🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: microsoft.public.windows.tabletpc
Article #6

Strange behavior of a new X41 TabletPC, Rootkit installed by Lenovo-IBM?

#6
From: Juan I. Cahis
Date: Fri, 07 Jul 2006 19:06
40 lines
3120 bytes
Dear friends:

I cannot create a MININT directory on C:\, I always get the "Access
denied" message. I use WinXP Pro (TabletPC) with SP2, and C: is
formatted with NTFS. My account has full Administrator privileges. I
have all the files unhidden. Also, I disabled any antivirus and any
other protection software.

I gave full access rights to EVERYONE for C:\, and the problem was the
same. I didn't have any problem, however creating any folder in C:\
with *another* name, or creating MININT in another folder than C:\

Please note that the problem is that *nobody* can create a folder
called MININT in C:\, even if you try to create it through a cmd.exe
window or through Windows Explorer.

I could circumvent the problem creating a directory called MININT0 on
C:\, then booting in Safe Mode, and then renaming it to MININT and
copying all the needed files into it, but now, when I am in normal
mode XP again, I cannot see MININT's contents.

As I could create the MININT folder without any problem when booting
in Safe Mode, I assume that there is some driver or service installed
by Lenovo-IBM that originates the problem. If you boot in Safe Mode,
this driver or service is not running.

But today, I ran Sysinternal's (Mark Russinovich's) Rootkit Revealer
for the first time in my X41-TP, and the whole MININT folder (and all
of its contents) was marked as a possible rootkit because it is
"hidden from Windows API".

My PC is an absolutely new IBM-Lenovo X41 TabletPC. Does Lenovo-IBM
install a Rootkit on their PCs that load when Windows starts in Normal
Mode? Is this a similar case of Sony's?

Any hint?
Thanks
Juan I. Cahis
Santiago de Chile (South America)
Note: Please forgive me for my bad English, I am trying to improve it!
Technical Details
Message-ID: <pmbta2p4qrvlpisuqtv557c86fhn8o44kb@4ax.com>
Path: arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!bcklog1.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mail

Show Full Headers
Complete Article Headers
X-Google-Thread: fe15d,c46fd4b69b483347,start
X-Google-Thread: 10d036,c46fd4b69b483347,start
X-Google-Attributes: gidfe15d,gid10d036,public
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news2.google.com!news4.google.com!border1.nntp.dca.giganews.com!nntp.giganews.com!bcklog1.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mail
NNTP-Posting-Date: Fri, 07 Jul 2006 14:06:09 -0500
From: Juan I. Cahis <jiclbchSINBASURA@attglobal.net>
Newsgroups: microsoft.public.windows.tabletpc,ibm.ibmpc.thinkpad
Subject: Strange behavior of a new X41 TabletPC, Rootkit installed by Lenovo-IBM?
Date: Fri, 07 Jul 2006 15:06:04 -0400
Reply-To: jiclbchSINBASURA@attglobal.net
Message-ID: <pmbta2p4qrvlpisuqtv557c86fhn8o44kb@4ax.com>
X-Newsreader: Forte Agent 3.3/32.846
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Lines: 40
X-Trace: sv3-t5X/jS045Gci6yQMfnERJhGYhFKQjAHh+1sbl3pU1bFSlxspcHJRTgIktwsLGfpmJ58ioQS2gcwkEeb!kPfYp2Fhgf4NEvSwJjBUpOEf0GqtpzRacFimurPXFBMXrdqR7MgEYg3KlX72Ax/PYhiHobQ=
X-Complaints-To: abuse@giganews.com
X-DMCA-Notifications: http://www.giganews.com/info/dmca.html
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.32