How to completely cleanup a trojan infected PC/Network?

Pantherina@feddit.de to Linux@lemmy.ml – -6 points –

A friend told me they had suddenly open ports in their router, and they suspect a trojan.

So first I would like some way to verify that. I dont trust Windows so I ask the Linux people hahaha.

So its a Windows PC, that has to be wiped of course.

  • plug put from network
  • mount on Linux, copy all personal data
  • overwrite that thing and reinstall maybe a better OS?

So now there are some problems.

  1. The BIOS could be infected, its proprietary and cant just be reflashed (I guess?)
  2. There are maany files that could be tampered with.

So I would like your experience. I have a flash programmer, can you just flash a vendor Bios image? I want to be really sure there is nothing on there anymore.

Can you use ClamAV or something to search files? I would think about a trojan unpacking Word files, inserting a macro and packing again, for example. Or PDFs, or anything else that you would simply keep.

What to do with the Router? If it has opened Ports, may it be infected too?

But before that I would really want to make sure its necessary.

Thanks in advance!

7

If somebody went to the expense of developing a bios implant to target you and your exact micromodel of computer, just give up. Hand yourself over to Mossad now, and get it all over with.

Here is an alternative Piped link(s):

just give up.

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.

So first thing, an open port isn't a bad thing most of the time. And a malware infection doesn't need open ports, nor does modern malware try to open ports.

How did they check for these open ports? Did they log in the router and check? Run a scan from an external service?

The most common explanation for unknown open ports on a router in a home network will be a feature called "universal plug and play" or UPnP for short. This allows IOT devices to ask the router for a port to be opened, and by default most home routers will do just that. Devices like security cameras etc often do that so you can access the video from a phone or something. Games also sometimes use UPnP to open ports for multiplayer.

It's considered good security practice to disable UPnP as a lot of devices don't really protect the services they expose through UPnP; but that still doesn't make open ports an indication of malware.

On the subject of games, is there anyone in the house that might try to host a game server? Even something as simple as minecraft doesn't need any additional software and a Google search for how "friends can't connect to Minecraft game" will show instructions on how to set up port forwarding etc.

Honestly, id just reinstall windows, check the router for port forwarding, change the admin password on the router, and call it a day.

Then, keep an eye on it and see if the situation improves