You are not logged in.

Pages: 1 2

#1 2023-02-28 21:58:06

etc
Member
Registered: 2023-02-28
Posts: 16

[SOLVED] Compromised Laptop after Windows Update

Dear Community,

After searching the forums for hours without finding a solution I decided to make an account myself, hoping you people can help me as I am clearly not knowledgable enough to help myself.
I'll try making it quick - please keep in mind that I am by no means a Linux expert and that I might need some real noobie-advice.

I had a laptop with dual-boot Windows 10 and Arch, which was working fine. Yesterday I updated to Windows 11, which screwed up my boot (all I could see was grub rescue).
I then tried to reconfigure/reinstall grub - unfortunately I don't remember the exact steps, I used the "set prefix" command to choose the right partition and was able to "insmod normal" and "normal" then, which led me to my Arch installation. I then tried fixing the problem permanently by reconfiguring GRUB by reinstalling it and creating a new config file via mkconfig.

I managed to get it to work and even after restarting the system was able to load into Arch. I then booted Windows 11 and used it for a while and when I wanted to reboot to Arch, it announced another update. When the computer was starting up afterwards, I was at Grub rescue again. I tried following the same steps, but this time it didn't work (I can't remember the exact error message). I was still able to boot into Windows via boot manager and created a live USB.

I then tried to repair Grub via the live usb and I obviously managed to nuke my system somehow. I didn't touch any Windows-related files but tried to reinstall grub which led to various error messages, "symbol 'grub_debug_malloc' not found", not enough disk space on the EFI - which I tried to fix by removing Arch boot entries via efibootmgr -, cannot find EFI directory etc. I tried mounting the EFI partition correctly (it's a 100mb Windows one, so I didn't want to touch it directly) to /efi, trying to follow any advice, but when I tried to install Arch again (at that point I didn't try to save my old Arch installation anymore), I got the output that it was a "read-only" directory.

I gave up and wanted to boot into Windows, but now I couldn't even do that anymore. I don't even have a grub rescue anymore, all I get is the boot loader and when I try launching Windows from there, it doesn't work at all. I feel like I bricked my computer but I hope this is recoverable.

Last thing I tried was to use rescatux, but when I boot into the live USB I get the error message "invalid magic number" and "you need to load a kernel first".

I would be grateful for any advice as this is a dire situation for me. I will try to provide any information you might need.

Best,
Björn

Edit: Some updates and precisions. I tried again, doing the following:

Booted into the live USB

Connected to network

lsblk

giving me an output of 4 partitions under /dev/nvme0n1:

/dev/nvme0n1p1 259:1 100M (win EFI)
/dev/nvme0n1p2 259:2 16M
/dev/nvme0n1p3 259:3 366.2G (win partition)
/dev/nvme0n1p4 259:4 98.9G (arch partition)

mount /dev/nvme0n1p4 /mnt
arch-chroot /mnt
grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=arch

with the result:

Installing for x86_64-efi platform.
grub-install: error: cannot copy '/boot/grub/x86_64-efi/core.efi' to 'efi/EFI/arch/grubx64.efi': No space left on device.

---

By the way, here is the 

efibootmgr -v

output, if it helps any:

efibootmgr

Sorry for the picture, I obviously can't copy the output.

Also, when I run: 

grub-install --removable

I get the output: 

grub-install: error: cannot find EFI directory.

Last edited by etc (2023-03-03 23:12:28)

Offline

#2 2023-03-01 01:43:03

V1del
Forum Moderator
Registered: 2012-10-16
Posts: 25,255

Re: [SOLVED] Compromised Laptop after Windows Update

Thanks for the actually actable precision, i was about to ask for actual output instead of paraphrasing as there was nothing of use in the original post.


Your command to mount the root filesystem lacks the /dev/ prefix i.e. 

mount /dev/nvme0p4 /mnt

You need to mount the ESP before running the GRUB install commands, before doing the arch-chroot 

mount /dev/nvme0n1p1 /mnt/efi

(or mount directly to /efi after the chroot), after which the grub-install command should generally start working. Depending on how things were setup originally you might also have to reinstall the kernel package so the images are correctly generated and regenerate the GRUB config with 

grub-mkconfig -o /boot/grub/grub.cfg

Last edited by V1del (2023-03-01 01:45:19)

Offline

#3 2023-03-01 01:58:02

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

Hi V1del, thanks for your reply and yes, I realised the original post was lacking a bit, I apologize.
As I have to copy everything manually, that unfortunately leads to mistakes. I did include /dev in my arguments, just forgot to write it out in my post.
If I do as you say, the first issue I encounter is grub-install telling me there is no space left on the device.

