A515-55-Q3 How to re-flash bios after founding UEFI rootkit?

GOSHOPUSTINQKA
GOSHOPUSTINQKA Member Posts: 2 New User
edited July 2022 in Aspire Laptops
After in-depth scanning by ESET anti-virus, I got detection for EFI/CompuTrace. After quick googling I found that this is software embedded in the bios and is used for tracking the device in case of being stolen. But the problem is that is prone to hijacking by rootkits and etc. This is the first time I got this detection( and i scan my pc every week or two) and I never installed or activated this or any similar software. So I think i got rootkit(most likely from visiting some sketchy websites few days prior). One way to fix it is to flash new bios, but I got latest bios( my laptop is A515-55-Q3) and when I launch the zaui.exe you get Acer's drivers and software, it gives error "the version of the rom file is the same as the bios". Tried to install older bios but still didn't work. Does anybody knows other ways to re-flash my bios?

{Thread was edited to add model name to the title}

Best Answer

  • JackE
    JackE ACE Posts: 44,873 Trailblazer
    Answer ✓
    If I was as worried as you seem to   be, I'd probably first run a full scan with Microsoft's malicious software removal tool. It's updated regularly along with Windows Defender. Press WIN+R. Enter 'mrt'. Follow directions.

    If still not satisfied, I'd probably download and run the latest version of M c A fee's Stinger and run it's rootkit detection option. It's another standalone program like micro soft's MRT but a little more focused on rootkits.

    These scanners take a long time to run but I think better than risking a bricked machine or wiping the boot drive for what might very well be a false positive detection. In the latter case, I'd probably just buy a new boot drive to replace the old drive cuz they're real cheap these days. Then clean install the operating system on the new drive. And then copy my personal files off the old drive with a USB-to-SSD/HDD adapter since it's no longer the boot drive 

    Jack E/NJ

Answers

  • JackE
    JackE ACE Posts: 44,873 Trailblazer
    Trying to flash the BIOS this way is risky.  If an infection really exists --- which is very hard to conclusively detect despite what rootkit detector ads might claim ---- it would more likely be embedded in the operating system kernel or the hidden trusted EFI file partition on the boot drive. Flashing the BIOS would have little or no effect on what's on the boot drive.

    If you still want to risk bricking the machine for an infection that probably doesn't exist despite what the AV software thinks it detected, there is a procedure that must be followed to install the same or earlier BIOS version that's on your machine now.  The basic procedure is shown in this link.


    Jack E/NJ

  • GOSHOPUSTINQKA
    GOSHOPUSTINQKA Member Posts: 2 New User
    So I guess complete re-install of Windows is better option, if the infection is real?
  • JackE
    JackE ACE Posts: 44,873 Trailblazer
    Answer ✓
    If I was as worried as you seem to   be, I'd probably first run a full scan with Microsoft's malicious software removal tool. It's updated regularly along with Windows Defender. Press WIN+R. Enter 'mrt'. Follow directions.

    If still not satisfied, I'd probably download and run the latest version of M c A fee's Stinger and run it's rootkit detection option. It's another standalone program like micro soft's MRT but a little more focused on rootkits.

    These scanners take a long time to run but I think better than risking a bricked machine or wiping the boot drive for what might very well be a false positive detection. In the latter case, I'd probably just buy a new boot drive to replace the old drive cuz they're real cheap these days. Then clean install the operating system on the new drive. And then copy my personal files off the old drive with a USB-to-SSD/HDD adapter since it's no longer the boot drive 

    Jack E/NJ