x98 pro arrived fom GearBest riddled with malware

[TheChodax .]

Well, I took the plunge and ordered, didn’t take long to arrive with expedited deliver so I was very happy when it turned up. First impressions, very nice and smooth install, no flashing warning signs that something was wrong. However, having read that some people had received tablets with malware installed I decided to install Malwarebytes. This is where the problems started.

Malwarebytes found 4 serious problems, 2 of which were identified as PUP’s. It offered to clean and everything seemed ok but I decided to install Avast for a second opinion. Unfortunately Avast find nothing but exits the scan every time at 62% with no proper report. Ran Malwarebytes again, all clear so I stopped worrying.

 

Overnight Windows 10 installed a number of updates, one was very large and took a long reboot to finish. After that I started getting warnings from Edge browser that certificates for any sites such as BBC, Google etc were all invalid and my system may be compromised. It wouldn’t let me browse all. Avast’s safezone browser (re-badged Chrome) works ok but everything takes an age to load. I am now seriously concerned that there are some DNS hijacking shenanigans going on. Browsing feels just wrong, Edge won’t work but both Avast and Malwarebytes are saying all is ok.

Can anyone suggest how to proceed from here?

[Dirkblaster]

Maybe worth grabbing the factory image from the downloads section and reflashing windows from scratch (just in case recovery partition has malware inside too) if you’re concerned?

[mitrou]

is your time/date correct?

[TheChodax .]

Yep all fine, time is set correctly and stays correct after power cycle.

[TheChodax .]

Some suspicious stuff coming up with Spybot…

Attachments:

You must be logged in to view attached files.

[TheChodax .]

Have considered that but worried about ending up wrecking the tablet, going to exhaust cleaning it up before I take that route.

[TheChodax .]

So, it appears that although windows states I have administrator rights I can’t actually perform full administrator functions, have tried running sfc /scannow from the command line and it tells me I don’t have access rights. I then decided to create an additional account, it allowed me and I assigned administrator rights to that but I still can’t run the command I want.

 

Just to check I ran a full Malwarebytes with root kit scan enabled and the brand now account had 2 x PUP’s installed as per the picture. This is definitely looking the tablet has been compromised at root level so I’ll probably have to do a factory image install when I get a bit of time and hope that is clean. Have tried to download the images but the links appear to be dead in the download section.

Attachments:

You must be logged in to view attached files.

[pierre]

i find two with malwares bytes, anyway i wanted to reinstall windows in my language, i did it with the original version that i found in microsoft website, i just back up the original drivers for reinstallation after windows install 😉

[Author]

Posts