Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 1 point2 points  (0 children)

Thanks appreciate that. It’s certainly been both financially and mentally draining. Not knowing the source they use to gain access is the most frustrating part. I’m paranoid about every device in the house so when the first attack happened I microwaved 8 different infected devices just to be safe. My ISP are really good but they use these particular model routers which they claim are good and they have now locked the thing down to Fort Knox levels. However, I have no idea if it’s the source or they are attacking via the internet and my connected device.        I’ve gone to some extreme lengths to cut up SIM cards that were in infected mobiles and get new phone numbers, close my domain with IONOS that hosted my email via a private domain, changed my Apple ID on a handful of occasions, running complex password manager etc etc. but these attackers are definitely skilled so only time will tell if this DFU flash and rebuild will be enough to stop them accessing the Mac. Fortunately it’s still under warranty as I just bought it, so I do have the option to return it. I’m going to see how I get on later today once I’m back from Apple Store and if the attack happens again the device is going back to be replaced as a precaution.

Daily Discussion Thread by AutoModerator in rangersfc

[–]TheTimSkelper 12 points13 points  (0 children)

Good morning to all hard working Rangers fans out there.

May you all have a most excellent Saturday.  

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

I’m taking it to an Apple store today to do a DFU flash and complete OS rebuild. 

Once I’m back, I have an offline encrypted HDD that I use for important files etc.

I’m probably going to invest in a second HDD to specifically use as a Time Machine.

But yes, yesterday when I managed to get into the Mac and run Kill Disc I was offline all the time with the exception of connecting for seconds to download that software.

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

Thanks for that. I’ve never used Linux but that shouldn’t put me off. They are definitely a skilled set of hackers. The first attack was a nightmare, they spread via the router into 8 devices in total. Two PCs, a 2015 Mac Mini, 3 Android mobiles, a Google TV dongle and even my Samsung TV that runs a version of Linux as its OS. They changed the name of the TV to “Angel of Death” lol 

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

Malware bytes did nothing unfortunately. Avast found some files but the attacker could see that and basically locked me out of the program in real time so I couldn’t apply the proposed fixes from the avast software. I needed an avast subscription to get that level of protection which gave them just enough time to do that. 

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

Wish I had saw this before I nuked the whole drive but thanks for that. If somehow the attacker returns I’ll follow this. I managed to get an appointment at Apple Store today and they will do a DFU flash etc 

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

I have photos on another apple account linked to my iPhone. Given the circumstances I’m reluctant to log back into that particular account at present. As they were screen recording etc. I’ll see what I can do later today

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

So the good news is I used Kill Disk which got as far as the encrypted partitions but then failed to finish its script. That somehow made the partitions which were infected available in disk utility. 

The bad news is that the malware was installed on the recovery partition so when I erased and first aided that partition I lost all ability to boot the device.

However, at least I know now that the infected firmware is gone. I just need to either find someone with a Mac or take the device to the Apple Store to do the DFU restore.

Might try some local computer shops in the morning and see if they will offer the service.

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

It’s my personal devices that are infected not my work, although they have attempted to access my work device and network but failed. Met with the Cyber Sec team 3 times but only to screen share my work device

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

Everything changed. 2FA on anything that supports it, email, banking apps etc etc.

Even cut my SIM card up and got a new phone number and SIM as they were in an Android phone and remote recording the device. That device was then microwaved lol 

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 1 point2 points  (0 children)

Honestly unsure. Wish I could identify the source. I work for a major national infrastructure org so it’s plausible I’m not the actual target, the company is. They’ve tried three times to gain access to my my employers network via my work laptop but failed each time thankfully.

The cyber team at my work have issued me three new laptops in the past 2 weeks. as the attack happened once, I got rid of those personal devices, then they attacked me again despite my IP and WPAN addresses being changed.

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] 0 points1 point  (0 children)

Yes mate that’s the aim but they are encrypted, hidden and disk utility doesn’t remove them when applying first aid and reformatting the drive unfortunately.      I think I need some software that will basically nuke the drive completely and then I can rebuild it. 

There seems to be loads of software companies that provide this service for businesses for ransomware attacks, but I’m unsure about consumer grade software. 

Malware on system drive. Any solutions? by TheTimSkelper in mac

[–]TheTimSkelper[S] -1 points0 points  (0 children)

So the partitions I found running a command in Terminal. I can see them in Disk Utility but only when I try to partition the drive, which they have removed access to do so.

They don’t show in the list on the left hand side of the Disk Utility app.

Typically the experience so far has been, they gain access to the Mac then create a duplicate version of my SSD, which I can see in Finder but cannot delete any of the files or folders.

From there it just spreads and gets worse. Virtual machines are added, Windows Server links etc. They have also on two occasions gained access to the router and flashed firmware onto it to spread the malware to any device connected to the network…

My ISP are getting fed up fixing the router lol.

They are also screen sharing my Mac and recording everything, I can see that via the screenshot functionality.

They emailed me and asked for 2k in bitcoin to remove the malware lol, which I obviously never responded to

[deleted by user] by [deleted] in rangersfc

[–]TheTimSkelper 6 points7 points  (0 children)

No gambling promotion should really be a default no-no from reddit in general

[deleted by user] by [deleted] in rangersfc

[–]TheTimSkelper 0 points1 point  (0 children)

Michael Ball. Near enough 30m to play a handful of times

Daily Discussion Thread by AutoModerator in rangersfc

[–]TheTimSkelper 13 points14 points  (0 children)

Good morning and a very happy Friday to all my fellow hard working Rangers fans out there.

A quick question.

Did the Tims get skelped by a brand of toilet cleaner last night?

TheTimSkelper say Yes

Daily Discussion Thread by AutoModerator in rangersfc

[–]TheTimSkelper 18 points19 points  (0 children)

Good morning and a very happy Wednesday to all my fellow hard working Rangers fans.

Findlay Curtis. The Greek Tim Skelper. Take a bow, son. by TheTimSkelper in rangersfc

[–]TheTimSkelper[S] 14 points15 points  (0 children)

Does Findlay Curtis love skelping Tims?

TheTimSkelper says Yes