[SOLVED] Can a malware infect MOBO bios and RAM ?

[Mario Italia]

Just wondering?

 

[Mario Italia]

As above.
Disconnect ALL drives in the system, power up, see what happens.

I did, now I can still see the ransomware but it allows me to access boot options.

 

[AJNameS]

You still see what? There has to be a way to show a picture of this. Can't you use your phone camera or something?

 

[USAFRet]

My mobo is Asus Z170-A.

For that board, press F8 during power on to halt the POST process and select what drive to try to boot from.

 

[USAFRet]

I did, now I can still see the ransomware but it allows me to access boot options.

We need an actual pic of this.
Your phone or whatever.

 

[Mario Italia]

And now I mana

For that board, press F8 during power on to halt the POST process and select what drive to try to boot from.

OK, I reconnected my hdd and accessed win10 DVD via bios, what should I do ?

 

[USAFRet]

And now I mana

OK, I reconnected my hdd and accessed win10 DVD via bios, what should I do ?

Well, we're still trying to determine the level of "problem".
Whether this is an actual "BIOS infection" (unlikely), or a run of the mill Windows ransomware.


Again...with ALL actual storage devices physically disconnected.
No DVD, all hard drives, SSD whatever...physically disconnected.

Power up.
Does this message appear?

 

[Mario Italia]

Well, we're still trying to determine the level of "problem".
Whether this is an actual "BIOS infection" (unlikely), or a run of the mill Windows ransomware.


Again...with ALL actual storage devices physically disconnected.
No DVD, all hard drives, SSD whatever...physically disconnected.

Power up.
Does this message appear?

Disconnected everything, and now the massage is gone !

 

[USAFRet]

Disconnected everything, and now the massage is gone !

So, a standard windows ransomware. Not "BIOS".

In the BIOS, change the boot order...put your DVD first.
Then, boot up from your Win 10 DVD, and do a FULL wipe and reinstall on whatever HDD or SSD you want.
Have only that one drive connected while you do this.
Delete ALL partitions on the drive.

How To - Windows 10 clean install tutorial

If you are looking for the Windows 11 Clean install tutorial, you can find that here: Windows 11 Clean install tutorial (Click here) Otherwise, welcome to the Windows 10 Clean install tutorial This tutorial is intended to help you, step by step, to perform a clean install of Windows...

forums.tomshardware.com

 

[Mario Italia]

So, a standard windows ransomware. Not "BIOS".

In the BIOS, change the boot order...put your DVD first.
Then, boot up from your Win 10 DVD, and do a FULL wipe and reinstall on whatever HDD or SSD you want.
Have only that one drive connected while you do this.
Delete ALL partitions on the drive.

How To - Windows 10 clean install tutorial

If you are looking for the Windows 11 Clean install tutorial, you can find that here: Windows 11 Clean install tutorial (Click here) Otherwise, welcome to the Windows 10 Clean install tutorial This tutorial is intended to help you, step by step, to perform a clean install of Windows...

forums.tomshardware.com

So, a standard windows ransomware. Not "BIOS".

In the BIOS, change the boot order...put your DVD first.
Then, boot up from your Win 10 DVD, and do a FULL wipe and reinstall on whatever HDD or SSD you want.
Have only that one drive connected while you do this.
Delete ALL partitions on the drive.

How To - Windows 10 clean install tutorial

If you are looking for the Windows 11 Clean install tutorial, you can find that here: Windows 11 Clean install tutorial (Click here) Otherwise, welcome to the Windows 10 Clean install tutorial This tutorial is intended to help you, step by step, to perform a clean install of Windows...

forums.tomshardware.com

I managed to run startup repair and found some issues, and now I'm in my desktop, everything is Okey except there's a weird file with weird name like 4rty6cv7; and I don't wanna click it .

 

[USAFRet]

I managed to run startup repair and found some issues, and now I'm in my desktop, everything is Okey except there's a weird file with weird name like 4rty6cv7; and I don't wanna click it .

Full wipe and reinstall.

 

[Mario Italia]

It's an exercis

Full wipe and reinstall.

Full wipe like zero filling or full format as if it's new ?

 

[Mario Italia]

It's an exercis

Full wipe and reinstall.

Full wipe like zero filling or full format as if it's new ?

 

[Mario Italia]

Okey, hold on, maleware bytes isolated that file, should I wipe or perform a scan first ?

