Windows 10: malware survives on $SysReset

Discus and support malware survives on $SysReset in Windows 10 Network and Sharing to solve the problem; Hi. I was recently infected by a Trojan detected as "Win32:Trojan.Sonbokli.A!cl" at 1:50 am APROX, I tried removing it with Windows Defender but it was... Discussion in 'Windows 10 Network and Sharing' started by ramirofeldman1, Dec 20, 2023.

  1. RAMIROFELDMAN1
    ramirofeldman1 Win User

    malware survives on $SysReset


    Hi. I was recently infected by a Trojan detected as "Win32:Trojan.Sonbokli.A!cl" at 1:50 am APROX, I tried removing it with Windows Defender but it was useless, it was still active. So I reset the PC and reinstalled Windows finished at 6 am. To my surprise, in the "$SysReset" folder created at 1:50, I found a "scratch" folder containing the process "crss.exe" Process that I had the suspicion that the Trojan was using before the reset. Checking the path of this process I realized that it now appears as "Error opening process".Could this be a malware file that survived the restore?

    :)
     
    ramirofeldman1, Dec 20, 2023
    #1
  2. GROM0X
    Grom0X Win User

    Malware That Can Survive OS Reinstalls

    Read more: Suspected Chinese Hackers Unleash Malware That Can Survive OS Reinstalls
     
    Grom0X, Dec 20, 2023
    #2
  3. GALILEO
    galileo Win User
    Malware That Can Survive OS Reinstalls

    While not wanting to ever declare something "impossible", just how is it "possible" for malware to survive a firmware flash? Surviving a firmware "patch"...yes, definitely possible...but a "flash"?

    Regardless of the boot source for the machine, the currently installed firmware will "always" be read. That always presents a vector for the malware to load to RAM - to the best of my knowledge, there is no way to avoid this possibility. However, if the code for flashing the firmware is written correctly... again that darn "if"...that code can explicitly control access to specific RAM memory locations and thus effectively lock and prevent "any" other loaded code from executing. Thus, preventing RAM loaded malware from injection execution between completion of the flashing operation and rebooting. Thus, allowing the reboot to flush the RAM loaded malware and thus, preventing backwashing the newly flashed firmware.

    Again, "if" the flashing code is written correctly...
     
    galileo, Dec 20, 2023
    #3
  4. ZEBAL
    zebal Win User

    malware survives on $SysReset

    Malware That Can Survive OS Reinstalls

    "If" is not acceptable in security or in this case there is no way to be safe except removing chip and flushing with EPROM:
    EPROM - Wikipedia

    See "The firmware dilemma" section here:
    Can Malware Survive If I Reset My PC? - Ask Leo!
     
    zebal, Dec 20, 2023
    #4
Thema:

malware survives on $SysReset

Loading...

  1. malware survives on $SysReset - Similar Threads - malware survives $SysReset

  2. Microsoft's inability to detect and prevent malware from surviving inside inactive profiles

    in Windows 10 Gaming
    Microsoft's inability to detect and prevent malware from surviving inside inactive profiles: Microsoft is so quick to offer to build out your desktop environment with the assistance of a previously used account, but cannot prevent viruses associated with the old account from being transferred to a new copy of Windows, often the reason for reinstalling Windows in the...

  3. Microsoft's inability to detect and prevent malware from surviving inside inactive profiles

    in Windows 10 Software and Apps
    Microsoft's inability to detect and prevent malware from surviving inside inactive profiles: Microsoft is so quick to offer to build out your desktop environment with the assistance of a previously used account, but cannot prevent viruses associated with the old account from being transferred to a new copy of Windows, often the reason for reinstalling Windows in the...

  4. malware survives on $SysReset

    in Windows 10 Software and Apps
    malware survives on $SysReset: Hi. I was recently infected by a Trojan detected as "Win32:Trojan.Sonbokli.A!cl" at 1:50 am APROX, I tried removing it with Windows Defender but it was useless, it was still active. So I reset the PC and reinstalled Windows finished at 6 am. To my surprise, in the "$SysReset"...

  5. malware survives on $SysReset

    in Windows 10 Gaming
    malware survives on $SysReset: Hi. I was recently infected by a Trojan detected as "Win32:Trojan.Sonbokli.A!cl" at 1:50 am APROX, I tried removing it with Windows Defender but it was useless, it was still active. So I reset the PC and reinstalled Windows finished at 6 am. To my surprise, in the "$SysReset"...

  6. $sysreset folder

    in Windows 10 Gaming
    $sysreset folder: Hello, i reinstalled my pc today and now i have folder $SysReset and there are weird files like Rollback, is it normal to have this folder and these files in it? https://answers.microsoft.com/en-us/windows/forum/all/sysreset-folder/ad493a11-0381-47c8-a790-7f02876837b1

  7. $sysreset folder

    in Windows 10 Software and Apps
    $sysreset folder: Hello, i reinstalled my pc today and now i have folder $SysReset and there are weird files like Rollback, is it normal to have this folder and these files in it? https://answers.microsoft.com/en-us/windows/forum/all/sysreset-folder/ad493a11-0381-47c8-a790-7f02876837b1

  8. $SysReset and $WinREAgent folders

    in Windows 10 Network and Sharing
    $SysReset and $WinREAgent folders: Hello, I recently looked through my C drive and saw two hidden folders i do not fully know if i can safely delete them or not. I know when and by what action they were created, but i do not know if i can just rightclick>delete those two folders. Thanks in advance, Blaze....

  9. Malware That Can Survive OS Reinstalls

    in Windows 10 News
    Malware That Can Survive OS Reinstalls: Suspected Chinese Hackers Unleash Malware That Can Survive OS Reinstalls 165890

  10. Unable to remove $SysReset

    in Windows 10 Updates and Activation
    Unable to remove $SysReset: Hi i am running windows 10 with all the latest updates and i have found this folder on my laptop and i am not able to delete it $SysReset I have done a search on this forum and i have followed most of the advice in the posts but nothing seems to work, i have deleted some...