Offline

#4 2023-03-01 07:34:17

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 76,358

Re: [SOLVED] Compromised Laptop after Windows Update

grub-install telling me there is no space left on the device

/dev/nvme0n1p1 259:1 100M (win EFI)

"Yes."

https://wiki.archlinux.org/title/EFI_system_partition#Create_the_partition wrote:

The partition size should provide adequate space for storing boot loaders and other files required for booting.

To prevent interoperability issues with other operating systems[1][2] it is recommend to make it at least 300 MiB. For early and/or buggy UEFI implementations the size of at least 512 MiB might be needed.[3] If you plan to install multiple kernels and either mount the partition to /boot or pack the kernels in unified kernel images, you can use 1 GiB to be on the safe side.

ls -lhR /mnt/efi

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#5 2023-03-01 09:10:58

V1del
Forum Moderator
Registered: 2012-10-16
Posts: 25,255

Re: [SOLVED] Compromised Laptop after Windows Update

Note that you can easily provide actual outputs as long as you have an internet connection on the live USB: https://wiki.archlinux.org/title/List_o … n_services

Offline

#6 2023-03-01 12:29:12

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

Hi seth,

seth wrote:

grub-install telling me there is no space left on the device

/dev/nvme0n1p1 259:1 100M (win EFI)

"Yes."

https://wiki.archlinux.org/title/EFI_system_partition#Create_the_partition wrote:

The partition size should provide adequate space for storing boot loaders and other files required for booting.

To prevent interoperability issues with other operating systems[1][2] it is recommend to make it at least 300 MiB. For early and/or buggy UEFI implementations the size of at least 512 MiB might be needed.[3] If you plan to install multiple kernels and either mount the partition to /boot or pack the kernels in unified kernel images, you can use 1 GiB to be on the safe side.


I followed the installation guide on the wiki: https://wiki.archlinux.org/title/installation_guide, taking into account the warning:

Warning: Only format the EFI system partition if you created it during the partitioning step. If there already was an EFI system partition on disk beforehand, reformatting it can destroy the boot loaders of other installed operating systems.

I chose to mount grub not on /boot/efi, but on /efi which is supposed to help with the issues of device space: https://wiki.archlinux.org/title/Dual_boot_with_Windows

Windows Setup creates a 100 MiB EFI system partition (except for Advanced Format 4K native drives where it creates a 300 MiB ESP), so multiple kernel usage is limited. Workarounds include: Mount ESP to /efi and use a boot loader that has file system drivers and is capable of launching kernels that reside on other partitions.

Also, it worked just fine until the update and the error message for 

grub-install --removable

is 

grub-install: error: cannot find EFI directory.

So I do wonder whether that is the real reason. But if it is, I would of course appreciate any hints as to how to resolve it.



V1del wrote:

Note that you can easily provide actual outputs as long as you have an internet connection on the live USB: https://wiki.archlinux.org/title/List_o … n_services

The issue is that I can't even access my GUI. I tried launching xfce4 from the boot USB today, mounting 

mount /dev/nvme0n1p4 /mnt

and going 

arch-chroot /mnt

then 

startxfce4

giving me an error message (in the graphical interface but impossible to interact with it) 

Unable to contact settings server. Could not connect: No such file or directory

I'll try looking into a command line only solution using your link though!


Thanks for your replies so far!

