mike4 0 Posted March 19, 2019 Share Posted March 19, 2019 Hi tried SysRescue live cd, clicked boot but am unshure if it checked the Uefi bios for rootkits. How to scan the UEFI Bios? Thanks Link to comment Share on other sites More sharing options...
Administrators Marcos 5,090 Posted March 19, 2019 Administrators Share Posted March 19, 2019 It's not possible. ESET for Linux does not scan UEFI. Link to comment Share on other sites More sharing options...
mike4 0 Posted March 19, 2019 Author Share Posted March 19, 2019 So how to do that? On my new laptop I have win10 but with mcaffee trial. Link to comment Share on other sites More sharing options...
itman 1,668 Posted March 19, 2019 Share Posted March 19, 2019 (edited) I am not sure SysRescue will scan the UEFI. According to this: https://support.eset.com/kb3509/?locale=en_US&viewlocale=en_US , it only scans boot sectors. Appears to me you will have to use an Eset installed product to scan UEFI. -EDIT- You can give Eset's Online Scanner- installed version, a shot and see it has a setting to scan the UEFI: https://support.eset.com/kb2921/?locale=en_US&viewlocale=en_US Edited March 19, 2019 by itman Link to comment Share on other sites More sharing options...
mike4 0 Posted April 19, 2019 Author Share Posted April 19, 2019 Thanks but for not messing up also my harddisk I have not connected any hd. Tried the online scanner but seems not to scan uefi bios but am sure to have such a bios trojan on my pc. Why? Because I don't have any hd connected but get Errors even virus found with hiren's boot cd. on ubuntu i get 2 files in ~.gnupg which is not normal but used to encrypted download of trojan later on. anything else to do but to return the asus motherboard? already did that twice. Where else could be the Problem? Link to comment Share on other sites More sharing options...
itman 1,668 Posted April 19, 2019 Share Posted April 19, 2019 4 hours ago, mike4 said: Where else could be the Problem? It is not unheard of for anything firmware related to be possibly infected. For example, any add-on PC Express bus cards such as a network adapter card, etc.. As far as motherboard chipsets go, JMicron ones have long been suspected. Are your memory chip card/s from a reliable vendor? Link to comment Share on other sites More sharing options...
mike4 0 Posted April 20, 2019 Author Share Posted April 20, 2019 I don't have any network Cards only a ASUS ROG Strix Z390-F Gaming Motherboard but I'll return also my Nvidia graphics Card and the ddr4 memory modules as I suspect the memory to be corrupted by the virus. Hopefully that should fix it finally, or could I miss something else? Link to comment Share on other sites More sharing options...
itman 1,668 Posted April 20, 2019 Share Posted April 20, 2019 I really think you're being a bit "paranoid" on this issue. If you really believe you have firmware related malware and you have shown no proof of this, you should have you device checked out by a competent security professional. Link to comment Share on other sites More sharing options...
itman 1,668 Posted April 23, 2019 Share Posted April 23, 2019 BTW - I forgot to mention this possibility since you have an ASUS motherboard: https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/ Link to comment Share on other sites More sharing options...
mike4 0 Posted April 24, 2019 Author Share Posted April 24, 2019 im not paranoid I'm simply running out of ideas after resending to asus warranty twice the Motherboard. Link to comment Share on other sites More sharing options...
Most Valued Members Nightowl 205 Posted April 24, 2019 Most Valued Members Share Posted April 24, 2019 31 minutes ago, mike4 said: im not paranoid I'm simply running out of ideas after resending to asus warranty twice the Motherboard. If you are really worried , you could flash your BIOS again with the latest BIOS update from ASUS , Format your PC and reinstall your Windows and see if there is any differences . Link to comment Share on other sites More sharing options...
itman 1,668 Posted April 24, 2019 Share Posted April 24, 2019 (edited) On 3/19/2019 at 6:20 AM, mike4 said: So how to do that? On my new laptop I have win10 but with mcaffee trial. Let's back up to this posting. I don't know how good McAfee is at detecting UEFI/BIOS malware. However, I do know Eset's AV scanner can detect the same. I suggest you uninstall McAfee. Reboot and install either NOD32 or Eset Internet Security in 30 day trial mode. Either one as part of the installation process with run an in-depth scan on all connected SDDs/HDDs; see below screen shot. This in-depth scan will include an UEFI/BIOS scan. Ref.: https://www.eset.com/int/home/free-trial/ Edited April 24, 2019 by itman Link to comment Share on other sites More sharing options...
