Lenovo PCs and Laptops seems to have hidden a rootkit in their BIOS The Chinese computer and laptop maker, Lenovo is once again in the eye of the storm after users have found that their PCs/Laptops are shipped with a hidden backdoor at the BIOS level. Earlier in the year, it was found that all Lenovo PCs/Laptops are shipped with a spyware called. The secret UEFI level spyware installer kit discovery was made by a user, on Ars Technica Forum. He had purchased a Lenovo G50-80 and did a clean install using a retail disc. However when he tried to reboot the system he got a pop up message saying “Note: This is from the product itself and not from the network. To help you continue to upgrade system firmware and software, in order to make your system more stable, safe and high performance, download and install the Lenovo system optimization software. The software download process needs to connect to the internet.

Click here to read the Lenovo License Agreement LLA” The popup has a option to either cancel, or to agree and install. However that is not the issue here. Since the user tried a clean install, he shouldnt be getting such a message in the first place. Gilmore Sans Font. This message may be a indication of UEFI/BIOS level spyware in the Lenovo PCs. Another user, found many entries in the Windows system which contain files like LenovoCheck.exe and LenovoUpdate.exe.

These entries appear again on reboot, even if the user deletes them “Uh oh – check your Services tab in Task Manager – “Lenovo Update” service is there and running for me (even though I said NO to the popup! Copybot Secondlife on this page. ) And there’s a bunch of crap in c: windows system32 like LenovoCheck.exe, LenovoUpdate.exe and various things in the registry. If you delete those files, or just overwrite them with junk, they reappear when you reboot. If you Disable the service, it is Running when you reboot! See this thread for someone else who noticed this, with more details – nobody believes him! He thinks it’s UEFI” Another user,, gave a detailed reply about how the files, LenovoCheck.exe and LenovoUpdate.exe are being created by Lenovo PCs and Laptops. He says that before booting windows 7 or 8, the BIOS checks if C: Windows system32 autochk.exe is the Lenovo one or the original Microsoft one. If it is not the lenovo one, it moves it to C: Windows system32 0409 zz_sec autobin.exe, and then writes it’s own autochk.exe.