Odd Computer Reset

[Necromanhcer]

Hey guys! I know I am brand new to the forum but I am not brand new to the security field. Then again, I'm not close to a pro.

I have a computer that whenever you shutdown it will re-image itself and reset to a standard computer. You can locally logon or you can use a net logon. I was wondering how you'd go about RATing that. Would a rootkit remove the reset function but still leave it lookings like an ordinary one?

Thanks!

[barry99705]

Sounds like it's running a deep freeze like program, or it's netbooting an image.

[Broti]

Reminds me of some group policies we had at school back in the days of Win 2k.

[newbi3]

You would need to infect the image that the computer is booting from

Or infect the bios which isn't impossible but is definitely not easy

If you have access to the bios settings maybe there is a setting in there for network boot which you could disable

Edited January 13, 2015 by newbi3

[digip]

Sounds like it's running a deep freeze like program, or it's netbooting an image.

Or a VM that resets after every boot, like school training stations. Thin clients can be setup to do this, but I also thought of the DeepFreeze as you mentioned since I remember Johnny Long using it to protect workstations he setup for the schools in Uganda.

Either way, sounds like someone has a reason for doing this; even honeypots are setup like this sometimes.

@Necromanhcer - ask the admin who set it up ;)