0

Background:

I have a very persistent malware problem I am unable to remove, even with a full disk *disk wipe and re-install. I believe the malware is either residing in an inconspicuous location on my storage drive or in the firmware on my motherboard.

 *Disk wipe includes removing all partitions and performing a low level format with programs such as Gnome Disks, GParted, Parted, FDisk, SFDisk, FDisk (Dos version), Diskpart (Win 10), ActiveKilldisk, DBAN, Partition Magic, Partition Mini-Tool, etc.  

Pre-Actions:

After booting to live Ubuntu USB, I opened the "Gnome Disks" program and deleted all the partitions on the disk in question, then rebooted.

Actions:

After I use the fdisk -l command from a live Ubuntu USB to list the partitions on my storage drive, I get the output listed below.

Disk /dev/sda: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 974E0A83-A8F5-426A-9C6F-3875011C574E

Device     Start   End Sectors Size Type
/dev/sda1     34 32767   32734  16M Microsoft reserved

*Partition 1 does not start on physical sector boundary.*

After deleting partition one and issuing a print command, I get the following message.

Command (m for help): d

Selected partition 1
Partition 1 has been deleted.

Command (m for help): p
Disk /dev/sda: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 974E0A83-A8F5-426A-9C6F-3875011C574E

Command (m for help): d

*No partition is defined yet!
Could not delete partition 93960418819865*

Command (m for help): 

Questions:

Primary:

Can someone please explain why and how to correct the messages "Partition 1 does not start on physical sector boundary" and "Could not delete partition 93960418819865"? According to the output, I just deleted all partitions, so partition 93960418819865 shouldn't exist.

Secondary:

What is partition 93960418819865?

closed as unclear what you're asking by Ramhound, bertieb, Pimp Juice IT, music2myear, DrMoishe Pippik Jul 30 '18 at 16:37

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    It appears you found a bug in fdisk. It may be using an uninitialized variable. // Please provide the output of fdisk -v. – Daniel B Jul 24 '18 at 18:43
  • Well nevermind, it is use of an uninitialized size_t. As such, you may safely ignore the large number. – Daniel B Jul 24 '18 at 18:57
  • Instead of mercilessly re-wiping the disk, change for another disk and see if the malware returns. This said, what makes you think you have a malware looming (and not a mere software bug/hardware problem)? Did anyone else confirm this? – xenoid Jul 24 '18 at 19:39
  • I have replaced, storage devices, motherboards, networking equipment and even complete computers, only to the new equipment re-infected. I have worked extensively with Malwarebytes, and other big named anti-malware companies over the course of 18 months but get the same result of being told I need someone that has can be physically present to analyze the issue. – user919501 Jul 24 '18 at 20:15
  • 2
    So, now that we dealt with the fdisk strangeness, you should probably explain (in your question!) what makes you think you have a virus at all. All I see is a regular partition. – Daniel B Jul 25 '18 at 11:09
1

I recommend you just zero out your disk: Assuming the disk in question is /dev/sda, you would use dd if=/dev/zero of=/dev/sda bs=1M to start this process, which I estimate to take something like 3 hours. Not only will this remove the boot sector and all partitions and file systems, it even will overwrite all instances of whatever is on this disk short of forensic reconstruction.

A short version of dd if=/dev/zero of=/dev/sda bs=1M count=10240 will do this to just the first 10 GB of the disk, which should be more than enough and take only 2 minutes or so.

After this procedure reboot and enjoy.

Caveat:

It is quite likely, that your persisctance problem with the malware stems from infected backups or EFI - no amount of disk wiping can cure that.

  • I have done what you have suggested (several times) but I still have the malware return. I have also tried using the hdparm --dco-restore command but I get the following output. Do you have any other suggestions? – user919501 Jul 24 '18 at 19:05
  • **With output this time root@ubuntu:~# hdparm --yes-i-know-what-i-am-doing --dco-restore /dev/sda /dev/sda: issuing DCO restore command SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 04 51 40 00 21 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 root@ubuntu:~# – user919501 Jul 24 '18 at 19:06
  • As I said in the caveat: If your malware still returns, it might not come from the disk but from the EFI or from restoring an infected backup. – Eugen Rieck Jul 25 '18 at 7:40