Windows malware on /boot from factory?
11-06-2019, 11:13 PM
I see you found my pinned thread, but I'll repost the contents of it here in case other people overlook it (or see the title of this thread and panic):
On some number of PBP systems (not all), the boot directory contains files belonging to the Sality class of Windows malware. It likely has been caused by one or more flashing/test stations at the factory which are infected by this malware. These files take the form of one or more .exe or .pif files with cryptic names, as well as an autoexec.inf file.
IT DOES NOT POSE ANY DANGER TO YOUR PINEBOOK PRO. Again, it is Windows malware, and can't run on Linux (especially ARM Linux!). However, in the interest of complete safety, MrFixit has pushed an update which includes a small script which tests for unexpected files in this boot partition and asks you if you wish to delete them. This script will only run once upon update, as the malware files can not reappear. The script is available here, if you wish to inspect it or run it on your own.
The factory will be notified of this issue, and hopefully it will not recur in the future.
On some number of PBP systems (not all), the boot directory contains files belonging to the Sality class of Windows malware. It likely has been caused by one or more flashing/test stations at the factory which are infected by this malware. These files take the form of one or more .exe or .pif files with cryptic names, as well as an autoexec.inf file.
IT DOES NOT POSE ANY DANGER TO YOUR PINEBOOK PRO. Again, it is Windows malware, and can't run on Linux (especially ARM Linux!). However, in the interest of complete safety, MrFixit has pushed an update which includes a small script which tests for unexpected files in this boot partition and asks you if you wish to delete them. This script will only run once upon update, as the malware files can not reappear. The script is available here, if you wish to inspect it or run it on your own.
The factory will be notified of this issue, and hopefully it will not recur in the future.
Community administrator and sysadmin for PINE64
(Translation: If something breaks on the website, forum, or chat network, I'm a good person to yell at about it)
(Translation: If something breaks on the website, forum, or chat network, I'm a good person to yell at about it)
