Score:-1

How to circumvent script Kiddee app?

ru flag
HHS

I have a Dell Inspirion 5558 running Ubuntu 20.04.02. While staying in a hotel ("free Wi-Fi") someone scooped up my username/password and used it to install a small script that, upon immediately booting past the Dell logo presents a page the claims it is from Dell Security and requests username/password to access the computer. The problem is that the entire screen is filled with a black border that offers no options, etc. I cannot get to any funtionality. Even when I boot and hit f12, a brief "preparing for one-time boot" appears it is then covered with this full-page screen. I can't get to the bios set-up to set the order of boot device (to format the disk). I'm stuck. Any suggestions on getting past or under this script?

Additional information posted as an answer

The former behavior was: power on, display Dell logo, go to page asking to unlock sda1 (with a password because the entire disk is encrypted), if that passes, go to normal Ubuntu user login.

Now the behavior is: power on, display Dell logo (it will not accept f12 so no access to BIOS to change boot order) then the page with the info box appears claiming to be a Dell security app claiming no access unless administrative password, etc. is entered on that page. There is NO way out of that page; I can't go further. I've removed the hard drive and the same behavior occurs so I think some hacker flashed some firmware. I removed the coin cell battery and shorted out its terminals. The machine started briefly, POST beeped 3d times, but the display was off. I've put the coin cell back in but i will take it out again and perform the suggested method of holding down the power button for 20 seconds or more (to drain any remaining charge). Then I will put the coin cell back in (but not the disk drive) and boot to see if the malware is still on the system. That's the only thing I can try. The fact that this malware display page isn't booting from anything (no HD, no CD, no USB,etc.) makes me think it is in firmware and is executed before any attempt to boot occurs. I will try to esc at the Dell logo to get to Grub but I think think the keyboard is disabled until the malicious page demanding admin password is displayed. I can fill in the line on that page with a bogus password but the page just reports the password is invalid and to try again. Nasty. If the malware is in firmware on the motherboard I don't know how to get to it.

Thanks

Artur Meinild avatar
vn flag
Can you get to the Grub menu? If not, then I'm afraid this hasn't got anything to do with Ubuntu, since it's activated before Ubuntu even starts.
guiverc avatar
cn flag
I'd suggest you apply all fixes & security upgrades, your details as provided imply you've not applied any for over a year (https://fridge.ubuntu.com/2021/08/27/ubuntu-20-04-3-lts-released/ shows the ISO date for 20.04.3, but installed systems received it a week before then) whilst a fully upgraded system reports itself as [20.04.5](https://fridge.ubuntu.com/2022/09/01/ubuntu-20-04-5-lts-released/) having done so for awhile.
ar flag
Based on the information you have put as an answer, the malware seems to reside in the UEFI or in the `/boot/` partition. If it is the latter, you should be able to boot from a live Ubuntu installation USB and use the **Try Ubuntu** option. At that point you will be able to examine the `/boot/` partition and the EFI System Partition.
Score:-2
as flag

There are a few ways to get around this issue:

  1. Use a live CD or USB to boot into a different operating system. From there, you can access your files and format the hard drive.

  2. If you can't boot into a different operating system, you can try using a bootable virus scanner. This will allow you to scan and remove the virus without having to boot into Windows.

  3. If you can't boot into a different operating system or use a bootable virus scanner, you can try using the Recovery Console. This will allow you to access the command prompt and fix the issue.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.