable!!

fixer · Apr 13, 2023

Try3 said:
I find your experience interesting and I hope that somebody can explain it.

But I do not understand why you made the leap from a disk fault to diagnosing a rootkit.
Surely a disk fault [overcome by zapping] would explain all the symptoms you reported.

I do appreciate that some rootkits are disk-based whilst others are in the firmware.
Rootkit - Wikipedia
So, if you had a rootkit at all, it would have been a disk-based variant.

All the best,
Denis

Yeah, I did say I wasn't certain it was a rootkit. In retrospect I agree - just a disk fault. However this old box has been utterly reliable for donkey's years so a sudden disk fault never even occurred to me. Anyway, Win 10 is reinstalled on it now and all looks good atm but I'll keep the replacement I bought just in case.

Try3 · Apr 13, 2023

You might also like to have a look at the similar repeated system image restoration failures experience of Stigg in Computer Won't Boot | Spinning Circle Starts Briefly, Then Stops - TenForums
Stigg's fix to repeated system image restoration failures is reported in post #17 of that thread.

All the best,
Denis

Solved Rootkit survives restored image

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Minor Threat

My Computer

Well-known member

My Computers

Minor Threat

My Computer

Well-known member

My Computers

Minor Threat

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Similar threads