Edit: 

ls -lhR /mnt/efi

gives the output: 

/efi:
total 96M
drwxr-xr-x 3 root root 1.0K Feb 28 20:56 EFI
drwxr-xr-x 2 root root 1.0K Mar 10  2022 System Volume Information
-rwxr-xr-x 1 root root  53M Feb 28 22:00 initramfs-linux-fallback.img
-rwxr-xr-x 1 root root  32M Feb 28 21:59 initramfs-linux.img
-rwxr-xr-x 1 root root  12M Feb 28 21:59 vmlinuz-linux

/efi/EFI:
total 12M
drwxr-xr-x 95040 root root 12M Feb 28 22:28 arch

/efi/EFI/arch:
total 213G
-rwxr-xr-x      1 root root 528M Nov  7  1980 g8ò└f.╢└
-rwxr-xr-x      1 root root 919M Nov  7  2048 δä█tf.9╩u
-rwxr-xr-x      1 root root 201M Jan  8  2031 gfëL$g.fï
-rwxr-xr-x      1 root root 1.8M Jan 31  2031 .f1
d?????????      ? ?    ?       ?            ? f╖äb.f9┬
-rwxr-xr-x      1 root root 1.1G Nov  6  2048 gÇd$≡g.çd$
d?????????      ? ?    ?       ?            ? f1└gfëD.$f
-r-xr-xr-x      1 root root 2.2G Nov  6  2010 	fë≡fφ╘².  f
-rwxr-xr-x      1 root root 3.8G Jan  6  1981 
.
d?????????      ? ?    ?       ?            ? ä¿.fVf
-r-xr-xr-x      1 root root 1.7G Jan  7  1980 ìö
-rwxr-xr-x      1 root root  44M Nov  7  1980 ò├f╢█f.cδ
-rwxr-xr-x      1 root root  77M Jun  6  1983 f[f^f├ç.>ⁿ?
-rwxr-xr-x      1 root root 581M Nov  6  1992 tgfâd$.x■g
-r-xr-xr-x      1 root root 2.2G Jan 31  2097 $f)≥f╙.fâε
-rwxr-xr-x      1 root root 3.1G Nov  6  2025 f╕.ë±
d?????????      ? ?    ?       ?            ? P@¿ uf.nt
drwxr-xr-x 146405 root root  19M Jan 17  2076 gèffâ╚. <x
-rwxr-xr-x      1 root root 1.7G Jan 17  2088 fΦb   f.╕
-rwxr-xr-x      1 root root 3.2G May  8  1981 ¿tfφ╛.   
-r-xr-xr-x      1 root root 211M Nov  2  2035  and pre.ss
-rwxr-xr-x      1 root root 131M Jan  4  1986 $gfìT$.gfì
-rwxr-xr-x      1 root root 1.7G Sep 16  2031 $fFδágf.â|$
-rwxr-xr-x      1 root root 216M Apr 13  2014 $gfìT$v.f╣R
-rwxr-xr-x      1 root root 1.6G Aug  1  2031 $<.fìT
-rwxr-xr-x      1 root root 791M Jul 10  2037 $f1╥fë┴f.≈╤g
-rwxr-xr-x      1 root root 1.7G Jan 28  2093 $  g╟D$.  
-r-xr-xr-x      1 root root 1.6G Aug  4  2031 $    gç}
-r-xr-xr-x      1 root root 2.9G May  2  1980 )∙gfïgf.ë
f
-rwxr-xr-x      1 root root 253M Feb  1  2107 *gfì\$.fj@
-rwxr-xr-x      1 root root 3.7G Apr  2  2081 1█î╦f┴π.f
-rwxr-xr-x      1 root root 360M Mar 11  2103 ;f1÷gf╛.U
-rwxr-xr-x      1 root root 2.4G Jan 15  2059 <$.$g
-r-xr-xr-x      1 root root 801M Jan  1  2047 ?fü·inet.uhf
-r-xr-xr-x      1 root root 2.1G Mar  7  2031 @.f1└
-r-xr-xr-x      1 root root   21 Apr  9  2093 @BfëαfΦL.
-rwxr-xr-x      1 root root 3.4G Mar  6  2023 Afâ°û└.f╢
-rwxr-xr-x      1 root root 581M Feb  4  1998 D$xg╟D$~.J
-rwxr-xr-x      1 root root 4.0G Nov  6  2072 EgèU.Å
-rwxr-xr-x      1 root root 1.6G Oct  2  2031 Hfú└@gfï.D$<
-rwxr-xr-x      1 root root  17K Aug  8  2031 HgfìT$f.╕
-rwxr-xr-x      1 root root 581M Apr  3  2092 L$pgèT$x.fâΓ
-rwxr-xr-x      1 root root 2.2G Apr  1  2105 Nfâ°tVf.ht
