Member Avatar for michael.tuason2

Can anybody please guide me or enlighten me on how to go about this problem, Im running on windows 7, intel i3 processor and 6 gig of ram. I am using a toshiba laptop, satellite, c840, my current bios is InsydeH2O v6.50.my registry is a mile long, and the persistent module is the trusted installer. I have 3 files on my that doesnt seems to fit, pageswap.sys, hiberfil.sys and a girbish all caps folder.

pls if anybody can assit me in my current predicament. tnx

  • 4 Contributors
  • 3 Replies
  • 229 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

Short, practical plan (for ): stop using the machine on the network, do not reinstall or keep experimenting, and make a forensically sound image of the drive before doing anything else. Imaging first preserves evidence and lets you test removals safely on a copy; if you can remove the drive and image it via a write‑blocker on a clean workstation, do that. Bootable rescue media (live Linux or a vendor rescue ISO) is the right way to triage without starting the infected Windows environment. ()

Quick file triage you can run from rescue media or on the image: the Windows hibernation file and paging file are normal system items (hiberfil.sys, pagefile.sys); they alone aren’t proof of compromise. A strangely named driver (like pageswap.sys) or a random ALL‑CAPS folder in the root is worth investigating. Use Sysinternals tools to check persistence and signatures (Autoruns, Sigcheck): looking for unsigned drivers in System32 and unexpected autostarts is high value. Example commands to remove the hibernation file and to run a signature sweep (on a copy or after imaging) are shown below. (learn.microsoft.com)

powercfg -h off       # disables hibernation and removes hiberfil.sys
sigcheck -u -e C:\Windows\System32 > sigcheck-system32.csv
# then review sigcheck output and run Autoruns.exe to inspect autostarts

Firmware (BIOS/UEFI) warning and tools: firmware/UEFI implants are real and can survive a disk wipe — LoJax (ESET) and MoonBounce (Kaspersky) are public examples. InsydeH2O is a common UEFI platform used by many OEMs, so a vulnerable or writable flash area can let an implant persist. For firmware inspection and dumping use Intel CHIPSEC, UEFITool and (when appropriate) flashrom or vendor utilities; these tools let you dump the SPI image and compare it to a known‑good image. If a firmware compromise is confirmed, reflash only with an official vendor image or have the vendor/service replace the board — random downloads are dangerous. (eset.com)

Suggested sequence (practical): isolate → image (write‑blocker) → offline AV/rescue scans on the image → run Sigcheck/Autoruns/Process Explorer on the copy → dump firmware with CHIPSEC/UEFITool and compare hashes → if firmware looks altered, reflash official BIOS or escalate to the vendor/DFIR. ’s live‑Linux idea is useful for triage; ’s point about the flash chip is correct — if you can’t prove firmware integrity, do not trust the device for sensitive use. If help is needed, consider a professional DFIR service rather than guessing. ()

Recommended Answers

All 3 Replies

Member Avatar for Begginnerdev

Most mother boards have a crash free bios that has a backup of the OEM bios settings. I am assuming you have attempted to boot the pc in safe mode and scan it that way. I suggest booting into a linux live environment to disinfect the problem drive. Something like this might do the trick.

Member Avatar for RobertHDD

I havent heard anything about BiOS rootkits lately

Member Avatar for rubberman

There are not BIOS rootkits per se - the BIOS is read-only memory. However, there is a flash chip that holds the current BIOS settings, and that CAN become rootkit infected. This is a favorite tool for agencies such as the NSA and other sophisticated hackers. Even if you wipe and re-image your drive, when you boot up again, if you haven't wiped the flash, then you get re-infected.

Some systems let you wipe the flash by removing the battery (laptops) and holding down the power button for some period. Others require that you remove the battery, access the motherboard, and short out a couple of contacts. Your computer manufacturer will have instructions on how to do such a "factory reset" of the BIOS flash.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.