0

I posted three messages regarding my computer being compromised. I was advised to reinstall everything, because it's nearly impossible to figure out how the hack was done. I reinstalled, and almost immediately, after two or three days, my computer was compromised again.

My harddrive is split (partitioned), into "C" and "D". I, of course reinstalled again on "C" and left "D" untouched. Could I have a "boot trojan" of sorts that gets activated when I start the computer, from "D"? Is the harddrive still "one", even though it's partitioned?

  • What did you do in those 2 or 3 days? If you install the same malware because it's inside a program you use. Then that might be the problem. Do you have software from dubious sources? Do you launch software from the D drive? – Silver Dec 21 '16 at 10:27
  • No dubious sources. My D drive contains nothing i use, it was just partitioned like that when i bought the computer; there's only some old games i never play, so nothing was activated from it. My question was if D is part of the "booting drive"..i mean technically it's one big drive, just partitioned? Is it possible something activates from D at booting, like a mini virus or something giving the hacker possibilities..etc? Sorry i'm not very technical or good at this. – Dave Dec 21 '16 at 10:44
  • Sound like an advance attack if it is possible. I don't know if it is possible and what is required. Let's see if anyone can elaborate. Even if it is possible I would still look at other possible sources of the problem. I've found this forum cnet.com/forums/discussions/… Try googling on 'malware surviving reformatting' it seems possible. – Silver Dec 21 '16 at 10:51
  • When you reinstalled, did you use a disk provided by the computer manufacturer, or was it through a hidden partition on the drive? Also, did you choose the "reformat and start fresh" option (may be named something else, often "advanced mode" or other scary things) or the "reinstall Windows but keep files" option (also may be named something else, often "safe reset" or other less scary things)? – Matthew Dec 21 '16 at 11:24
  • It was an image file done when the computer was bought, by the guy that sold it to me. I restored that image, wiping C when doing so. – Dave Dec 21 '16 at 11:40
2

Based on the information that you've provided and your comments, I'd guess your problem is one of the following (arranged in decreasing probability):

  • Your D:/ Drive contains malware - You mention that there is nothing of value in that partition, but you've not wiped it since the day you got it from the factory. Some systems come with auto backup software that backs up to that disk, and I'd guess that your previous OS backed up an infected file which is again working its magic.

  • Infected reinstall media - You're using a backdoored image or it was tampered with after you created it.

  • Bootsector virus - As Hacktiker said, but less common and less probable.

  • Thel3l, i don't believe my sytem has any auto back up software. I should also mention i disabled the Wifi since reinstalling, because apparently that's the most common entry route. So what am i doing wrong? I should also mention i also have an external HD, but that mostly contains movies and the such. – Dave Dec 22 '16 at 9:55
  • @Dave - Your current system may not have any of that bloatware, but I'm talking about your system prior to re-installation, straight out of the factory. If it had two partitions and was from any major vendor, chances are that it had some sort of auto-backup software from the vendor installed onto D:\ Additionally, if you're using the external HDD across reinstalls, there's a good chance that you copied over some malware onto it. You honestly wouldn't even know- it could be a backdoored executable or embedded in an image. – thel3l Dec 22 '16 at 10:07
  • What you're currently doing wrong is using some non-cleaned hardware across re-installs. Scan your files with some AV (pshaw.) or just wipe everything and start again. If you're not willing to lose all that data, manually load each file into a sandbox or a throwaway system and execute each file until one of them triggers the virus again. – thel3l Dec 22 '16 at 10:11
  • Thel3l, the main HD was partitioned by a friend, it didn't come partitioned from the factory. Also, i did Anti Virus scanning, and Malware scanning, and nothing came up(what is pshaw.??). I don't know what a sandbox is or how to do all those things, and yes, losing all date is not an option. Thanks. – Dave Dec 22 '16 at 11:51
  • @Dave : Going from what you're saying, are you completely sure that you have an infected PC? What are the symptoms that you see that lead you to this conclusion? – thel3l Dec 22 '16 at 15:38
0

A hard disk drive (hdd) contains a boot sector, which contains information needed to start your operating system. Furthermore, it has a partition table that contains the locations and sizes of your partitions, and of course the partitions itself.

There exists malware that infects your boot sector [1]. This malware would not be affected by you formatting a partition.

To get rid of this type of malware, you would need to rewrite your boot sector which is usually done by the installer of the operating system.

[1] https://www.sophos.com/en-us/threat-center/threat-analyses/threatsaurus/a-to-z-of-threats/b/boot-sector-malware.aspx

  • Hello Hacktiker, i used an image file made when the computer was bought using CloneZilla. That replaces everything on C but leaves D unaffected. Would that wipe out the boot sector? – Dave Dec 21 '16 at 11:50
  • That kind of malware do exist, but it is not very common. I would bet my money on some other explanation (like reinfected from installed software), but I agree that this is a possiblity. – Anders Dec 21 '16 at 11:52
  • So Anders, if it's not a boot sector malware, then what am i doing wrong? The image i used to restore C was clean. – Dave Dec 21 '16 at 11:57
  • I am not into the specifics of CloneZilla, and do not know whether it does restore the boot sector when restoring the C:\ partition. I agree that a boot sector malware is less likely than the other possibilities mentioned by @thel3l. – Hacktiker Dec 21 '16 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.