-rwxr-xr-x      1 root root    0 Jan  1  1980 P`.reloc
d?????????      ? ?    ?       ?            ? P∞  fâ>á.?~
-r-xr-xr-x      1 root root 1.6G Jul 31  1998 XäΘΩ.fâΩ
-rwxr-xr-x      1 root root 241M Feb  2  2031 [f^f_f]f.├fu
-rwxr-xr-x      1 root root 3.4G Nov  6  2048 \f[f^f_f.]f├
-rwxr-xr-x      1 root root 1.2G Feb  5  1998 ]g÷d$xt.
fi
-rwxr-xr-x      1 root root 1.6G Jan  4  2046 ^ &t@fâ─.,f[
-rwxr-xr-x      1 root root 1.1G Aug 16  2031 `M.$Ç
-rwxr-xr-x      1 root root  22M Feb  1  2107 d$φgfì.L$,
d?????????      ? ?    ?       ?            ? f╖D$H=.<w
-rwxr-xr-x      1 root root 2.9G Mar  8  2031 f╢└fë≥f. T
-r-xr-xr-x      1 root root 1.7G Jan  3  2031 f)┬fà╥~	.g╞
-r-xr-xr-x      1 root root 3.1G Jan  1  1980 f1÷δ9f╣
-r-xr-xr-x      1 root root 2.2G Mar  7  2031 f9╓|fë╚.f≈╪
d?????????      ? ?    ?       ?            ? f9╩uf1└.f├f
d?????????      ? ?    ?       ?            ? fYf¥f1╩f.à┬
-rwxr-xr-x      1 root root 1.4M Nov  6  2079 f]f├εf├f.ë┬∞
-rwxr-xr-x      1 root root    3 Apr  9  2105 fwfvfsfq.fë├
-rwxr-xr-x      1 root root 3.7G Jan  4  2014 f£á¿.f`ⁿ
-rwxr-xr-x      1 root root 1.7G Aug  6  2031 fà└t<fë├.fë≡
-rwxr-xr-x      1 root root 1.5G Jan  1  1980 fà█ufhw.;
-rwxr-xr-x      1 root root 1.7G Mar 28  1998 fâ|$lt-.fë·
-rwxr-xr-x      1 root root 4.0G Apr 16  1980 fâφójbg.fâD
-rwxr-xr-x      1 root root 4.0G Jan 17  2085 fâ╚ δf1.└f[
-rwxr-xr-x      1 root root 1.9G Apr  1  2031 fë∞?f1÷.f╕
-rwxr-xr-x      1 root root 1.7G Jan 25  2087 fë√f)├f9.┌}	
d?????????      ? ?    ?       ?            ? fë╚gfï\$.gè
-r-xr-xr-x      1 root root  65M Jun  3  2031 fìL$gfï.T$
-rwxr-xr-x      1 root root 1.6G Aug  1  2031 fìd$fφ.
-rwxr-xr-x      1 root root 1.6G Jan  4  2031 fìhgfël.$g
-rwxr-xr-x      1 root root 3.2G Mar 21  2001 fïd$tgfë.$g
-rwxr-xr-x      1 root root 1.9G Dec  2  1998 fΦ¢.┬fà
-r-xr-xr-x      1 root root 1.6G Feb  1  1987 fΦ╖⌠  fë.├f╜
-r-xr-xr-x      1 root root 2.1G Feb  1  2031 fΦ╗.gfì
-rwxr-xr-x      1 root root 1.6G Jan 25  2031 fφ@·  fë.├fâ
-r-xr-xr-x      1 root root 143M Mar 21  1983 f┐.f1 
d?????????      ? ?    ?       ?            ? f├f├fUfW.fVf
d?????????      ? ?    ?       ?            ? f╕`p.$f
-rwxr-xr-x      1 root root  13M Feb  2  2031 f╣R.ï|$
-r-xr-xr-x      1 root root 1.7G Feb  2  1980 gf╖î$û
-rwxr-xr-x      1 root root 783M Apr  5  2076 gfëd$gf.╛
-rwxr-xr-x      1 root root  15K Oct 27  2107 gfìD$fΦ.╝
-rwxr-xr-x      1 root root 1.7G Mar 19  2031 gfìL$f║.;
-rwxr-xr-x      1 root root    0 Mar  1 02:54 grubx64.efi
-r-xr-xr-x      1 root root 1.9G Nov 23  1995 gèD$]gêD.$|f
-rwxr-xr-x      1 root root 2.0G Nov  6  1980 gèT$`gfì.ò
-rwxr-xr-x      1 root root 2.2G Jun  3  2031 gèt$gêp. δΦ
-r-xr-xr-x      1 root root 1.6G Jan 16  2005 iàτ.ê?c
-r-xr-xr-x      1 root root 1.7G Jan  9  2031 if)┴fë°ä.└t
-rwxr-xr-x      1 root root 4.0G Jan  1  1995 i└q┴.Θ≤
-rwxr-xr-x      1 root root  98K Nov  6  2021 ound...

