In my post above I expressed a hunch the bios may have been tampered with. This leads me to suspect that my very BIOS has been tampered with, which is out of the scope of any software type infection that I know of, meaning a physical compromise seems to be the likely culprit here. Apparently there is an admin password set in BIOS that is preventing me from changing that setting (not set by me), which has confused the hell out of me, and a computer professional told me that the only way he knows how to fix it would be replacing the physical BIOS chip. It wasn't set that way a few months prior when I first installed linux on the system, so it must've been changed since then. I tried reinstalling the OS with a live CD on that machine, and it turns out that the BIOS has been configured to block booting from live media. Worth it I think!!Ĭlick to expand.Yes, I know all that, and I have been running anything remotely risky through a VM (all flash, any risky site, and all email), and NoScript should block most possible exploits on my host (which I feel is unlikely in the first place since the host only goes to very safe sites). Once prepared those actions take less than a minute and you always start 'clean'. In addition clone that VM back around once a week or so just as a double measure. Then when you log on you can 'snap' your VM back to perfectly clean removing any 'crap' from the previous session. When you create that last VM (the internet activity one) make sure and create a clean snapshot of it. Preventing a break out by malware, logger, etc. Properly configured you will keep any activity inside the VM protecting your host and any VM's chained before the last one. Let me encourage all reading along here to run VM's at the end of your connection chain. Just a paranoid fart at that point.Īlong with the OP's concerns this is an obvious one.

What have you used the machine for? If its only privacy I could live with cleaning it up, but if its MORE THAN THAT, I would personally replace the machine and move on. Do I flash back a clean bios to eliminate that possibility? I have no fear but I have done them a bunch. That's good from where I sit, but it does draw attention. so you obviously are trying to remain private in your pursuits. You mentioned that the machine was being used with vpn's, tor, etc. This would allow you to remove the software logger threat - BUT - not the threat of a physical invasion if that happened. I don't know what kind of backup protocol you have, if any, but without question I would blow away the drive contents and wipe the platter at least once. If you live in a dorm or share living quarters with a number of folks that have access to your place the odds go up! I am not looking to invade your privacy but before you fix this issue I would pause and consider how to avoid it in the future.

I can't tell how exposed your machine is based upon 'lifestyle'.

Hardware keylogger