Hacked, is software embedded in SSD drive partitions? BIOS?

[GotInfluence]

Someone got software on my laptop. I found out when I was using it and someone began clicking through my files.

That's why I tried to re-intall Windows. However, I didn't remove it.

The SSD has 3 partitions and I can't delete or merge D & E, thinking this is where the software resides.

C (This PC)

D with 16.5 GB 48.9MB used.

E with 2GB, 15.9MB used.

When I tried to eliminate (or merge) D & E by right clicking, only (help) pops up.

Is there a way to re-configure this? Or is it possibly something in the BIOS?

Thanks!

[CherylG]

Make a Windows bootable flash drive. Your Windows 10 license key is embedded in BIOS and you can reinstall Windows any time. Microsoft provides the free Media Creation Tool to download files and create a Windows 10 usb flash drive.At least 8gb flash drive required:
https://www.microsoft.com/en-us/software-download/windows10

Select Download tool now, and select Run.
If you agree to the license terms, select Accept.
On the What do you want to do? page, select Create installation media for another PC, and then select Next.
Select the language, edition, and architecture (64-bit or 32-bit) for Windows 10.
The Guide here shows the steps.Pay attention to Step 5 if you will be using another pc. If you use the Probook leave it checked and it will make all of the correct selections for you.
https://www.tenforums.com/tutorials/2376-create-bootable-usb-flash-drive-install-windows-10-a.html
-------------------------------
When the flash drive is prepared insert it in a usb port. Power on the laptop and immediately start tapping Esc key. From the menu tap F9 key and use the arrow keys to move to and select usb. Tap Enter key.
When installing and you go through first few screens- choose Custom and select each partition and delete each. Install on the unallocated space left from that process.Continue with installation.It should pickup the key from BIOS but if it asks at any point just choose "I don't have a key". It will continue and should activate once you are online.

This will not include the original software from HP but most of it can be installed from your Support page.

[GotInfluence]

CherylG - this is strange, I have the following drives;

0 partition 1 MSR

0 partition 2 Primary (2TB HD)

1 unallocated space 360 MB (CAN'T DELETE) is this where the problem could be?

1 unallocated space 20.2 GB (CAN'T DELETE) is this where the problem could be?

1 partition 1 MSR

1 partition 2 Primary (250MB SSD)

1 partition 2 Recovery

1 partition 4 OEM (reserved)

1 partition 5 OEM (reserved)

Now how do I put them in the proper order, too?

Thanks!

[CherylG]

Just start with the last partition listed and highlight it then click the delete icon. Hopefully you will end up with one large unallocated space on which to install Windows.

[mdklassen]

>  I tried to re-intall Windows. However, I didn't remove [the "RAT" - Remote Access Trojan].

> The SSD has 3 partitions and I can't delete or merge D & E, thinking this is where the software resides.

> C (This PC)

> D with 16.5 GB 48.9MB used.

> E with 2GB, 15.9MB used.

Disconnect the Ethernet cable from your computer -- to prevent any Internet access by that RAT.

When installing Windows (from the USB memory-stick that the Other Person told you how to create), you should see the "where to install" screen.

From that screen, highlight a partition, and click "delete".

Repeat, until there are NO partitions of that volume.

At this point, there is nowhere left for the RAT to hide.

Then, select that "empty" volume as the target of the installation.

The Microsoft Windows Installer will divide the volume into the required partitions:

* the (tiny) "boot-manager" partition,

* the remaining (99%) partition, which will become the 'C:' drive.

Since you are NOT installing from HP-provided media, that "16.5 GB" partition will not be created.

[GotInfluence]

Yeah, I hate that these RATS are the Bubonic Plague of the computer world.

And thanks, but the DELETE is not available. There's no Red X to click on, it's grayed out.

Need a deeper solution than what normally appears as my choice with a fresh install.

[CherylG]

@GotInfluence

The Restore CD you can create from your Support page may work better to return all partitions to normal setup.

https://support.hp.com/us-en/drivers/selfservice/swdetails/hp-probook-440-g4-notebook-pc/10477248/sw...

If no joy Use Diskpart with Clean command on the SSD as outlined in the video here. If preferred, you can skip ahead with the part where he shows selecting Install since it is showing what doesn't work and then he backs up to show what to do. Just fast forward it a bit to get to part you need:

https://youtu.be/z4Z38pD1Gt0

[mdklassen]

---

@GotInfluence wrote:

And thanks, but the DELETE is not available. There's no Red X to click on, it's grayed out.

Need a deeper solution than what normally appears as my choice with a fresh install.

---

At that point in the Windows Installer where the disk-drive(s) and partitions are shown, I have NEVER had a problem clicking on any specific partition, and then clicking on "Delete".

Otherwise, the DISKPART.EXE, as recommended by the Other Person, will do the task.

As with any command-line interface, be really sure that you have the "focus" on the correct partition/volume.

[CherylG]

---

@mdklassen wrote:

When installing Windows (from the USB memory-stick that the Other Person told you how to create), you should see the "where to install" screen.

From that screen, highlight a partition, and click "delete".

Repeat, until there are NO partitions of that volume.

At this point, there is nowhere left for the RAT to hide.

---

Unless it is on the 1tb storage drive.

[mdklassen]

> Unless it is on the 1tb storage drive.

Good point.

But, if it exists, but on the "wrong" drive-letter, then the RAT cannot be launched from a "clean-install" of Windows.

Compare to holding a hand-grenade, with the safety-pin still attached.

While it is dangerous to do so, if the safety-pin is not "pulled", it's not fatal.

The Microsoft anti-virus in Windows 10 puts "bad" files into the "quarantine", where they cannot do any harm.