-r-xr-xr-x      1 root root 124M Aug  5  1987 rHàª.>ê?
d?????????      ? ?    ?       ?            ? tygfï\$.f9δ
-rwxr-xr-x      1 root root 2.1G Jan  1  2031 u,fk√fü.╟0C
-rwxr-xr-x      1 root root 1.7G Jan  4  2016 u@gfïT$D.gfï
d?????????      ? ?    ?       ?            ?   δ∞fë±f.)╤f
-rwxr-xr-x      1 root root 1.4G Apr  1  2042   gfïD$<.gfë
d?????????      ? ?    ?       ?            ?    fX.<╟
drwxr-xr-x  84049 root root  11M Feb  1  1980    fë╟÷.│?
d?????????      ? ?    ?       ?            ? £á¿f`â.∞,ë
-rwxr-xr-x      1 root root 2.2G Mar  7  2031 ¬à╘.$gê
d?????????      ? ?    ?       ?            ? °uf╕
d?????????      ? ?    ?       ?            ? Çtï$ü.┬
-rwxr-xr-x      1 root root 1.3G Jul 26  2001 â∙	w*gf .D$
-rwxr-xr-x      1 root root 255K Aug  1  2097 â├gÇ|.1ö
d?????????      ? ?    ?       ?            ? â╧@fëεδ█.Ç·-
-rwxr-xr-x      1 root root 3.1G Jan 23  2107 çGgfì|$.fj
-rwxr-xr-x      1 root root  73M Feb  1  1987 çî.fë
-rwxr-xr-x      1 root root 1.7G Nov  6  2009 é╕<.4g
-rwxr-xr-x      1 root root 4.0G Jan  1  1980 êBfΦA∙  .fíê
-rwxr-xr-x      1 root root 1.8G May 24  1991 ëαfφ
.g╞d
-rwxr-xr-x      1 root root 1.4G Jun  7  2014 ëαfφo	.g╟d
-rwxr-xr-x      1 root root 4.0G Jan  1  1980 ëαfφo.g╟d
d?????????      ? ?    ?       ?            ? ë∙gfïD$.gfï
-r-xr-xr-x      1 root root 1.1G Jan 10  2042 ë┬fâτuH.fë╪
-rwxr-xr-x      1 root root 4.0G Apr  9  2084 ë╨f)╚f├f.ufw
-rwxr-xr-x      1 root root 1.6G Nov 22  2002 ìf╣
-r-xr-xr-x      1 root root 3.4G Aug  1  2031 ìHgfëL$.fW
-rwxr-xr-x      1 root root 3.7M Feb 21  2031 ìcfpfh▒.9
-rwxr-xr-x      1 root root 1.7G Sep  9  2076 ìrgfìP.gfï
-rwxr-xr-x      1 root root 1.9G Jun  2  2031 ìÇ:.ì
-rwxr-xr-x      1 root root 3.7G Mar 21  2094 ï$f)╨f9.┌r
d?????????      ? ?    ?       ?            ? ïD$f┴α.gfì
d?????????      ? ?    ?       ?            ? ÷gfï$gf.ëD$
-r-xr-xr-x      1 root root 1.6G Feb 22  2031 ú╠@fΦæ· . fφ
d?????????      ? ?    ?       ?            ? Φ.fà└
-rwxr-xr-x      1 root root 2.6G Jan  1  1980 Φf%≡.f╚
-r-xr-xr-x      1 root root 1.9G Apr  4  2059 αfë╦f1└f.1÷f
d?????????      ? ?    ?       ?            ? δf║x;.fφo
-rwxr-xr-x      1 root root    0 Jan  1  1980 δjHdrS
d?????????      ? ?    ?       ?            ? π8.fWf
-rwxr-xr-x      1 root root 1.6G Nov 20  1982 φk.
-r-xr-xr-x      1 root root 1.6G Nov 14  2028 φn   δφf.[f├
-rwxr-xr-x      1 root root 3.7G Jan 11  1989 ⁿ  f╖ä.Bf
-rwxr-xr-x      1 root root 2.3G Dec  3  2095 ∞gfë$g.fëL
-r-xr-xr-x      1 root root 3.7G Mar  7  2072 ∞  gèD$H.óKB
-rwxr-xr-x      1 root root 247M Jan 22  2101 ≤ªò└f╢.└f^
d?????????      ? ?    ?       ?            ? ─fëΩf T.@fë
-rwxr-xr-x      1 root root 584M Feb 20  2012 └f p@gê.D$
d?????????      ? ?    ?       ?            ? └fë·f T.@f
-rwxr-xr-x      1 root root 1.1M Jan 27  1980 └gfïd$u.fâ
-r-xr-xr-x      1 root root 3.2G Mar  7  2096 └tfü√ç
-r-xr-xr-x      1 root root 1.6G Nov  6  1987 ┘<$gâ|$
-rwxr-xr-x      1 root root 1.1G Jun  7  2031 ├gfâ|$
d?????????      ? ?    ?       ?            ? ├VWë╟ë╓Q.┴Θ
d?????????      ? ?    ?       ?            ? ├fUfëσfW.fVf
-rwxr-xr-x      1 root root 1.4G Jun  3  2031 ┬f	╨f╢└.f≈╪
drwxr-xr-x  91166 root root  12M Feb 28 22:30 ═δ≥1└═.═Ω
-rwxr-xr-x      1 root root  12M Oct  1  1981 ║¼?
-rwxr-xr-x      1 root root 3.2G Nov  7  2048 ╕.   
-rwxr-xr-x      1 root root 2.9G Jan  1  2031 ╖╥f1└f .T@g
-rwxr-xr-x      1 root root 1.9G Jan 22  1981 ╗└9.gfï
-rwxr-xr-x      1 root root 1.7G Nov  7  2044 ╛±
d?????????      ? ?    ?       ?            ? ╞0fCδf.â²
d?????????      ? ?    ?       ?            ? ╞ δ∞f1.└fà
-rwxr-xr-x      1 root root 3.3G Mar  2  2031 ╢ê├╙t.	fA
d?????????      ? ?    ?       ?            ? ╢└f^f_f├.fWf
-rwxr-xr-x      1 root root 1.1K Mar  7  2031 ╥f≈⌡fë┴g.fïd
-rwxr-xr-x      1 root root 3.1G Sep 17  2080 ╦f)╙fà█~.	g╞
-rwxr-xr-x      1 root root 1.1G Feb  5  1998 ╦φ  fφ╟∞.  g
d?????????      ? ?    ?       ?            ? ╧fë╨f[f├.fUf
d?????????      ? ?    ?       ?            ? ╨δßgfìn.gfï
-r-xr-xr-x      1 root root 2.2G Oct  8  2107 ▀gfï$f.╪fë
-r-xr-xr-x      1 root root 1.5G Apr  9  2018 ▀gfïd$f.≈τf
-rwxr-xr-x      1 root root 1.6G Jan 11  2031 ▀ç∙ltgf.╟d$

