Article View: microsoft.public.windows.tabletpc
Article #6Strange behavior of a new X41 TabletPC, Rootkit installed by Lenovo-IBM?
From: Juan I. Cahis
Date: Fri, 07 Jul 2006 19:06
Date: Fri, 07 Jul 2006 19:06
40 lines
3120 bytes
3120 bytes
Dear friends: I cannot create a MININT directory on C:\, I always get the "Access denied" message. I use WinXP Pro (TabletPC) with SP2, and C: is formatted with NTFS. My account has full Administrator privileges. I have all the files unhidden. Also, I disabled any antivirus and any other protection software. I gave full access rights to EVERYONE for C:\, and the problem was the same. I didn't have any problem, however creating any folder in C:\ with *another* name, or creating MININT in another folder than C:\ Please note that the problem is that *nobody* can create a folder called MININT in C:\, even if you try to create it through a cmd.exe window or through Windows Explorer. I could circumvent the problem creating a directory called MININT0 on C:\, then booting in Safe Mode, and then renaming it to MININT and copying all the needed files into it, but now, when I am in normal mode XP again, I cannot see MININT's contents. As I could create the MININT folder without any problem when booting in Safe Mode, I assume that there is some driver or service installed by Lenovo-IBM that originates the problem. If you boot in Safe Mode, this driver or service is not running. But today, I ran Sysinternal's (Mark Russinovich's) Rootkit Revealer for the first time in my X41-TP, and the whole MININT folder (and all of its contents) was marked as a possible rootkit because it is "hidden from Windows API". My PC is an absolutely new IBM-Lenovo X41 TabletPC. Does Lenovo-IBM install a Rootkit on their PCs that load when Windows starts in Normal Mode? Is this a similar case of Sony's? Any hint? Thanks Juan I. Cahis Santiago de Chile (South America) Note: Please forgive me for my bad English, I am trying to improve it!
Technical Details
Message-ID:
<pmbta2p4qrvlpisuqtv557c86fhn8o44kb@4ax.com>Path:
arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!bcklog1.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Thread: fe15d,c46fd4b69b483347,start X-Google-Thread: 10d036,c46fd4b69b483347,start X-Google-Attributes: gidfe15d,gid10d036,public X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!bcklog1.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mail NNTP-Posting-Date: Fri, 07 Jul 2006 14:06:09 -0500 From: Juan I. Cahis <jiclbchSINBASURA@attglobal.net> Newsgroups: microsoft.public.windows.tabletpc,ibm.ibmpc.thinkpad Subject: Strange behavior of a new X41 TabletPC, Rootkit installed by Lenovo-IBM? Date: Fri, 07 Jul 2006 15:06:04 -0400 Reply-To: jiclbchSINBASURA@attglobal.net Message-ID: <pmbta2p4qrvlpisuqtv557c86fhn8o44kb@4ax.com> X-Newsreader: Forte Agent 3.3/32.846 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Lines: 40 X-Trace: sv3-t5X/jS045Gci6yQMfnERJhGYhFKQjAHh+1sbl3pU1bFSlxspcHJRTgIktwsLGfpmJ58ioQS2gcwkEeb!kPfYp2Fhgf4NEvSwJjBUpOEf0GqtpzRacFimurPXFBMXrdqR7MgEYg3KlX72Ax/PYhiHobQ= X-Complaints-To: abuse@giganews.com X-DMCA-Notifications: http://www.giganews.com/info/dmca.html X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly X-Postfilter: 1.3.32