Here is my horror story that I thought I would share to see if one had any great suggestions and maybe would be interested in researching my problem because it is very fascinating. If you are interested in looking at my problem I am happy to do a share screen. If you do discover the exploits this malware uses you would probably make 40k in bug bounties alone on top of my 1k.

Edit:This might seem implausible and but I would happily introduce you to my friends who were also infected if you need be if you do not believe me.

Description: I have a very bizarre malware that I get on any computer if I play a song from an infected computer or I open up my email or even sign into my email. Wiping the drive does nothing. I have gone to the genius bar, geek squad and they could not help and I have spent thousands trying to fix this.

I have installed different operating systems Ubuntu, Windows and OS X on different systems and the malware remained. I think what I have is rootkit that turns into a boot kit as soon as I make a significant change in the OS such as upgrading to a different version. On one protective PC desktop (probably the best one), after I got the malware again I tried the factory rest on the PC. What was bizarre is after the computer restarted the computer said “A request has been made to change keys to the firmware” at the boot up screen with white letters and a blue background. I selected “no” between the two choices of yes or no. This was the only time of all the many computers I have tested that after the factory reset, the computer did not still have the symptoms of the malware after the reset. Typically the sound quality, visual quality and speed become worse after a reset with the malware actually.

I have gone through various computers and even infected friends computers on accident, so this has become a very heart breaking problem.

To test whether it really exists and that I am not just making it up is I tested the two main infection methods on the computers at Best Buy. As soon as I either played a music file I made from an infected system on a clean system things became different on the clean system. The computers became a little slower, the sound of the computer both became warped and sharp sounding. You could say distorted. If you logged into an email that I used on an infected computer the same thing generally happened, but to a lesser extent. I did learn I have a rootkit called Linux/Ebury on my main computer, but I can’t prove if it is related for sure. The other bizarre thing is the sound quality and volume of the computer then changes throughout the week and it seems nearly like a timed cycle. I cannot watch movies or anything on infected computers because the sound becomes so bad.

It sounds like this thing was created in a lab because the only similar malware I have heard of is Bad USB and a couple others that seems to be able to infect any system. I personally believe the malware gains access to my firmware on the motherboard and changes keys related to the sound through out the day. I call it a “sound cycle.” The volume changes significantly and the quality changes slightly throughout the week. If for instance when I have apple completely wipe and reinstall my mac, what is interesting and telling is the Macbook stays in the “sound state” it was right before I wiped it. The sound cycle seems to stop and the “sound state” becomes static. However as soon as I either play a song or movie created from the old system or log into my email, the cycle continues again. I have tested this 5 times to make sure.

I could go on about my research and my struggles, but I really just don’t know what to do to fix this problem other than maybe completely getting a different identity with new email accounts and what not and tossing my old computers. However that would be incredibly expensive and if I slip up and have the malware come back it would all be for nothing. I need to figure out a way to a 100% prevent it.

  • Could you specify a clear question? – techraf Dec 28 '16 at 3:16
  • Sure, can you help me get rid of this issue? – BillTheMagnificient Dec 28 '16 at 3:36
  • 2
    I'm voting to close this question as off-topic because this does not provide enough information to figure out what's really going on. The questions consists of a few observations mixed with strange explanations. But probably lots of information are missing and the reported observations might be warped but the explanations the OP already has. Also, if the OP really has spend thousands already and is willing to spend more than why not simply burn the infected system and buy a new one? – Steffen Ullrich Dec 28 '16 at 6:43
  • 1
    To me it sounds like there are no actual symptoms that would be best explained by a virus. – Anders Dec 28 '16 at 8:03

Your observations aren't plausible from a technical perspective.

Your malware spreads via audio files. Malware can't be arbitrarily "attached" to a file. Rather, a malicious sound file would work by triggering an unpatched vulnerability in a sound driver / media player program.

Your malware infects different operating systems on different machines. It's implausible that any malware would be able to exploit audio software on all these systems at once... and then attract attention by distorting your sound.