/efi/EFI/arch/gèffâ╚. <x:
total 12G
d????????? ? ?    ?       ?            ? ▒O╝∞÷╧.å╚
d????????? ? ?    ?       ?            ? 	ßì36î>│.ÄÖë
d????????? ? ?    ?       ?            ? Γ¥ çΩµ.pw
-rwxr-xr-x 1 root root 3.5G Oct 20  2004 $v╫O ┼	.╖Y¢
-r-xr-xr-x 1 root root 159M May 31  2101 (╥!╘╕c║».°_⌐
d????????? ? ?    ?       ?            ? 8T╤ï¢
╜.ß~M
d????????? ? ?    ?       ?            ? ;n▀â½_.|▐
d????????? ? ?    ?       ?            ? RôxáZàí7.Σæ╕
-rwxr-xr-x 1 root root 834M Nov 15  2025 WÆùçΣⁿ╫è.z{ä
d????????? ? ?    ?       ?            ? {)╘FGÉ.┌Γ│
-r-xr-xr-x 1 root root 1.8G Mar  4  2079 ¼▀ïΘ╙i╔.å6;
-rwxr-xr-x 1 root root 2.1G Oct 26  2091 ¼.╗ü╖öÜ▄.;z
-r-xr-xr-x 1 root root 1.2G Dec  5  2014 ½ÿûò╡╔═.⌐▄
d????????? ? ?    ?       ?            ? ë≤4╛·2`ë.┤φε
d????????? ? ?    ?       ?            ? Σ╟n╛N▄¥.½╣*
d????????? ? ?    ?       ?            ? δ─
÷╔╪).o(
d????????? ? ?    ?       ?            ? ₧d╖░3%.σαs
-rwxr-xr-x 1 root root 2.1G Feb 28  1983 ┴iâv6╙d.ñ<6
d????????? ? ?    ?       ?            ? ╬╟"ⁿ¿{.kj«
d????????? ? ?    ?       ?            ? ▒├w,'DΦ

