Remove computer from malicious vm

LushJ1099-3671 5 Reputation points
2023-08-17T04:51:53.7433333+00:00

I believe my PC is running inside either a container or is a VM. I don't have much experience with virtualization. I did not install Virtualization software. I do not want nor did I ask for this. Computing has been my hobby for 28 years. Mostly Windows and in the last 6 or so years Linux and FreeBSD. But this has me stomped. Examples of my issue: 1) Using Dmidecode in Linux or Power shell Get-Computerinfo it details a Hyper-visor running. Device Manager View Options has a Device Container listing (Never seen that before) Keyboard is listed as PS/2 (Haven't seen that in years) All sorts of drivers, hardware, files that when i research VM software it matches what I have. I have gone as far as: 1: Disabling Virtualization in the BIOS. 2: Used Windows 10 Startup DVD Diskpart.exe to remove Volumes, Partitions, Clean drive, Format Drive. 3: Install System Image that was from initial startup of PC some 2 years ago. Upon Windows booting I immediately check MMC Event Logs, Services, Device Manager. I find events I've never ran into before. Examples: Kernel-XVD Loaded; Numerous Hyper-V initializations for I/O remapping, Hyper-V CVE mitigations, VBS Registry configs... Considering I used a system image from before the PC was ever hooked into internet and was disconnected from internet when I wiped and restored image it just doesn't make sense to me. It's like I have some sort of BIOS malware or a well hidden cluster on my drive. One last thing. When using a forensics Linux Distro I ran Testdisk. Im not 100% when dealing with hard drive pools, but it listed a Solaris ZFS pool that exceeds my 512GB drive. As in 123,950 TB !!!! And that Linux distro wouldn't boot unless I had Ethernet plugged in and the darn boot logs showed it connecting to 'SHITBOX' (Which is what I named the PC months ago and about 5 reinstalled os's later). Help!

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
11,072 questions
System Center Virtual Machine Manager
0 comments No comments
{count} vote

1 answer

Sort by: Most helpful
  1. XinGuo-MSFT 15,781 Reputation points
    2023-08-17T09:03:50.06+00:00

    Hi,

    Check system manufacturer by running the command "systeminfo | find /i "system manufacturer".

    If the output includes hardware manufacturers like HP, Lenovo, or Dell, it indicates a physical machine.

    If "Microsoft" is present in the output, it signifies a Hyper-V virtual machine.

    If "VMWare" is present, it indicates a VMWare virtual machine.

    0 comments No comments