Enterprise Rootkit - Remove n Replace

TLDR;

What’s the best approach at editing the bios to get rid of this thing…?

—update
Found scripts it runs and will have to update this in a moment…

For full transparency this all extended from Flashing a modded BIOs file.

Everything EXCEPT the bios.rom was used from here…
BIOSMOD2 — Яндекс Диск found here

The modified Bios I used is from the creator of the last. And that file is below.

From what I recall I only used FPTW64, the mod file and the .efi and changed

Two settings in the Grub

I wouldn’t have noticed it but this Rootkit is either coming from 2 places 1 my ISP router whos connected their switch.

I’ve completely wiped windows, air-gapped the system and am attempting repairs via SystemRescue loaded onto RAM.

Replaces all .efi it finds and adds Destop.ini to every drive.

7ff7b70c0000.Pecmd.exe - Used Hollow Hunter and found this was one of the culprits…

And what is your question now?

How can I remove the bootkit. I mean it’s enterprise level malware.

I’m assuming I need to somehow figure out how it’s executing, change the code back to normal or reflash the bios manually. It has instructions on getting a backup from somewhere and can also move itself onto RAM.

It affects Linux and Windows. The only way I’ve been able to access anything was loading SystemRescue onto RAM.

It even spread to my router and hosted itself via DLNA and installs as a printer driver to re-infect.

1 PC has altered bios which I’m assuming is basically gone.

2 other pcs are secure boot enabled with TPMS. So I’m assuming they can be recovered.

I wanted to see if anyone would be willing to read over the script and Bios file to see if they can see what was going on or assist in what was altered.

My next plan of attack is reflashing the bios, booting an iso into RAM, running anti-root kit software etc and run firmware updates and go from there. I’ve contacted 4 local IT companies that would even touch any of the machines, one is willing to mess around with it.

Any advice would be great if anyone has any other options.

And what is the file backup.bin you linked to your first post?

Is this the firmware you think is infected?

The tools were used from the BIOS2

So I suspect either foul play on either the script or FTPW

or

Bios file via google drive

Again: Is the dump ‘backup.bin’ in your first post the firmware which you think is infected / changed by a rootkit?

(That’s a ‘yes’ or ‘no’ question)

Yes. Sorry

Well, Asus G10CE, bios region is in static parts a100 % identical to a 330 Asus stock bios region.

Different from Asus stock 330 is - of course - NVRAM and one padding between NVRAM with windows code, machine specific data, eventlog.

NVRAM normally has no executable code but it has the certificates for signing secure boot / bootloaders, so I’d reset that.

ME region has no relevant differences in configuration, never heard of a changed ME firmware for a rootkit.

So I’d recommend to transfer FD, GbE and the padding with machine specific data in bios region from your backup to a stock 330 Asus firmware. You can’t get cleaner than this.

G10CE_msp.zip (8.0 MB)