What follows is the final result of the efforts I made, with the help of this Forum, to finally resolve a Bootkit / Rootkit Infection.
Please reference SquidBoy02 in two posts, August and September (?) 2017 for more information.
The following is a Step-by-Step Process for what worked for me, but is referenced to prior posts and help from BleepingComputer Forum Experts who have my deepest respect and appreciation.
* * *
How I Finally *Solved* My Rootkit / Bootkit Infection:
The asterisk is there because I didn't save the HDD in this process, since DBAN - Darik's Boot & Nuke - wouldn't load, further indicating that the Rootkit had control of my HDD, and possibly my CMOS on the MoBoard. I might consider trying to save it later, using I just migrated all my files to an external HDD (Rootkit there now? Remains to be seen...), and then physically destroyed the HDD, by opening it & removing the "Disk(s)" and recycling the rest at an e-Waste Facility.
The Shiny, Mirror-Like HDD "Disk(s)" will be used as signaling devices in my backpack if I become stranded and need to signal for help...they're very reflective, with a viewing hole in the center...and it makes me smile to see my triumph over the R&B-Kits when I look at the Discs.
I tried to amend my earlier post(s) when I asked for help with a suspected Rootkit / Bootkit Infection, but they've been locked in the period of time it took for me to solve the problem...(2 Months)...hence the Post here. Search for posts under Rootkit / Bootkit and SquidBoy02 to see if your situation is similar, if not exactly like, my situation.
* * *
Everything we tried failed on this Forum failed...but not without the efforts of some very fine people. I thank you all. I then spent hours and hours scouring all sorts of forums for other's takes on Rootkit / Bootkit Removal...and the number of entries is very large and getting larger as I looked. But it gave me a few strategies...and I eventually solved the problem.
That said, I have a Desktop Computer...not a Laptop...so your Mileage May Vary. I just checked, and the process seems very similar except that you'd probably have to remove the Power...the Laptop Battery, too...and then open the case to access the HDD and Battery for CMOS.
- Cracking the Case Open which *Voided the Warranty* on my ASUS G11CD Desktop Computer. (Considering the pitiful Customer Support by ASUS for my product, that Warranty was worthless anyway...and it was time to take matters into my own hands.)
- Remove Power Supply & Push Power ON Button a 3 - 4 times to drain electrical capacitance on MoBo inside computer.
- Unplug & Remove the HDD... (Not absolutely necessary, but I'll mention "Why" at the bottom.)
- Remove the Circular Battery for the CMOS on the MoBo...thereby depleting the "Memory Hold" of any Instructions held in the CMOS from the Rootkit on Boot-Up...r
- Research your Computer Model, and try to find a Schematic Diagram of the Mother Board to determine where the Clear CMOS Jumper is. On my ASUS G11CD, it was toward the bottom edge.
- Lift the jumper on the MoBo to clear the CMOS (Bios) by jumping 2 of 3 posts, waiting a while...10 - 15 minutes is overkill, but I did that...and then returning the jumper to the Original Position. **A picture w/ a cell phone might be handy BEFORE you do this step, if you forget where to put the jumper in the original position.
- Download a Recent Version of BIOS from ASUS to an empty Flash Drive...using a different computer (obviously).
- Return the Battery to the MoBo.
- If a Laptop, reconnect the Laptop Battery and lock it into place
- Reconnect Power Cord to Computer.
- Insert Flash Drive into USB Port in preparation for Flashing the BIOS.
- Turn Computer ON while pressing Del or F2 to enter BIOS Configuration, and then Navigate to Flash BIOS Utility. (All Mfr.s will differ, but most have a Flash BIOS Utility.)
- Use the Utility to Flash the BIOS on the MoBo using the Flash Drive as reference for New BIOS. (The BIOS was "cleared" when you removed the battery, as well as moving the Jumper on the MoBo to "clear" again...as an extra precaution...so now you have to restore the BIOS.
- ***Flashing the BIOS didn't work the 1st time, so I found different versions and kept trying until I found the right BIOS from ASUS.*** Keep Trying.
- Turn OFF Computer and Remove Power Connection. (Leave Battery on MoBo and Laptop Battery in place!)
- Install compatible New HDD (Hard Drive). I used a Samsung SSD (which I had always wanted) and a 2nd HDD - a Western Digital BLACK - 2 Terabyte Sata HDD.
- Reconnect Power Connection. (If no 2nd HDD, pls. disregard the info below).
- Insert Operating System Disk into CD/DVD Drive, or Flash Drive into USB Port.
- Install OS onto Computer...in my case, Windows 10...and then configure the 2nd HDD.
- Once OS is installed, Boot-Up the System...hit the Windows Button on the keyboard, or START Button in the lower left corner of the screen, and search for Disk Management.
- In Disk Management...assign a Drive Letter to Second HDD and do a simple format - NTFS in my case - to set the Drive for whatever you planned, and now the Computer will recognize both SSD & HDD.
- Reference this website, if you need help with configurations as they helped me a great deal with their videos: https://youtu.be/qMo8krAJd5Q
That's it, though it might seem like a lot.
In essence, you're: Saving your Files First...and then Removing Any Trace of R&B-Kit from the HDD & the CMOS on the MoBo...prior to Flashing New BIOS onto MoBo...and Re-Installing OS onto System.
* * *
Nothing I did worked to remove the Rootkit / Bootkit from my Computer...and I mean *every-single-program* designed to remove R&B-Kits, Provide Logs to Study, etc., etc.
Therefore, after searching dozens of Forums...I learned that the Newest Trend in Malicious Code Writing was to install the Rootkit / Bootkit Virus beyond the level of detection of most Programs...e.g. a Section of the HDD that couldn't be wiped out, or on the MoBo itself, so that any time a Pgm. would try to remove the Rootkit / Bootkit...it would FAIL...since the Kit was controlling initiation of said pgm., etc.
That's what really made me realize that I had a Rootkit / Bootkit Virus.
This process, detailed above, worked very well and I'm typing at that computer right now...and it works better than it ever did before w/ 2nd HDD and Primary SSD plus 16 GB more RAM.
But...it was a long haul, and I wanted to Return the Love I felt with this group of very talented experts...hence my final post on my original request for help. Others might come up with different versions of this approach, and I would defer to them as I'm NOT a Computer Expert (though I'm definitely getting there in some regards), and they might be able to speed up the process.
(SIDEBAR: BTW - Walmart is an amazing resource for Computer Parts. I was able to order 10 (Yes...10!) Sata 3, Locking Cables for MoBo connections for under $10...shipped. Knowing Global Exploitation, I probably walked over 14 skulls that day in my purchase of those cables...so I'll have to send the rest of my paycheck to Amnesty International to help my Conscience and Soul.
But that beats $14.95 for a Simple, Non-Locking, SATA Cable (Non Sata 3 / No Locking) from the Local Computer Store, though I DO try to keep those guys in business when I can. If "I" can order 10 for $10.00 Shipped...what can the LCS order with Wholesale Pricing? Seems like a Sata 3 Cable shouldn't cost more than $4.00 in a Brick and Mortar Store, but maybe I'm uninformed...???)
* * *
Best of Luck!
p.s. I'll log in a few more times after this posting to see how it's going, or if others disagree...inevitably...or suggest process changes. After that...I'm off and running until the next time I need help from BleepingComputer.com -- S.B.
Edited by hamluis, 07 November 2017 - 02:50 PM.
Moved from MRL to Announcements - Hamluis.