• ×
    Information
    Need Windows 11 help?
    Check documents on compatibility, FAQs, upgrade information and available fixes.
    Windows 11 Support Center.
  • post a message
  • ×
    Information
    Need Windows 11 help?
    Check documents on compatibility, FAQs, upgrade information and available fixes.
    Windows 11 Support Center.
  • post a message
Guidelines
The HP Community is where owners of HP products, like you, volunteer to help each other find solutions.
Archived This topic has been archived. Information and links in this thread may no longer be available or relevant. If you have a question create a new topic by clicking here and select the appropriate board.

‎10-30-2018 06:43 PM

HP Recommended
Product: Pavilion x360
Operating System: Microsoft Windows 10 (64-bit)

I stupidly allowed a scammer access to my computer - only for 5mins before I shut it down - and I fear he may have injected a keylogger or rootkit into it. I have hardly used it since and am using an old computer in the meantime.

 

An indepth ESET scan found Computrace in the UEFI/Bios. Both HP and Absolute have assured me this HP model was not pre-loaded with Computrace. Subsequent ESEST scans have not found it again.

 

A scan with GMER found : an "unkown MBR code".

 

A subsequent scan with MBRCheck found :

    238 GB  \\.\PhysicalDrive0   Unknown MBR code
            SHA1: 79FD7572A47915D4D6B28F9B2238ED620FEC4B2F
Found non-standard or infected MBR.

 

At https://forums.majorgeeks.com/threads/mbrcheck-found-non-standard-or-infected-mbr.247133/ - it says "It can be reported as UNKNOWN when you have an OEM system such as an HP or a DELL for instance. They may have used a custom/unique MBR for their use of a recovery partition."

 

So is that true, that the unknown code is an HP thing? I noticed that a Z drive appears now and then, is it to do with that? Or is this malware? And I'm worried that Computrace or a rootkit is still there too, hiding

 

All help gratefully received, thankyou 🙂

 

 

 

Archived This topic has been archived. Information and links in this thread may no longer be available or relevant. If you have a question create a new topic by clicking here and select the appropriate board.
† The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.
Didn't find what you were looking for? Ask the community
† The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the <a href="https://www8.hp.com/us/en/terms-of-use.html" class="udrlinesmall">Terms of Use</a> and <a href="/t5/custom/page/page-id/hp.rulespage" class="udrlinesmall"> Rules of Participation</a>.