Reformating SSD leaves Rootkit intact

lunarlander

Thread Starter
Joined
Sep 21, 2007
Messages
12,856
Hi,

I have just recovered from a rootkit. I have had unresponsive start menu, charmap changing, wrong responses from File Explorer. All from an attacker toying with me. I had re-installed Windows, hardened it, only to have this continue. Until I read that it is considered basic recovery procedure nowadays to zero fill your drive.

I put on my thinking cap. SSDs are not like spinning disks, where when you reformat them, the beginning sector could fall anywhere. SSD will probably respond that the disk begins here, at a static spot. So a rootkit seeking persistence only has to reuse a space used by drivers or something on the AutoRuns list, mark it readonly, and it will live forever. Because you are re-installing the same Windows, same drivers, same everything OS wise, and they will probably be re-installed at the same spot. Windows setup follows a set sequence.

Sounds reasonable ?
 

crjdriver

Moderator
Joined
Jan 2, 2001
Messages
42,757
You should not format a ssd; secure erase is a much better way to go. This is a command issued to the drive's controller and cleans the complete drive.
Many high end motherboards include a secure erase option in the bios.
 

lunarlander

Thread Starter
Joined
Sep 21, 2007
Messages
12,856
I was just using Windows setup's install process. I doubt it would detect and use 'secure erase' on an SSD. Especially if it is only available on high end mobo's.
 

crjdriver

Moderator
Joined
Jan 2, 2001
Messages
42,757
Setup would never use secure erase. Most of the drive mfg have a utility which will make a bootable usb to secure erase OR there is linux parted magic which will secure erase as well.
 

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top