1

can any sort of malware/ rootkit still be on my computer after a factory install? my dell inspiron running windows 7 had(maybe still does) some sort of malware (a rootkit maybe) at its worst point it had complete control over my computer.i use malwarebytes premium, Microsoft security essentials and microsoft malicious program removal tool. all of which would come up with nothing after a full scan. but my wireless adapter would not let me connect to the Internet but I'd still see connections in and out from my computer, the only thing that stopped that was disabling the adapter from my bios. services, processes i couldn't suspend or stop. programs with strange or no name i could not uninstall or keep from reinstalling. files/folders i couldn't view or alter. extra hidden users with admin privileges i'd remove one and before i could turn around there'd be another one in its place. So i did a factory install of windows 7 home premium(with a new windows disc that dell sent me) and almost right away i started seeing some of the same strange processes and connections to ip adresses i wasn't going to.

3
  • Yeah I've seen that too. Found a Rootkit after client had done factory reset. Also there are BIOS based viruses but that is too rare. So your best chance is get a disc and format the HDD then reinstall
    – clhy
    Dec 22, 2015 at 2:26
  • There are also firmware rootkits, like GPU's and so on. Firmware rootkits are usually impossible to repair, so you have to toss the offending piece of hardware.
    – Moab
    Dec 22, 2015 at 16:31
  • how do i go about checking for these rootkits?
    – SMI2LE
    Dec 22, 2015 at 22:54

1 Answer 1

1

Wikipedia's article on “Host protected area” says “Some NSA exploits uses HPA[5] for application persistence.” Based on that statement (assuming that was is written on Wikipedia is actually true), this would mean that devices have been infected, allowing malware to persist even if the entire hard drive's normal data area is wiped. When the device is started up, during the time when the BIOS tries to communicate with various hardware, even before the operating system loads, the device firmware could execute malicious instructions that may subvert even the process of wiping a hard drive and then re-installing the operating system.

The "Host protected area" can contain sectors that a hard drive may use to remap bad sectors into. This may be a section of the hard drive that is only accessible through specific software, and is typically not accessible by most software typically used (as part of an operating system). For instance, although hdparm might see this in Linux, common software like fdisk might be completely unaware of this disk space.

Anti-Virus software might be rather unlikely to detect such things, since such interaction with hardware might be rather specific to hardware models. That means that there might not be a universal way to perform a standardized check for such problems. That may be why Mikko Hypponen, from the F-Secure anti-virus software, discussed "a spectacular failure for our company, and for the antivirus industry in general." "The truth is, consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets." (Source: Wired: Why Antivirus Companies Like Mine Failed to Catch some malware)

So, can it happen? Absolutely. Is it happening? Experts seem to indicate that this does happen in high profile situations where governments are willing to invest serious resources into making things like that happen. How often does this sort of thing happen with more widespread malware that is likely to affect an end user's system? That answer may be quite hard to tell, but some abilities tend to spread over time, as software gets shared and additional malicious people keep learning. The capabilities being used by active thieves improve, causing the correct answer to be gloomier next week compared to the situation from last week.gloomier than the answer last week.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .