1

Someone, have no idea who, really worked my computer, and placed some rootkit, all-knowing, all-smashing malware something and I simply cannot keep Windows OS clean in a multiboot configuration with Ubuntu even after removing MBR, deleted all partitions and partition table, and reinstalled Ubuntu with Grub only, and no MBR.

The symptoms are, for the Windows part, that group policy rules are changed soon after establishing the internet connection and reboot computer. Local System is replaced by either SYSTEM and/or SERVICE and I can no longer find Local System when trying to restore the defaults, and it goes on like this with other locations/services, and I also find a lot of unknown executables inside the windows root folder, and system32 also with only one or two reboots after a fresh install of windows. When trying to install antivirus software I experience some delays, and only the firewall is able to block part of the unusual network activity.

Several attempts to reinstall Windows after installing Ubuntu were pathetic, I always seemed to get stuck to some point where the ugly malware rootkit something showed up and started doing its business as usual. I feel like being haunted and have no idea what to do or whether this nasty pirate is able to track me, and somehow infect my system again.

On top of all these, I recently noticed BIOS not being able to set time precisely, it is always a few hours backward. Is there anything I can do to erase this malware or to prevent further attacks? I've tried them all, antimalware, antivirus, antipirate software, and with very few results. I was thinking to delete all data on hard disk again, format and delete new MBR left from previous windows installs, and start it over using some Ubuntu Live Cd. Or maybe change my hard disk or what?

This is a new entry in my post as requested by user @mgjk who asked me to describe my problem with more details

As requested by @mgjk in his reply, I have to describe my problem using more details, and to be specific I think it is mostly about a virus described on this page, a virus/malware known as Trojan:Win32/Spyeye which may be, among others, related somehow to Systray .exe stub file usually located in /windows/system32. They say most AV software won't detect it, and I did try many solutions to eliminate it with no results.

I usually run WinXP, it is compatible with my ancient Dell machine. As for the specific symptoms, I sometimes could not have access to right-click menu commands in Windows, they were present but did not activate, or the taskbar did not show any of the open windows/apps, instead they were present on top of taskbar as if they were shrinked, and when it got really ugly I could not have access to most usual commands like stopping a process in Task Manager, using Regedit or editing system rules and policy using Gpedit.msc tool.

As already told in a previous comment, my ISP told me to install Kaspersky AV, latest release, and after first reboot I got yet another thingy on my Windows, which is known as das boot virus or something like that. Great idea, what can I tell, use Kaspersky to get rid of Spyeye. I should have known better.

  • 6
    Just wipe the disk and start over. – Polynomial Oct 26 '14 at 18:46
  • 2
    upgrade the BIOS, use a live CD to wipe the HDD, change your public IP address if that's the way he tracks you, use a decent anti-virus and make sure your OS is up-to-date. According to you he is a kid NOT NSA so the above should be enough – Ulkoma Oct 26 '14 at 20:07
  • 5
    Are your sources clean, where did you get Windows from, did you get Ubuntu from Ubuntu's website, did you check the checksum? Is it possible upon connecting to the internet Windows Update installs updates which is changing some of your setting? – Brian Duke Oct 26 '14 at 20:09
  • 2
    If a rootkit was installed, it's possible he's not tracking you but that the infection is not cleaned yet. You need to do what you yourself suggest - reformat and wipe the MBR. No big advice here. – schroeder Oct 26 '14 at 21:08
  • 2
    Make yourself a Linux live-CD using a clean machine (a friend's PC for example), then boot from it and wipe the disk using dd if=/dev/zero of=/dev/sdX bs=1M. – user42178 Oct 27 '14 at 14:17
5

A totally different angle on this would be to step back and consider your analysis.

  • You have a hypothesis that your machine is infected with malware.

  • You are collecting evidence through your attempt to build the machine into a dual boot configuration.

To determine if it is true that you have malware, you'll need to come up with a test of this hypothesis. The test might be to demonstrate well documented behaviour which cannot be explained by experts on the OS, or well documented behaviour which cannot be reproduced. I personally document this stuff with pen, paper and a camera.

