Member Avatar for cguan_77

hi guys, any ideas on how to remove the malware on a hidden partition?
i believe the malware resides on the hidden partition.

because i did a system factory reset, when i boot the laptop. There's already a word document on the load folder. (which i never created) and by right it should be empty because it's a system factory reset.

any tricks to remove the malware from the factory hidden partition?

it's a lenovo laptop. any help is greatly appreciated.

thanks.

  • 2 Contributors
  • 1 Reply
  • 190 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by rubberman

Dani AI

Generated

Short expert summary and safe plan

If a factory reset immediately returns files you didn’t create, the OEM recovery image used by that reset is almost certainly compromised — the hidden recovery partition contains the factory image and recovery tools, so resetting from it will rebuild whatever’s on that partition. Back up personal documents to an external drive (do not run executables from the backup), and make an image of the disk first if you want a forensics copy. (download.lenovo.com)

Preferred remedies (ranked)

  • Safest and fastest: obtain official recovery media or a clean Windows installer, boot it, delete all partitions and do a full reinstall. This guarantees you aren’t restoring the infected factory image. Use the vendor recovery option if you want the OEM drivers/apps, or use Microsoft’s installer to get a clean OS image. Always update the system immediately and run offline scans before restoring data. (download.lenovo.com)

Surgical removal of the hidden partition (if you must)

From a recovery/WinPE environment you can remove OEM/recovery partitions with DiskPart — but be extremely careful not to delete the EFI/System/MSR partitions. Example sequence (runs as admin from recovery media):

diskpart
list disk
select disk 0          <- verify the correct disk number
list partition
select partition X     <- the OEM/recovery partition
delete partition override
exit

If unsure, stop and get vendor support: deleting the wrong partition can make the machine unbootable. (learn.microsoft.com)

Drive sanitation and offline scanning

For HDDs a full zero-fill or DiskPart clean all will remove data. For SSDs overwriting is unreliable because of wear-leveling and over-provisioning — use ATA/NVMe sanitize or the drive vendor’s secure-erase tool (or follow NIST sanitization guidance) to properly purge an SSD. After sanitizing, boot a known-clean rescue environment and run an offline scan (for example Microsoft Defender Offline) before returning files. (csrc.nist.gov)

Notes: ’s point about scanning from outside Windows is sound; scanning helps find active remnants but won’t fix a poisoned recovery image. If the infection survives a full wipe+reinstall, suspect firmware/UEFI compromise and escalate to Lenovo support or replace the drive.

Member Avatar for rubberman

I've had to remove such for clients of mine. I use a Linux system with 2 or 3 different virus scanners when someone has these problems. The virus may have also infected the boot loader. In any case, running a Windows scanner will likely not totally remove this critter. On my Linux system, when I scan a Windows drive (I remove them from the client's system, plug them into a drive dock connected to my Linux system) I scan with ClamAV (good open source scanner), f-prot (industrial strength scanner), and McAfee for Linux. Each will find stuff the others don't. I especially look for things they ALL agree is a virus, and if 2 of the 3 agree, that also gets special consideration. Then, after removing the infected cruft, there is the matter of restoring the system to operational status. This is difficult when the recovery (hidden) partition for Windows has infected components. I keep a clean set available for a number of versions so I can restore the bad parts. As a professional, this is how I deal with these problems, and I have never had a client come back with the system still infected. I usually give them "the talk" about good network browsing habits, and such.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.