Rootkit help me

Hey,guys as topis says i have some bootkit that remain after hdd format.
I’ve tryed also to flash the BIOS.
But with the same results.
Any suggestions ?

Some basic info would be good to add to the first post:

  • How do you know there is a rootkit?
  • Provide some good info
  • How have you reformatted the HDD?
  • How have you tried to flash the BIOS and what where the results?
3 Likes

I’m facing those things :

  • someone has changed my settings and just control my pc
    -my mouse is moving on my desktop without i touch it
    -some of my account passwords has been changed
    -also someone can close my apps and games

I reformatted my HDD with a slow formatting (Gparted).
I flashed my BIOS with the BIOS settings (Qflash) before system starts.

Still not alot to go on but:

  • disconnect the machine from everything
  • make sure your backups are safe
  • make sure you have a backup to access online accounts: eg a 2fa option with phone / One Time Key’s / sms .
  • reinstall from a clean safe medium and connect to a network you trust, install all updates and:
    • this site lists a few rootkit scanners that could help you scan from malicious activity
      chkrootkit & rkhunter are in the repositories to check for a rootkit.
    • clamav linux virus scanner
  • do you have some remote management software running that is being exploited?
  • do you share the network with others who might have the same issue?
  • do you enable services on your machine that are being exploited?
  • do you have simple username password combinations that can be guessed that you use locally?

If you have the suspicion you are being targeted specifically. Talk to somebody you trust and ask advice on what next steps to take.

I done the formatting with disconnected pc.
I checked my pc with few boot disk anvirirus.
At the four questions all nope.

you need to start at the top of your network & work your way down.
reset & change your router password. it’s the first point of entry.
check it’s firewall settings.

how many computers on the network, they might have control of another to attack you from within.