Virusscanner detects keylogger file in HP recovery partition

[PaulvandenB]

Hello,

My virusscanner detects keylogger file "PrivacyRisk.SPR/KeyLogger.N" in "E:\preload\install25.swm" in HP recovery partition. I cannot delete this file nor put it in quarantine. How do I remove this file?

Thank you.

[Riddle_Decipher]

@PaulvandenB

Welcome to HP Forums!

I have a few steps to help you out:

Please create a recovery media that could be used when in need: Click here for steps.

While HP does not recommend it, you can remove the recovery partition by performing the following actions. During the removal process, a reminder displays if Recovery disks have not been created.

1. Click Start, type Recovery in the search field, and click on Recovery Manager when it appears in the program list to open the Recovery Manager window.

2. Click Advanced options.

3. Select the Remove recovery partition option and click Next.

4. When prompted to verify that you want to delete the partition, select the Yes option, and click Next.

5. Allow the removal process to continue and restart the PC.

Related links

HP Notebook PCs - Using Recovery Manager

Let me know how that pans out,

If you feel I was helpful, simply click on Accept as Solution to help the community grow,

That said, I will have someone follow-up on this to ensure you've been helped,

Just in case you don't get back to us within 24 - 48hrs, and have a good day, ahead.

[PaulvandenB]

Dear Riddle_Decipher,

Thank you very much for your solution. Do I understand correctly that you advise to create a recovery medium so that I can remove the recovery partition? My hesitation with your appreciated suggestion is that in this way I always have to carry this recovery medium with me, in case something bad happens to my laptop.

Is it not possible to remove just a single file from the recovery partition? Something was also able to write a file onto it.

Thanks a lot. Kind regards,

Paul

[Riddle_Decipher · Accepted solution]

@PaulvandenB You don't have to carry the recovery media with you as such, what it would do is, once the partition is removed and you have any issues, the recovery media would recreate the recovery partition back on your computer, this time without the keylogger error as the new partition would be encrypted, and should normally contain only the files required to reinstall the OS, in the future (if need be).

I hope that answers your query,  

If it did, simply select "Accept as solution", to help the community grow, 

And if you wish to thank us for our efforts, click on the thumbs up for kudos.

Have a great day ahead.

[PaulvandenB]

Dear Riddle_Decipher,

That is a clear answer and will solve my problem. Thanks a lot for your help, that is much appreciated!

Kind regards,

Paul

[Riddle_Decipher]

@PaulvandenB I'm glad I could be of assistance,

And I appreciate your kind words, have a good day.