[powereds]

I wouldn't trust them. Their computer bios does a software check on every boot and replaces a system32 file with their own spyware file (again, on every boot). I don't trust Lenovo one bit.

Posted via CB10

Which system32 file to be specific? Which systems are affected? Wouldn't it be detected if you run sfc /scannow?

"But I say this to you, love your enemies and pray for those who persecute you;" - Matthew 5:44

[Smitty13]

Any evidence?

Here's a decent summary of this issue: http://phoneia.com/lenovo-has-done-i...-on-their-pcs/

Additionally this is one of the originating forum posts that brought this issue to light: http://arstechnica.com/civis/viewtop...b014#p29497693

Also take into consideration that many intelligence/government agencies are now dumping Lenovo all together due to the numerous security concerns (Source: http://www.infosecurity-magazine.com...enovo-servers/ ), I think that speaks volumes to the proof we have.

While of course this could be at least partially politics at play, these issues have all been independently confirmed within the opsec/infosec communities.

Posted via CB10

[crackbrry fan]

Here's a decent summary of this issue: http://phoneia.com/lenovo-has-done-i...-on-their-pcs/

Additionally this is one of the originating forum posts that brought this issue to light: http://arstechnica.com/civis/viewtop...b014#p29497693

Also take into consideration that many intelligence/government agencies are now dumping Lenovo all together due to the numerous security concerns (Source: http://www.infosecurity-magazine.com...enovo-servers/ ), I think that speaks volumes to the proof we have.

While of course this could be at least partially politics at play, these issues have all been independently confirmed within the opsec/infosec communities.

Posted via CB10

How dare you speak truths! We don't care who is spying.!:-)

Posted via CB10

[Smitty13]

Which system32 file to be specific? Which systems are affected? Wouldn't it be detected if you run sfc /scannow?

"But I say this to you, love your enemies and pray for those who persecute you;" - Matthew 5:44

The system32 file in question is autochk.exe. Read more about how one user found out about this here.

To quote what this user reported:

Before booting windows 7 or 8, the bios checks if C:\Windows\system32\autochk.exe is the Lenovo one or the original Microsoft one. If it is not the lenovo one, it moves it to C:\Windows\system32\0409\zz_sec\autobin.exe, and then writes it's own autochk.exe. During boot, the Lenovo autochk.exe writes a LenovoUpdate.exe and a LenovoCheck.exe file to the system32 directory, and sets up a services to run one of them when an internet connection is established.

From what I understand it is only Windows systems affected as it is pushing a Windows binary so Linux systems would not be affected. Rootkits will try to make themselves persistent by writing registry keys and/or patching the drivers so it gets loaded at boot. Linux doesn't pull drivers from the BIOS at boot, nor does it have registry keys as Windows does.

And sorry, can't really answer the last part of your question as I do not have first hand experience in dealing with this. Definitely something to look into, though.