BIOS/UEFI I think i have some sort of rootkit

lagigolo

lagigolo

VIP Member
VIP Member
Joined
Dec 26, 2006
Messages
1,054
Reaction score
121
Location
Upstairs at Erica's
I noticed the other day my lsass file had been modified. Started looking at the pc and it seems the bios has been rewritten.

It seems like the files its protecting are in the bios and its not really letting me boot from cd first. It pretends too, but any recovery stuff always comes up with errors or out of memory.

Any ideas or anybody come across something like this? I currently can't boot into windows as there is now a problem with the bootmanager and it won't let me reinstall or use any programmes to get it back. The original install disk it now says doesn't match.

I have tried linux discs too, but again fobs me off with fake loaders!!!
It won't let me delete anything, or modify anything, it keeps rebuilding itself. Although i managed to mess up the bootmanager somehow.
 
Sort by date Sort by votes
How would i do that? It now boots up to windows is missing boot manager press ctrl alt delete. Then if i put windows 7 dvd in, it won't repair, it won't install, its just stuck. It won't even let me load a live linux dvd to get on the internet with.

Even with the hdd removed bios stays the same, so its not the hdd faking it. Tried removing bios battery but it won't boot without it in.
 
Upvote 0 Downvote
I'd try BIOS update from USB if you can.

Can you get into the BIOS/UEFI? If I remember right some have a mode to emulate old style BIOS.
 
Upvote 0 Downvote
i can get into the bios. Do you think a setting has changed into old style bios? If so what would i be looking for?

Its an amibios, so not many settings in there.
 
Upvote 0 Downvote
lagigolo said:
i can get into the bios. Do you think a setting has changed into old style bios? If so what would i be looking for?

Its an amibios, so not many settings in there.
Click to expand...

I was wondering if anything was different in old style BIOS emulation mode.

What board is it?
 
Upvote 0 Downvote
What led you to see that BIOS files have been re-written?

BIOS is held on a EPROM type chip (maybe something similar nowadays) and retains date/time and some settings by use of CR2032 BIOS battery.

With Win7, you need to use CSM mode (legacy mode) and can you use hiren's bootCD and boot from that? This would then give you option of replacing boot table or using it's own one to see if you can then boot normally.
 
Upvote 0 Downvote
I was using hirens bootcd to nose around, it was this that let me look at some stuff. But again its only partially working. I did read one file on my pc which actually talks about creating fake copies of iso's and loading it from hard drive and pretending its booting from the dvd drive. It even quotes "Hirens" would be good to do this with, which is what i think is happening.

I will have another look at the weekend and get some more details.

It would be good if we could fix this as this was my best pc.
 
Upvote 0 Downvote
I have tried disabling/enabling loads of different things in bios. But still no closer.

I do see something flash up on the screen before hirens loads up. One is something about pxe stack, the other is just too quick to read.

I can't reload windows 7 as it says its wrong version.

I am now thinking go for a windows 10 download. Can i download an official windows 10 iso? Also can i get the details i need for activation from a file on my pc so i can put the activation code in at the end or the beginning? Can it even be done this way?

I will need to burn this iso from another pc.
 
Upvote 0 Downvote
I think it would be very rare to have a virus actually infect the BIOS region unless it's a very old computer. Most modern chipsets have BIOS virus protection, and it would have to have written itself at least checksum before flashing if not a lot more to defeat antivirus countermeasures.

This might sound dumb, but have you run Memtest on it? I mean for a long time, not just one or two good passes. Load tested your power supply? I've had PCs to really weird things when RAM was intermittently flaky, including Windows running perfectly but refusing to install or boot from CDs.

I've also seen random crashes from dirty power on a flaky power supply. Things would work find and then crash or throw odd errors, access violations, just weird random stuff.
 
Upvote 0 Downvote
2 solutions you have in my opinion and very easy to rectify :)

solution 1 (extreme)

Boot a live kali distro from usb, once in the live OS run online house call and a root kit analyser

irradiate anything you find !

solution 2 Easy

create a windows 2 go image on a usb stick

load windows 2 go download the latest bios f/w from manufactures website update bios from windows end of.

i dont personally believe its your bios more than likely your ram i agree with Hexadecimus

bios (uefi) can be affected but its rare

cheers

wattsy1612
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

B
old versions of uk info disk
2
Replies
24
Views
3K
D 8 RCS
D 8 RCS
silverdale
  • Question
Admin rights issue
2
Replies
20
Views
3K
alimac
alimac
Dutcho
  • Question
BIOS/UEFI Acer Nightmare
Replies
8
Views
999
Dutcho
Dutcho
trevortron
Wifi problem - internet or not?
2
Replies
21
Views
923
ceco_valchev
C
M
Windows 8.1 AIO x86/x64 FR pre-activated + office16 pre-activated + 7 softwares + 239 updates
Replies
0
Views
4K
mehdibleu
M
Back
Top