mike4 0 Posted April 25, 2019 Author Share Posted April 25, 2019 (edited) Thanks I intend to move to eset when McAfee trial ends also because I use both Win10 and Ubuntu. Is there a product line for both os? Bios flash I did many times, foremost with my old pc before trashing it. So I'm fed up with Asus and will ask for a refund and buy a similar Motherboard maybe msi etc. Thanks itman for the link. Last question, should I return today also the RAM memory and Nvidia graphics or is this paranoid? Thanks again Edited April 25, 2019 by mike4 Link to comment Share on other sites More sharing options...
itman 1,668 Posted April 25, 2019 Share Posted April 25, 2019 6 hours ago, mike4 said: Last question, should I return today also the RAM memory and Nvidia graphics or is this paranoid? I would say its paranoid, The only memory attack I know of is row hammer and it applies to ECC memory which most users don't purchase due to its higher cost: https://www.wired.com/story/rowhammer-ecc-memory-data-hack/ . As far as a nVidia firmware hack, I never have heard of one. Link to comment Share on other sites More sharing options...
mike4 0 Posted May 25, 2019 Author Share Posted May 25, 2019 (edited) ok so i've returned my graphicscard, asus Motherboard and ram. Motherboard is now msi. installed, booted from cd and get on win a trojan downloader, on ubuntu two files in .gnupg. Exactly like before.- So where could the virus hide? in the monitor? Motherboard and ram seem new, graphicscard might have been returned untested for virus? What do do? I'm asking my shop to take back all including monitor. Edited May 25, 2019 by mike4 Link to comment Share on other sites More sharing options...
Most Valued Members peteyt 393 Posted May 26, 2019 Most Valued Members Share Posted May 26, 2019 On 5/25/2019 at 9:37 AM, mike4 said: ok so i've returned my graphicscard, asus Motherboard and ram. Motherboard is now msi. installed, booted from cd and get on win a trojan downloader, on ubuntu two files in .gnupg. Exactly like before.- So where could the virus hide? in the monitor? Motherboard and ram seem new, graphicscard might have been returned untested for virus? What do do? I'm asking my shop to take back all including monitor. I'm a little confused. What evidence do you have that you have a trojan? Link to comment Share on other sites More sharing options...
mike4 0 Posted May 27, 2019 Author Share Posted May 27, 2019 (edited) With Hiren's boot cd antivirus it finds a trjoan downloader in Windows\system32 also on ubuntu live cd those 2 files are used for encrypted downloads. I have no HD connected nor internet Connection ps: sorry for not being clear. my laptop with McAfee is ok but only my pc has above Problems since 6 months Edited May 27, 2019 by mike4 Link to comment Share on other sites More sharing options...
itman 1,668 Posted May 27, 2019 Share Posted May 27, 2019 1 hour ago, mike4 said: With Hiren's boot cd antivirus it finds a trjoan downloader in Windows\system32 What AV do you have loaded on the Hiren's boot CD? It could very well be giving you a false positive detection. It also appears that it is incapable of removing whatever it is detecting; most likely since it is in the System32 directory. Do this. Note the name of the file the AV is detecting in the System32 directory. Boot into Windows. Then submit that file to VirusTotal here: https://www.virustotal.com/#/home/upload for a scan by the various AV engines it uses. If none or only one or two of the engines flag the file as malware, assume the Hiren's boot CD AV detection is a false positive. Link to comment Share on other sites More sharing options...
