Solved Virus remain after format [Moved by Staff]

[icotonev]

In fact, I now see that in 2022 you had the same problem:

Advice Request - How can malware remain on PC after I format my HDD?

How can a virus remain in the system after formatting the whole HDD? What are the types and how to remove them? I'm asking because my pc is infected with fully undetectable remote access trojan. Who remain after re-installation on my operating system.(with media created on clean pc of course)...

malwaretips.com

Are you kidding me..? Already two years ago, they explained to you how to proceed... Why are we dealing with this problem again now..
From the logs you provided for me, there are no indications of malware in the system...!

 

[Strike]

Ok,but please don't close my topic.
Maybe someone can help me with my issue.

 

[icotonev]

Modedit: I ve moved the thread from "Windows Malware Removal Help" to the "General Security Discussions" forum so others can join your thread and help.

 

[roger_m]

Ok,but please don't close my topic.
Maybe someone can help me with my issue.

I'm curious as to what makes you think that you have some undetectable trojan on your computer? I just looked at your original thread about this from two years ago and when I look at the VirusTotal link you posted and it shows that the file you uploaded is clean.

VirusTotal

VirusTotal

www.virustotal.com

Quite possibly when you first scanned it, one or two scanners detected some malware. However some of the lesser known antiviruses and AI based scanners, have lots of problems with false positives, whereby they often identify clean files as being malicious. I can only presume that the file was detected as being malicious due to false positives, which have now been fixed.

 

[Strike]

I'm curious as to what makes you think that you have some undetectable trojan on your computer? I just looked at your original thread about this from two years ago and when I look at the VirusTotal link you posted and it shows that the file you uploaded is clean.

VirusTotal

VirusTotal

www.virustotal.com

Quite possibly when you first scanned it, one or two scanners detected some malware. However some of the lesser known antiviruses and AI based scanners, have lots of problems with false positives, whereby they often identify clean files as being malicious. I can only presume that the file was detected as being malicious due to false positives, which have now been fixed.

I'm sure it's RAT, because i still fighting with the infection more than 2 years.
Well,it seems the MBR is clean.
But,i'm not sure where exactly it remains..
The problem is that i still don't have any firewall/av detection to proof it.

 

[Brahman]

1. Install yogadns. Run it in Windows Service Mode ( since this will enable yogadns as soon as the windows starts and there will not be any dns bypass) with nextdns doh and enable logs. Now you can see all your dns queries your system makes and check for any unusual address in logs to prove or disprove your RAT theory.

2. Or you can use A Mikrotik router, connect your system to it and use " torch" function to analyse out going traffic and it will look like this.....

 

[oldschool]

@Strike I believe you need to seek professional psychological assistance outside of the forums.

 

[Strike]

@Strike I believe you need to seek professional psychological assistance outside of the forums.

LOL

 

[oldschool]

LOL

This is no joke.

 

[brambedkar59]

I'm sure it's RAT, because i still fighting with the infection more than 2 years.
Well,it seems the MBR is clean.
But,i'm not sure where exactly it remains..
The problem is that i still don't have any firewall/av detection to proof it.

How do you know that your system is infected with a RAT or any other type of malware?
How did you rule out any hardware issues?

 

[Trident]

RAT persisting a reformatting of the hard drive is very unlikely. Attackers change tools, tactics and techniques, as well as CnC server, so using the same malware for 2 years is unlikely as well.

Do check for bios updates using your PC/Laptop manufacturer website tools and flush the UEFI firmware. Simultaneously with that, reformat the hard drive. Be very cautious about pirated software from Zamunda (Bulgarian torrents) and similar websites. Only install reputable software from trusted vendors.
It may be that something you download from dodgy sources has been repacked to include a RAT. Upon reinstalling, you download this software again and this is how your device gets infected.

I highly recommend that you take the device to a specialist which in Bulgaria will be walking distance away in major cities and won’t cost you more than 50 BGN, roughly equal to 25 EUR. They will have the necessary experience to diagnose the PC and will also let you know if it is a hardware problem. Slow device doesn’t necessarily mean infection is active.

@Brahman , DNS monitoring will be bypassed in cases where malware communicates directly to IPs (no resolution needed). For traffic monitoring, it will be better to use WireShark or some form of IPS like Suricata/Snort with the appropriate signatures package.

 

[R3j3ct]

WOW, alot of great advice on this issue but it's still happening years later? The only thing i haven't seen asked yet is, do you have a wireless mouse? If so how many? How close? Just a thought!

 

[Shadowra]

I'm sure it's RAT, because i still fighting with the infection more than 2 years.
Well,it seems the MBR is clean.
But,i'm not sure where exactly it remains..
The problem is that i still don't have any firewall/av detection to proof it.

RAT or other malware cannot remain on a system after formatting...

If you are infected, it's either the network (as is the case with Emotet, for example) or a device other than the computer.

And if you really were infected, I think @icotonev would have seen it....

 

[Brahman]

 

[Strike]

Ok,guys some of you is thinking that i just post threads to waste people time.
Is there any

RAT or other malware cannot remain on a system after formatting...

If you are infected, it's either the network (as is the case with Emotet, for example) or a device other than the computer.

And if you really were infected, I think @icotonev would have seen it....

I'm not an security expert or something,but those viruses are very rare and exist ofc.
They are called bootkits.

 

[Shadowra]

Ok,guys some of you is thinking that i just post threads to waste people time.
Is there any

I'm not an security expert or something,but those viruses are very rare and exist ofc.

No one said you make Threads to waste time.

Only, a persistent RAT after formatting is IMPOSSIBLE.

Attackers regularly change their attack strategies.

The only persistent thing is either a network infection (as I said) or an MBR infection (but @icotonev would have seen that too, and told you you weren't infected).

Then again, I've never seen malware that's been undetectable for 2 years.

 

[simmerskool]

??

Glupteba Botnet Evades Detection with Undocumented UEFI Bootkit

Glupteba botnet has been found to include an undocumented UEFI bootkit feature, enhancing its stealth and persistence capabilities significantly.

thehackernews.com

 

[Moonhorse]

i would just buy new drive or completely buy new device and enjoy my life, instead of spending 2 years to solve such issue

You have done right way , and you have gotten help you needed, if you think something still persist in there i dont think theres many ways to solve issue anymore

take care

 

[Strike]

i would just buy new drive or completely buy new device and enjoy my life, instead of spending 2 years to solve such issue

You have done right way , and you have gotten help you needed, if you think something still persist in there i dont think theres many ways to solve issue anymore

take care

You are right.
Btw guys i don't think that hacker will spy on home pc with 2 games