Security and privacy Q&A

Community General Discussion
151

Bit the bullet, did a full clean install of Win11 on my SLS to eliminate any remaining concern. Typing this from the SLS, which feels snappier (just kidding).

The process:

  • Made a bootable USB from within Win11 on a known (likely…) good PC. Didn’t recall this, MS offers a media creation tool that downloads Win11 itself, so no need to download the iso first. Nice.
  • entered UEFI on SLS using vol-up + power and enabled boot from USB
  • hooked up external keyboard, since neither keyboard, trackpad, or touch screen worked initially
  • deleted every single partition on the SSD to eliminate any rootkits present (hoping there are no UEFI exploits yet for the SLS)
  • Created new partitions, installed Win11, updated, rebooted, updated, etc.

The result

Checked the event logs using Nirsofts FullEventLogView… Same errors! :rofl: Good grief… So either the hackers work at MS or these errors are linked to Win11 and/or my account.

  • same long list of errors that “data of type Windows.Data.Security.Vault.WebCredentials was corrupted and ignored” (over a 100 of these)
  • same list of issues with known folders missing (something like ten of these)
  • same list of ten warnings of the type “LSA package is not signed as expected. This can cause unexpected behavior with Credential Guard”
  • same suspect driver error: igd10iumd64.dll did not meet the Custom 3 Antimalware signing level requirements.
  • same long list of errors from Microsoft-Windows-WMI-Activity, of the type “Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive WHERE DeviceID LIKE ‘%PHYSICALDRIVE0%’; ResultCode = 0x80041032; PossibleCause = Unknown” (gee, thanks)
  • Short list of alarming “The driver detected a controller error on \Device\Harddisk1\DR1” errors (I’ll install Samsung Magician and see if there’s a firmware update).

Long story short, probably not hacked (yay), possibly power issues with the original 2TB SK Hynix SSD (boo) that I installed, which would explain the two hard crashes to the boot logo, or alternatively, possible hardware issues with the SLS itself. If the crash recurs, the SK Hynix drive might be innocent after all.

I’ll keep an eye on my system, but most likely this was all a giant waste of time, aside from replacing the SSD if that was indeed the thing causing the crashes.