Show Posts
1
General Computer Support / I got infected with the worst possible rootkit. I need help ASAP.
« on: February 02, 2017, 10:39:13 pm »
Hi everyone. First off I want to say that all I'm about to type is true and it is happening right now. Also I didn't know where should I post this since it's a software related issue as well so feel free to move it to the correct subforum.
I started usng co,puters around 1996 and Ive never seen something like this; Last month I installed a Linux VM machine to perform some tests related to a videogame (yes, kinda stupid, I know). On top of that, one of the steps was to create a google cloud account to "connect with a database full of other players research related to the game". Eventually I get stuck at some step for no apparent reason. Like the user and password for this Virtual Machine I created just stopped working.
After trying to quickly figure out what the hell was going on, the mouse starts moving by itself and my PC restarts. Once I get back to the desktop I start opening My Documents and checking my other drives and I noticed a lot of my files were being copied and uploaded somewhere (probably the icloud account I just created). I hear the alarm of my Android phone. 16 new updates were installed and I had autoupdates disabled. Same goes for my iPad and my sister's iPhone. Apps getting updated all at the same time.
At this point im panicking and first thing I try to do is to check the router settings. I have OpenWRT installed and I see some ports like 443, 80, telnet and netsec were open. This is not looking good. At all.
Immediatelly shut everything off. Next day I try to close these ports on OpenWRT and it worked, or at least thats what I thought. I check the modem (Motorola sbg6580) and I see a few plugins installed. I dont even know how they did this. Tried to do factory reset but the plugins were still there opening the ports. Few days later got a new modem, sagemcom 3284. It was even easier for them to ope everything this time since this modem lacks a real bridge option. You can still log into the router and do whatever you want even in bridge mode and being online (which. afaik, this shouldnt be a thing).
To summarize, and a list of things I tried during the last month:
- My security was comprimised like never before.
- All the devices connected to the network at that time were all affected
- A partition called 'Boot (X:)' started showing up
- I tried reinstalling windows several times. Noticed that if I tried to create a bootable USB, the files were corrupted when I transferred em to the USB, making it impossible to make a fresh install.
- I also tried with an OEM windows 10 DVD, but this doesnt help because of the Boot X partition I mentioned before. Its like this partition waits for an OS to be installed and then installs all the viruses and crap over and over and over again.
- Reinstalled windows at least 20 times this month. Always fresh installs, a lot of times even after using KillDisk.
- I tried with KillDisk, CentOS, Kali Linux, Norton boot recovery tool (lol i know), the windows MBR recovery tool and nothing, I repeat nothing helped so far.
Some other creepy and really weird stuff Ive noticed:
- They created three facebook accounts using email accounts I own.
- They can see through my iPad wecam and they interact with me on Twitch chat. I know this sounds totally crazy but it is true. They make references to me failing at fixing this, they mock me, he make references to boot x and UEFI, shell, etc., even when the stream is completely unrelated. My guess is that one of them is restreaming my screen/screens for a bunch of people.
- I made two outlook accounts and used one to re-link my payoneer account to this new one. The outlook account got locked and cant no longer access to it because Microsoft detected a lot of spam coming out of it even tho I only created it to link it to my payoneer account. Same goes to another account that I made to link my paypal account. The other two outlook accounts I made were not locked out, but I didnt link them to anything anyways, maybe thats the reason.
So, what can I do? I'm from South America and I don't have too many options here so here I'm asking for help.
So far it seems only Google is kinda listening because Google Cloud was involved but they are asking for a bunch of names and information about what happened but they are not helping me to fix this issue with my PCs and network.
The only smilar post I could find on the whole Internet, is this one http://www.tweaking.com/forums/index.php?topic=3112.0 .
But no fix so far.
Any input is (please no "reinstall windows" replies) will be appreciated.
Thanks.
Ps: Tomorrow I could upload some pictures, let me k ow what would you like to see.
I started usng co,puters around 1996 and Ive never seen something like this; Last month I installed a Linux VM machine to perform some tests related to a videogame (yes, kinda stupid, I know). On top of that, one of the steps was to create a google cloud account to "connect with a database full of other players research related to the game". Eventually I get stuck at some step for no apparent reason. Like the user and password for this Virtual Machine I created just stopped working.
After trying to quickly figure out what the hell was going on, the mouse starts moving by itself and my PC restarts. Once I get back to the desktop I start opening My Documents and checking my other drives and I noticed a lot of my files were being copied and uploaded somewhere (probably the icloud account I just created). I hear the alarm of my Android phone. 16 new updates were installed and I had autoupdates disabled. Same goes for my iPad and my sister's iPhone. Apps getting updated all at the same time.
At this point im panicking and first thing I try to do is to check the router settings. I have OpenWRT installed and I see some ports like 443, 80, telnet and netsec were open. This is not looking good. At all.
Immediatelly shut everything off. Next day I try to close these ports on OpenWRT and it worked, or at least thats what I thought. I check the modem (Motorola sbg6580) and I see a few plugins installed. I dont even know how they did this. Tried to do factory reset but the plugins were still there opening the ports. Few days later got a new modem, sagemcom 3284. It was even easier for them to ope everything this time since this modem lacks a real bridge option. You can still log into the router and do whatever you want even in bridge mode and being online (which. afaik, this shouldnt be a thing).
To summarize, and a list of things I tried during the last month:
- My security was comprimised like never before.
- All the devices connected to the network at that time were all affected
- A partition called 'Boot (X:)' started showing up
- I tried reinstalling windows several times. Noticed that if I tried to create a bootable USB, the files were corrupted when I transferred em to the USB, making it impossible to make a fresh install.
- I also tried with an OEM windows 10 DVD, but this doesnt help because of the Boot X partition I mentioned before. Its like this partition waits for an OS to be installed and then installs all the viruses and crap over and over and over again.
- Reinstalled windows at least 20 times this month. Always fresh installs, a lot of times even after using KillDisk.
- I tried with KillDisk, CentOS, Kali Linux, Norton boot recovery tool (lol i know), the windows MBR recovery tool and nothing, I repeat nothing helped so far.
Some other creepy and really weird stuff Ive noticed:
- They created three facebook accounts using email accounts I own.
- They can see through my iPad wecam and they interact with me on Twitch chat. I know this sounds totally crazy but it is true. They make references to me failing at fixing this, they mock me, he make references to boot x and UEFI, shell, etc., even when the stream is completely unrelated. My guess is that one of them is restreaming my screen/screens for a bunch of people.
- I made two outlook accounts and used one to re-link my payoneer account to this new one. The outlook account got locked and cant no longer access to it because Microsoft detected a lot of spam coming out of it even tho I only created it to link it to my payoneer account. Same goes to another account that I made to link my paypal account. The other two outlook accounts I made were not locked out, but I didnt link them to anything anyways, maybe thats the reason.
So, what can I do? I'm from South America and I don't have too many options here so here I'm asking for help.
So far it seems only Google is kinda listening because Google Cloud was involved but they are asking for a bunch of names and information about what happened but they are not helping me to fix this issue with my PCs and network.
The only smilar post I could find on the whole Internet, is this one http://www.tweaking.com/forums/index.php?topic=3112.0 .
But no fix so far.
Any input is (please no "reinstall windows" replies) will be appreciated.
Thanks.
Ps: Tomorrow I could upload some pictures, let me k ow what would you like to see.