I Windows user got hack. I use Ubuntu LiveCD 20.04.6 LTS and take out SDD still hack in bios and connect to hacker Windows Network

[Esmurf]

Hello.


I was hack for more than one year. Hack my PC my phone and my family phone. We get drag into a virtual network. I see from PCAP data go up to Azure, MDNS, Amazon, etc.
Very long story but is Turkish hackers.

I try reinstall Windows but hidden partition in SDD which cannot be delete and they deploy same modify OS in my PC. I in a workgroup MDM but I alone PC at home. They access PC remotely. Got admin and authenticated user in my PC. My registry is change and I cannot change back.

So I use Ubuntu hope I can clean SDD and BIOS. If you want know more please say so I can give pictures.

Even my thumb drive got hack. So I cannot flash BIOS because thumbdrive is hack. So I take out SDD and run Ubuntu LiveCD. But still hack. I still connect to Windows Network.

Any idea how to do?

I attach image.

 

[Condobloke]

G'day Esmurf, Welcome to Linux.org

Are you sure this is not being done via your wireless connection ?....perhaps by a neighbour or a family member....or a boyfriend of your daughter....all of those are real possibilities.

Have you contacted your ISP....Internet service provider ?

So I take out SDD and run Ubuntu LiveCD. But still hack.

I wont say that it is impossible to hack a live version, but it does take a level of skill that is well beyond most people.

It tells me that someone has easy access to your pc

 

[f33dm3bits]

I wont say that it is impossible to hack a live version, but it does take a level of skill that is well beyond most people.

It tells me that someone has easy access to your pc

There are viruses that can infect your bios/uefi. If that's the case with OP then that could explain how someone could get access to any os they have installed and even a life session.

https://forums.malwarebytes.com/topic/318562-how-to-get-rid-of-a-suspected-bios-virus-hidden-trojan-and-a-hacker-situa

Need help identifying or removing BIOS/UEFI (firmware) virus on windows 11 PC - Microsoft Q&A

Hi. I will give a quick brief of the virus I accidentally Installed. After attempting to download ‘cracked’ software I thought I Installed a generic piece of malware that was easily removable. I tried to remove it using Norton scans but it detected…

learn.microsoft.com

https://www.reddit.com/r/techsupport/comments/16mpgtm/what_are_the_odds_my_bios_is_infected

https://www.reddit.com/r/antivirus/comments/189illw/how_common_are_bios_malware

 

[Esmurf]

G'day Esmurf, Welcome to Linux.org

Are you sure this is not being done via your wireless connection ?....perhaps by a neighbour or a family member....or a boyfriend of your daughter....all of those are real possibilities.

Have you contacted your ISP....Internet service provider ?


I wont say that it is impossible to hack a live version, but it does take a level of skill that is well beyond most people.

It tells me that someone has easy access to your pc

Hello Condobloke. Thank you for welcome.

No this is done through ethernet and mobile data. Yes I got contact ISP and police. But is not people close by. Is done through force enrollment to virtual network and force deployment of OS. My Windows before somehow got retail demo license. haha.

 

[Esmurf]

There are viruses that can infect your bios/uefi. If that's the case with OP then that could explain how someone could get access to any os they have installed.

https://forums.malwarebytes.com/topic/318562-how-to-get-rid-of-a-suspected-bios-virus-hidden-trojan-and-a-hacker-situa

Need help identifying or removing BIOS/UEFI (firmware) virus on windows 11 PC - Microsoft Q&A

Hi. I will give a quick brief of the virus I accidentally Installed. After attempting to download ‘cracked’ software I thought I Installed a generic piece of malware that was easily removable. I tried to remove it using Norton scans but it detected…

learn.microsoft.com

https://www.reddit.com/r/techsupport/comments/16mpgtm/what_are_the_odds_my_bios_is_infected

https://www.reddit.com/r/antivirus/comments/189illw/how_common_are_bios_malware

I read this later thanks.

 

[Condobloke]

I will ask a few other members for their opinions. You do not need to do anything further. They will see this topic and respond as they can.
Please be aware of the different time zones....this site has members world wide. Their response times may vary widely

@CaffeineAddict
@GatorsFan
@Trml
@osprey
@guiverc

 

[CaffeineAddict]

I in a workgroup MDM but I alone PC at home.

Hopefully this helps:

What is dmwappushsvc?

It's a Windows service that ships in the Windows operating system as a part of the Windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server.

Mobile Device Management overview

Windows provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy.

learn.microsoft.com

 

[Trml]

So I take out SDD and run Ubuntu LiveCD. But still hack. I still connect to Windows Network.

The "Windows Network" that is seen may simply be the Ubuntu live-iso running so called autodiscovery with Avahi. It may be active to access samba shares and use printers from the iso. It is alerting in these circumstances, but must not necessarily be a sign of infection.

My Windows before somehow got retail demo license.

Now this is a technology that is build to reset any changes to the Windows install to an immutable default. Most certainly it can be abused, but in itself can be misinterpreted too. If the PC previously got a demo-/storefront-setup using the service @CaffeineAddict linked above, the symptoms can again be a misinterpretation.

I don't see a way to analyse the behaviour remotely. As advised by @Condobloke you should seek professional local help to analyse what is happening, and not connect the PC to the internet meanwhile.