You performed some installations and have observed unusual results, but your observations aren't well documented (at least here).

  • "Windows OS" - What version of Windows?

  • "A lot of unknown executables" - Do you have a list?

  • "Local System is replaced by either SYSTEM and/or SERVICE and I can no longer find Local System when trying to restore the defaults" - where? how did you check?

  • "When trying to install antivirus software I experience some delays, and only the firewall is able to block part of the unusual network activity" - what unusual traffic did you detect? How long are the delays? when do they occur?

  • "I always seemed to get stuck to some point where the ugly malware rootkit something showed up and started doing its business as usual" - When do you get stuck? What prevents you from continuing?

Having precise information about any one of these unusual behaviours could help. There may be a non-malware explanation for the problems, or you may document behaviour unique to a very specific bit of malware.

Regarding your clock: Setting the clock back a few hours in the BIOS sounds like normal multiboot behaviour. Some OSes store the time zone as UTC, some store it as local time. This is usually only noticable in a dual boot configuration See further: https://superuser.com/questions/185773/does-windows-7-support-utc-as-bios-time

You can test the theory by booting to one os, checking the time, shutting down, checking the time in the BIOS, then repeating for the other OS. If you can resolve the issue or influence the hours by changing the way the OS stores the time or even the time zone in the OS, then you have pretty good evidence that you've identified the cause.

  • I usually run WinXP, it is compatible with my ancient dell machine. Here it is, a decent web address including a description of what I believe it is all about. As for the symptoms, I sometimes could not have access to right-click menu in Windows or the taskbar did not show open windows, instead they were present on top of taskbar as if they were shrinked, and when it got really ugly I could not have access to most usual commands like stopping a process in Task Manager or editing system rules and policy using Gpedit.msc application. – Taz D. Oct 28 '14 at 14:46
  • Already solved the clock problem, googled it and found out that Ubuntu sets clock to UTC as default. There is a workaround, and I followed it, and for most of the time BIOS clock and Ubuntu clock are syncronized. – Taz D. Oct 28 '14 at 14:49
3

It might actually be worse than the comments suggest. Example: If you are on your own home network, is it possible that other machines in your network are infected? If they are, that would explain the persistent re-infection after wiping and wiping and wiping and wiping. That being said. . .

Step One: Isolate all of the machines on your network. All of them. Do not let them talk to each other or connect to the internet, or anything.

Step Two: Get a CD that you can boot from.

Step Three: Boot a machine with your CD, connect to your home router and firewall off all incoming traffic. All of it.

Step Four: Boot the machines with your boot CD, find out if they are infected, wipe the disks and the MBRs, and start fresh.

Repeat ad nauseum until it's dead. Grind it into oblivion.

EDIT: Also, you might want to check any external storage for malware. Just to be safe.

  • 1
    Just one computer, no router,only cable. My rescue CD/DVDs already present, they proved to be useful in the past when experienced similar issues (viruses, malware) but this time is different, I am dealing with a pro, and I am no match for him/her. Recently, had an argument with a guy running unlocktheinbox site (about using adblock on his site), and he sent me a "violent" email which could have triggered the symptoms. Another argument with some guys from wilderssecurity forums (clamwin related), where my browser experienced too many hangs and freezes when logged in so who knows who. – Taz D. Oct 27 '14 at 20:36
  • 2
    Either way, they have to be compromising your machine externally. When you do a fresh installation, your system doesn't have any of the updates necessary to close a lot of the security holes. I would recommend getting a home office router so your machine doesn't have an internet-exposed IP address, and like I said before, firewall off all the incoming traffic so the attackers cannot exploit the security holes while you are updating your system. – Desthro Oct 27 '14 at 21:01
  • Great piece of advice with the home office router, I only have to google to find out how to properly firewall off all the incoming traffic. I looked up for the prices, and it is somewhere around 20 bucks. For now, I just followed some guide present on this page to learn how to secure my ubuntu system. – Taz D. Oct 28 '14 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.