Most Valued Members peteyt 393 Posted May 27, 2019 Most Valued Members Share Posted May 27, 2019 3 hours ago, mike4 said: With Hiren's boot cd antivirus it finds a trjoan downloader in Windows\system32 also on ubuntu live cd those 2 files are used for encrypted downloads. I have no HD connected nor internet Connection ps: sorry for not being clear. my laptop with McAfee is ok but only my pc has above Problems since 6 months Im confused about the hd part. No hard drive? If so how are you doing anything or do you mean external. Like itman said could be a false positive any info on what it found? Can it be uploaded to total virus? Also what made you run hirens boot cd. Did you see something suspicious? Link to comment Share on other sites More sharing options...
itman 1,668 Posted May 27, 2019 Share Posted May 27, 2019 (edited) Based on what is shown here: https://www.hirensbootcd.org/download/ , what is loaded on the Hirens Boot CD are old versions of MalwareBytes and Eset's on-line scanner. The current ver. of Eset's on-line scanner is 3.0.17.0. For MalwareBytes, the current ver. is 3.7.1.2839. As such, I would be skeptical of any detections by either. Edited May 27, 2019 by itman Link to comment Share on other sites More sharing options...
itman 1,668 Posted May 27, 2019 Share Posted May 27, 2019 (edited) OK. I am getting up their in age and as such you have slow days. So let's take this "from the top" again. You stated that you are receiving malware detections from the security software loaded on the Hiren's boot CD even with your hard drive not connected. The detections are coming from the System32 directory. This can only mean that the Win PE version loaded from the Hiren's boot CD is getting infected. So let's go through the possible scenarios on how this could happen. 1. I believe the Hiren's boot CD is delivered as an .iso file and all you do is create bootable media using the .iso file. The first possible source of malware could have been on the device you created the bootable media from. For example, the software you used to create the bootable media could have contained malware and it infected one of the files needed for booting from the CD. Also the above would be applicable for the original Eset SysRescue media you created. 2. The Hiren's .iso file file you downloaded contains malware. I don't know where you downloaded it from. 3. I believe the WIN PE version used does establish a network connection. So it is possible, something was downloaded from the Internet while Win PE was running and in turn dropped malware into its System 32 directory. This would be more likely if there was malware preloaded into the .iso file that established a connection to a malicious C&C server. Or your router is compromised to the point it is allowing unsolicited inbound connections, etc. etc.. In any case at this point. all we known is that Win PE version you are running is getting infected with malware originating from the Hiren's boot CD. If you have reason to beleive that the PC you noted is getting infected, you would have to post details on what malware is being detected on that. At this point and based on the limited data provided, I would suspect your router is compromised in some way. Although you did state that your notebook is OK and I assume it is also connecting through the same router. Finally, remember this is a web site forum for Eset users and I believe you haven't purchased an Eset license yet. As such, any malware assistance will be very limited in nature. Edited May 27, 2019 by itman Link to comment Share on other sites More sharing options...
mike4 0 Posted May 28, 2019 Author Share Posted May 28, 2019 (edited) Just downloaded, burned and scanned a new Hiren boot cd. Booting the pc now shows a Bluescreen "a device Needs to be repaired" I've only used my laptop in the last months so the cd must be clean. -------- -where to disable spelling correction on Windows? -can i install eset trial on multiple devices and os? (laptop now as mcaffee expired, later pc and linux)? Thanks Edited May 29, 2019 by mike4 Link to comment Share on other sites More sharing options...
itman 1,668 Posted May 28, 2019 Share Posted May 28, 2019 (edited) Again without you posting specifics on malware being detected, no one can really help on this issue. 4 hours ago, mike4 said: -can i install eset trial on multiple devices and os? (laptop now as mcaffee expired, later pc and linux)? Yes as far as I am aware of. But you would have to download and install Eset in trial mode on each device. Edited May 28, 2019 by itman Link to comment Share on other sites More sharing options...
mike4 0 Posted May 28, 2019 Author Share Posted May 28, 2019 took my old cd and it booted... to screenshot. any ideas on those? Link to comment Share on other sites More sharing options...
itman 1,668 Posted May 28, 2019 Share Posted May 28, 2019 (edited) 2 hours ago, mike4 said: took my old cd and it booted... Wind.exe is a PUA: https://www.bleepingcomputer.com/startups/wind.exe-6367.html My best guess is it was preloaded in the Hiren's boot cd .iso file in one of the included programs/utilities. -EDIT- I am assuming that your hard drive was disconnected when this scan was run? Edited May 28, 2019 by itman Link to comment Share on other sites More sharing options...
Recommended Posts