There could be electromagnetic interference at play or simply a malfuction of the sound card or speaker.

| improve this answer | |
  • I have done research of situations where code has been activated into a working picture or audio file. picateshackz.com/2015/02/… The technique to do this in an audio file is very similar, although is very rare. – BillTheMagnificient Dec 28 '16 at 2:48
  • The other thing like I said that is happening is the rootkit, Linux/Ebury was found on my current system and I tested for false positives and the rootkit does exist. But aside from that this malware likely came from pirated Music Software, similarly to how BMI had a rootkit for sharing their music files, I think this is similar from a Music company. – BillTheMagnificient Dec 28 '16 at 2:53
  • I am well aware of the implausibility or else this would be much easier to figure out. I shouldn't say it is the exact same if I install a different OS. But the sound state that it was before I installed the system is stuck in that sound state till I either play a music file or log into my email. – BillTheMagnificient Dec 28 '16 at 2:57
  • When I got the malware 3 years ago the electromagnetic interference was my first guess actually. I tried many different techniques to try to stop it and with no success. I also have traveled to 4 states, had roughly 14 computers and all have seem to have gotten infected eventually. I wish I could show you the sound quality on all 4 of my current computers. I would be happy to send you an audio file and you can see if I am lying. :) – BillTheMagnificient Dec 28 '16 at 3:04
  • @Eric Feel free to upload the audio file somewhere and link it. Nobody is suggesting you're lying, just that you're drawing the wrong conclusions. – Arminius Dec 28 '16 at 3:06

If this is a bootkit and it's hooking your IO, you need to run this in a virtual machine on a non infected system.

Take a clean machine running a linux VM, download the audio file, attach a debugger to the process that loads the audio file, run it and load the file. Check whats going on in the registers etc.

You mention it effects audio files that you created? This would have to be done after the file has been created. You could use inotify on a newly created file.

If it is a bootkit hooking the IO it could simply be distorting the incoming audio stream. Have you tried sending the audio to a bluetooth speaker? This could help determine if its effecting the audio system if the bluetooth audio remains clear.

The other thing would be to have a copy of some audio file that hasnt been infected and check the spectral content with the same file that you think has been infected. Diff the spectrograms.

If this is a real virus, from what you described with persistence and firmware issues, it's more likely the bootkit that is manipulating the audio below the kernel level, rather than infecting other machines via audio files. Unless the audio files were downloaded onto different machines. If the infected machines got the audio via usb device, thats more likely how its spreading.

| improve this answer | |
  • Great answer, I appreciate you taking your time and coming up with these creative diagnostic solutions. I am going to try your bluetooth speakers/headphones idea as well as analyze the spectral frequencies. I am also going to get a clean computer and test out the linux idea. This was the first answer I read where the diagnostic ideas were both creative and definitive. I really appreciate your help. If I can find the bug I want to compensate you for your help. – BillTheMagnificient Dec 29 '16 at 1:47
  • Is there a way I contact you outside of stack exchange, so I can give you the results of the diagnostics? It seems the folks at Stack Exchange think my question is too broad. – BillTheMagnificient Dec 29 '16 at 1:50
  • As this is a technical site, the question would be better off with actual data of the malware at work e.g. debugger screenshots or a file diff of an original and infected sound file etc. Im just stating that it could be a bootkit. Why anyone would write a bootkit just to degrade your audio, I doubt it. Bootkits are pretty much the holy grail of malware. If it is a bootkit, I would immediately get another machine and dont connect an infected usb or external drive to it. Test in a clean VM beforehand and do the same steps you did and set inotify or another tool to give you alerts on the files – jarryd Dec 29 '16 at 12:54
  • You also mention that simply logging into your email client from another machine leads to infection. That's pretty much impossible, bootkits usually need droppers. Check this out if you want to know more on the low-level workings of bootkits etc. nostarch.com/rootkits – jarryd Dec 29 '16 at 12:55
  • I would get that machine off of your network. If you need it for some remaining transfer to a new machine, then I would arp poison that infected machine and monitor its network traffic or use some sniffer. – jarryd Dec 29 '16 at 13:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.