I ordered this laptop for my mother on 03-23 and was delivered on 10-23. I built it and loaded Windows 11 Pro with Rufus with no issues. Unit has been working fine for her ever since. I did update the BIOS to 3.02 at some point since then. Last week she told me she is getting these popup errors that won’t go away. (Great, I know) I look at the unit and there is clearly some malware on it now. Her user account was a standard user and not an Administrator.
Here is where things get interesting. She said she tried to X them out to close them, but it didn’t work. Nothing is flagging with any of the malware scans run on it. But when it connects to the internet, the scam popups start nonstop. I figure no big deal; I will just roll it back to the setpoint I made when I set it up. Well, it removed it. But what is a first for me is when I tried to log into the admin account, it somehow removed the set password. I now have no access to an admin account. Not an issue I think, I will just reload Windows, or so I thought. I can’t restore windows from inside as it has changed the admin password.
Here is where I am now stuck. I cannot get it to load the Windows install start. I can get into the BIOS and I have turned off the boot from the current installed windows and just boot from USB. I Have tried using Rufus and using their version of Windows. I also tried loading it directly from Microsoft and running it. I tried this multiple times with the USB boot, I even fully formatted the USB drive between tries just in case. All this effort has gotten me 3 outcomes. 1: I get a fail notice. 2: It goes to [INFO] Launching 'efi\boot\bootx64.efi '… and will just hang. 3: It goes to [INFO] Launching 'efi\boot\bootx64.efi '… then the next line I get a _ and it hangs again. I have waited up to 20 min for something to happen and it never does in any of these.
I am at a loss at what is going on. It is almost like I just need to get a new SSD or somehow format it outside the laptop and try again. I would rather not hook this drive up to anything as this thing has the AIDS.
Sorry to hear your Mom’s machine has the ick. It probably has a rootkit installed too that is making things extra difficult.
Did you try creating the Microsoft Media Creation tool and booting from the USB it makes? I believe it gives you the option to fully format the drive and start over. It is not obvious though since it will “see” Windows is already installed and things you do not want to blow it away.
Alternatively, you can create Live USB for Ubuntu and have it wipe the drive like you are going to install Ubuntu. Then you can go back to the Windows USB and it should give you the option to wipe the drive and create a fresh install of Windows cleanly on the machine.
Those are two things I can think of off the top of my head. Going forward, have your mom buy a copy of F-Secure. The built in anti-virus for Windows is a little weak.
(This is just my personal reccomendation for Anti-Virius and threat protection; it is very hands off and not bloaty like a bunch of others out there)
This is a bootloader level problem. If you haven’t tried, use the official Media Creation tool to create your bootable USB. Rufus uses this UEFI_NTFS open source project to boot the Windows Installer which has some compatibility problems and isn’t secure boot compatible. Also maybe reset your BIOS.
There’s also a VERY slim chance that it’s got a compromised UEFI firmware. Those things exist…
You may also need to run an nvme secure erase on that stick – I can’t spot a LiveUSB linux (so no recommendation, I hope the Ubuntu LiveUSB) image that has the nvme-cli utilities that tell an NVMe SSD to ‘forget your encyption key for the storage you’re using and generate a new one, and consider all blocks as empty’.
Yeah it would not hurt to perform a complete deletion of that drive and reinstall just to make sure. If you feel that there is something on that drive you just don’t want to lose, search for “Malwarebytes Anti-rootkit scanner”. I love Malwarebytes and I hope this is the version that you can install on a thumbdrive (from a good computer) then stick in your moms FW and scan off of directly during boot (w/o booting into Windows at all).
I would have posted the link but I don’t want you to feel like anyone is trying to trick you into clicking into more malware.
Require is a very selective term. Like most people, she knows windows and at her age has no desire to try and learn anything else or deal with changes. So, I guess the answer is yes. LOL But from a software requirement standpoint, not really.
If you’re seeing that UEFI:NTFS v2.5 message even with the Microsoft official DVD image, you are not booting from the right device. The Microsoft official DVD image does not use UEFI:NTFS v2.5
Well, it seems to keep getting better. ROFL (not really) Loaded Ubuntu onto a USB using Balena. Hung up twice but it finally got to the language screen to load Ubuntu. Go down the line and I get to “erase disk” option.
