On 2019-11-23 9:18 a.m., Paul wrote:
Rene Lamontagne wrote:
On 2019-11-23 12:26 a.m., Paul wrote:
Rene Lamontagne wrote:

It seems to be embedded in *some* UEFI bios and can be removed from
there, something about Armoury crate or some such.
no sign of it in this Asus B450F ROG Strix MB.
Will check my Son's Z390 MB in the next couple days.

Rene

Ah, some Whack-A-Mole fun.

Hope you brought the big mallet with you.

https://www.techpowerup.com/248827/a...s-installation


Â*Â*Â* "...UEFI BIOS, we managed to find a fairly nondescript option
Â*Â*Â*Â* "Download and Install ARMOURY CRATE app", ... not easy to find,
Â*Â*Â*Â* being located in the "Tool" section of the BIOS setup."

Â*Â*Â* "The ASUS UEFI firmware exposes an ACPI table to Windows 10,
Â*Â*Â*Â* called "WPBT" or "Windows Platform Binary Table". WPBT is used
Â*Â*Â*Â* in the pre-built OEM industry, and is referred to as

Â*Â*Â*Â*Â*Â*Â* "the Vendor's Rootkit."

Â*Â*Â*Â* Put simply, it is a script that makes Windows copy data from the
Â*Â*Â*Â* BIOS to the System32 folder on the machine and execute it during
Â*Â*Â*Â* Windows startup - every single time the system is booted. According
Â*Â*Â*Â* to the Microsoft WPBT reference, which describes this feature as
Â*Â*Â*Â* useful for "anti-theft software", this binary is a
Â*Â*Â*Â* "native, user-mode application that is executed by the
Â*Â*Â*Â* Windows Session Manager during operating system initialization.",
Â*Â*Â*Â* which means "before all other programs, with administrative
privileges".

Â*Â*Â*Â* This gives pretty much full control over everything, including
Â*Â*Â*Â* protected folders and the registry."

*******

If you run out of options, you could try investigating
aÂ* SRP for the named Asus executable(s). If there
is more than one service, then you could try to stop them
that way. "Software Restriction Policy" is supposed to
be able to prevent an executable from being run by the
loader. Maybe a Windows 7 user would use this.

http://mechbgon.com/srp/

Apparently Microsoft is removing SRP, so AppLocker is a
second option.

https://www.tenforums.com/tutorials/...dows-10-a.html


It just doesn't seem to be possible to make a good GUI
for these things. (Selecting "Security Principle" and such.)

Someone wrote a tool for configuring Windows 10 Home,
but the interface on it is just as unwelcoming as
a MSFT one :-)

Â*Â*Â* Paul

Got the SOB finally, As I mentioned ther was nothing in the UFEI bios
about Armoury crate anywhere.
But late last night I decided to go over the bios again with a fine
tooth comb (and a BIG mallet) and guess what I found?

In the UEFI advanced section, Under *Tools* was an item called
*Asus Grid Install Service* which was enabled, So not knowing what it
was for I decided to uninstall it and see what happens.

Â*booted back into Windows and everything was working normally, so
decided to call it a day and hit shutdown!!!

Well, to my surprise it shutdown in very few seconds! So this morning
I Cold booted again 4 or 5 times and I am now back to a repeatable 5
second shutdown, and no sign of Asusupdatecheck in the verbose mode.

So I removed Verbose Mode and all is now OK.Â* Jeez, What a pain in the
ass for Asus to leave that misnamed item in the enabled mode as default.

Thanks again Paul for all the help and pointers.

Rene

I guess Asus "hoped to entertain", and they succeeded.

"There is a puzzle in every box"

You'd think Asus would have learned some lessons
from the router episode. Of letting "features" compromise
what they ship.

https://www.ftc.gov/news-events/pres...d-services-put


Â*Â* Paul

As promised I was able to check my son's PC and find his was taking
about 22 seconds for shutdown.

So I checked the UEFI bios on his Asus Z390 Prime motherboard and Under
tools there was no Mention Of Armoury Crate or Asus grid install, But
there was an "Asus Q Installer" which was enabled, So I disabled it and
Rebooted and removed the AsusSetupcheck.exe file in System 32 then a
Cold boot and now it does a shutdown in about 7 seconds.
So another Asus problem solved.

Rene