 

[USAFRet]

It's an exercis

Full wipe like zero filling or full format as if it's new ?

A Windows installation, deleting all existing partitions in the process.

That message window came from somewhere. And now you're seeing oddly named files.

Start from a known clean slate.

 

[Mario Italia]

A Windows installation, deleting all existing partitions in the process.

That message window came from somewhere. And now you're seeing oddly named files.

Start from a known clean slate.

I was gonna wipe until malware lbytes quarantined the culprit, it's a file in downloads folder because I forgot to turn on real time protection again after I quit my game.
It's a tool bar installer I think.

 

[Mario Italia]

A Windows installation, deleting all existing partitions in the process.

That message window came from somewhere. And now you're seeing oddly named files.

Start from a known clean slate.

I was gonna wipe until malware lbytes quarantined the culprit, it's a file in downloads folder because I forgot to turn on real time protection again after I quit my game.
It's a tool bar installer I think.

 

[USAFRet]

I was gonna wipe until malware lbytes quarantined the culprit, it's a file in downloads folder because I forgot to turn on real time protection again after I quit my game.
It's a tool bar installer I think.

And a "toolbar installer" doesn't demand $10,000 USD from you.

I know what I would do...

 

[AJNameS]

Just read carefully the things written and do them.
The formatting of the disk is the way to make sure things are going to be cleansed fully. Malwarebytes aren't bad, but they are better for dealing with adware and things found in weekly scans, but not so much in cases when someone was able to gain control over your system in the way you described. Don't overestimate them. Well, if you insist on it, and the PC drive has no important data, but instead just games and things for fun, mb go with the antivirus, your choice. But the risk is a risk.

 

[Mario Italia]

And a "toolbar installer" doesn't demand $10,000 USD from you.

I know what I would do...

Sorry, I don't understand? I'm kinda clueless when it comes to ransomwares.

 

[Mario Italia]

Just read carefully the things written and do them.
The formatting of the disk is the way to make sure things are going to be cleansed fully. Malwarebytes aren't bad, but they are better for dealing with adware and things found in weekly scans, but not so much in cases when someone was able to gain control over your system in the way you described. Don't overestimate them. Well, if you insist on it, and the PC drive has no important data, but instead just games and things for fun, mb go with the antivirus, your choice. But the risk is a risk.

Okey .

 

[USAFRet]

Sorry, I don't understand? I'm kinda clueless when it comes to ransomwares.

Something caused that dialog box to appear. Some malware.
Are you 100% confident that malwarebytes has identified and gotten rid of ALL of it?

I wouldn't be.

If it were my system, I'd recover from the full drive backup made yesterday or the day before.
If it were a family members PC...full wipe and reinstall of everything.

But, this is your system and data. All up to you as how to proceed.

 

[Mario Italia]

And a "toolbar installer" doesn't demand $10,000 USD from you.

I know what I would do...

I found it, it's a file called 5yu6r4.besup and I Googled the file extention and it's definitely the culprit.

 

[Mario Italia]

Something caused that dialog box to appear. Some malware.
Are you 100% confident that malwarebytes has identified and gotten rid of ALL of it?

I wouldn't be.

If it were my system, I'd recover from the full drive backup made yesterday or the day before.
If it were a family members PC...full wipe and reinstall of everything.

But, this is your system and data. All up to you as how to proceed.

Solved the issue, finally.
But is there any program that backups my data other than just copy and paste before I fully wipe just to make sure that file didn't breed more ransomwared .

 

[USAFRet]

Solved the issue, finally.
But is there any program that backups my data other than just copy and paste before I fully wipe just to make sure that file didn't breed more ransomwared .

Not really.
There is no way for any 'backup thing' to clean malware in the process.

Backups are what you do before the system gets infected or breaks.
My house systems are backed up every night, all drives. In case of need, I could roll back a day or two. Or a week. Or a month.

What is your backup situation at home?

What is your backup situation at home? And if you don't do that, why not? Every single day, I read multiple threads here of "How do I get my stuff back?" or "That drive had 5 years of photos of my kids!!" Be it a dead drive, dropped phone, virus, accidental deletion, formatting the wrong...

forums.tomshardware.com

 

[william p]

Try running Linux on a Live DVD (free to download on another computer). Run it in trial mode which takes time to load, be patient.
You can see files in your HDD from there, but nothing can run. Look for files you don't recognize, and check properties to see if they were created when your problem started. Try to delete them.