Lenovo smuggles unremovable software on to computers

Lenovo

has admitted using a feature to ensure that its software stays put on a Windows computer, even if the user has performed a clean install of the operating system.

This means that if Windows is reinstalled from scratch, the unwanted software is quietly added – without the user spotting it – when the computer next boots up.

Lenovo built a piece of code called the Lenovo Service Engine (LSE) into the firmware on the motherboard of laptops and desktop PCS made between October 2014 and April 2015.

This launches as soon as you turn on your PC, before Windows loads, making it extremely hard to remove.

It takes advantage of a feature called Windows Platform Binary Table (WPBT), a tool supported by Microsoft that is actually meant to help the installation of anti-theft software.

Lenovo was using it in a way it was never intended to be used. It’s not clear whether other PC manufacturers have also been exploiting WPBT to install their own unremovable software.

LSE replaces a Windows file named Autchk.exe with its own version. This creates another two files - Lenovoupdate.exe and Lenovocheck.exe - which then allow further files to be downloaded once the computer connects to the internet.

LSE downloads a program called Onekey Optimizer which, Lenovo says, is used for “enhancing PC performance by updating firmware, drivers and pre-installed apps”.

It also, rather ironically, scans “junk files” that harm your PC’S performance.

Over time LSE sends system data to a Lenovo server to help the company understand how people use its products. However, Lenovo claims this data can’t be used to identify individuals.

Worse, LSE contains a security vulnerability that leaves PCS open to attack by hackers. To fix this, Lenovo released a ‘Disabler’ tool to remove LSE from laptops ( www.snipca.com/17720, see screenshot left) and PCS ( www.snipca.com/17721). The company “strongly recommends” that users update their computers using these tools.

Lenovo has also revealed which PCS and laptops are affected: www.snipca.