This is strange as I selected the “erase disk” option. I go back and attempt to do it manually but I can never get the loader to allow the next button to be pressed no matter what I tried.
When it rains it pours. I know I can do dumb things at times, but I am fairly sure I am not getting hung up because something I am doing or not doing here. I am feeling to the point I think a hammer to this SSD is about my only option. I have wasted so much time on this had I had the hindsight I have now I would have just bought a new SSD. I have never had one kick me like this before. But I do not tend to wind up in this situation either.
Any other last-ditch ideas before I go full hammer time? Now where are those puffy pants…
You do not need to launch the Ubuntu installer to run the nvme-cli tools to erase your SSD. You can choose “Try Ubuntu” instead.
Alternatively, you can use System Rescue which is a little lower-level–still Linux!–and does not have a guided install process for you to get tripped up on.
Once you boot it, you can follow the steps in this AskUbuntu answer starting with sudo nvme list.
If you get an error stating sudo: command not found, you can leave sudo off (if using System Rescue).
Normally I would agree with you. If I load into the infected windows OS, the system “works fine” so to speak. The unit was working with no issue until it got infected. Whatever this infection is, is serious. As mentioned, it has removed the admin password while being used from a “user” account and many other things. It has also so far stopped me in my tracks from loading any OS. While I think the SSD is physically fine, it has what seems like government level spyware locking it down. Unless the malware has imbedded itself in the BIOS or some other hardware using a zero-day, I am at a loss at this point. This is not my field of expertise, but I know enough to be dangerous. That is why I am reaching out here.
If you’re going to erase the nvme drive anyway, any Linux boot disk would be enough, say arch, and then what you could do is overwrite the partition table so it can’t boot from the infected bootloader any longer.
dd if=/dev/zero of=/dev/nvme0n1 count=1 bs=1M
For example, should be enough to wipe out the bootloader. You might have to change what the of= to your specific hardware.
You can use lsblk to see what devices show up. There should be only 1 nvme drive.
Recently, I installed Windows 11 on two different machines and was surprised that BitLocker was mysteriously already turned on even though I had not activated Windows yet! My guess is that it is now enabled by default upon installation. The default installation just presumes everyone wants BitLocker and as soon as you activate Windows it gives you the full functionality.
Fortunately, I had already linked my token Microsoft account I use for basic installations and the recovery key had been uploaded. Why would I need the recovery key? Well when I went to dual-boot/install Ubuntu I was surprised that BitLocker was already turned on even though I had not done it. In the process of fiddling/investigating; the next time I tried to boot Windows it asked for my recovery key, ruh roh! What recovery key I thought? I pretended that I needed whatever was on the Windows installation and thankfully found the recovery key had been uploaded to the Microsoft account I used to install the OS.
The linux experts can probably expand further on manually formatting the SSD so you can start fresh again. I can not remember if I read this that Ubuntu sees BitLocker and halfway tries to not let you accidentally format the drive through some prompts.
If it turns out that the new SSD fixes all your issues and you haven’t destroyed the old one, I will buy the potentially-compromised one from you[1]. Seriously!
restrictions such as “I’m in the US” and “you’d be willing to sell it” apply (: ↩︎
I spent much time looking around the net on this issue. It seems to be a fairly common problem across many brands of equipment. THIS person was in the same boat on here. But unlike him, I made the USB using the Windows tool. And most of the posts across the internet never posted a resolution. After formatting and loading way wore times than I care to think about, I threw in the towel. I updated the BIOS and loaded Ubuntu, and it is doing fine. I have not given it back to her yet, so I have no idea how happy she is going to be, but I have spent far too much time on this. I still think there is something really nasty on this drive and I have no desire to plug it into anything to attempt to format it. I think it did embed into the old BIOS also, but I have no proof of that besides I was never able to load anything into it before updating the BIOS and new SSD. This is the drive. Amazon.com: Crucial P5 Plus 1TB PCIe Gen4 3D NAND NVMe M.2 Gaming SSD, up to 6600MB/s - CT1000P5PSSD8 Solid State Drive : Electronics All my mother does it check her mail, zoom her family, and watch stuff on it. It has had a very easy life.
It probably has a rootkit installed too that is making things extra difficult.