/efi/EFI/arch/   fë╟÷.│?:
total 61G
d????????? ? ?    ?       ?            ? τ╠]KÖ4.│í
-r-xr-xr-x 1 root root 3.6G Nov  5  2075 4ôu╖|.G»╤
d????????? ? ?    ?       ?            ? g╚)╨óg.+j4
-rwxr-xr-x 1 root root 1.4G Dec  8  2012 ≡++H▀╪.$
-rwxr-xr-x 1 root root 2.3G Nov  4  2016 Γ0FnSvê.τÿ
d????????? ? ?    ?       ?            ? ª½φ╔=║.E"ï
-rwxr-xr-x 1 root root 2.9G Sep  4  1990 E≤ßïÖ:φ.2
d????????? ? ?    ?       ?            ? ▓┘Fpb@.^5l
-r-xr-xr-x 1 root root 3.3G Jun 30  2072 "M`<╒{^.6╡ª
-r-xr-xr-x 1 root root 2.2G Jan 12  1984 $ü╔⌐L.hΩ
d????????? ? ?    ?       ?            ? *δ├4#.ä.ö8!
-r-xr-xr-x 1 root root 3.7G Jan 13  2067 4ud╠p┼╤.╒b⌐
-rwxr-xr-x 1 root root 2.7G Aug  7  2000 8a3hv=.ÿ"█
-r-xr-xr-x 1 root root 1.9G May  2  2086 @(!æöd╩.èè
-rwxr-xr-x 1 root root 3.0G Aug 19  1985 @╠┴x$╙éφ.╞▄╣
-rwxr-xr-x 1 root root 1.2G Jan  4  1991 Adséô-.╖&*
-r-xr-xr-x 1 root root 972M Jan 17  1992 DñUé■╛.w0b
d????????? ? ?    ?       ?            ? Lâá│»?,O.ñ ╛
-rwxr-xr-x 1 root root  30M Jun 25  2038 QJM╒Ñ&.ÑD
-rwxr-xr-x 1 root root 4.0G Dec 17  2076 Qª╪Ω┬t≥Σ.kçç
d????????? ? ?    ?       ?            ? UÜXD─]0ò.╪┌·
d????????? ? ?    ?       ?            ? d@âσÖ!#.αh┘
-r-xr-xr-x 1 root root 1.8G Aug 11  1997 eMÇ6NΓ.x╞,
d????????? ? ?    ?       ?            ? f°εσ■╞╙.ÇBX
-r-xr-xr-x 1 root root 500M Jan 13  1999 f╦!|hσ₧.±
-r-xr-xr-x 1 root root 2.6G May  4  1984 krΓkZë.u┴l
-r-xr-xr-x 1 root root 988M Apr 20  2067 rn;∞s?(|.Yí
d????????? ? ?    ?       ?            ? sf+>qú.∩è
-r-xr-xr-x 1 root root 1.6G May 27  2099 vbΩkå@gû.╥ å
-r-xr-xr-x 1 root root 2.6G Apr  6  2009 x²ΓóÇ╘.
Ö
-r-xr-xr-x 1 root root  90M Feb 23  2059 }íû$¼.3ó└
-r-xr-xr-x 1 root root 464M Jan 23  2002 ~l`ö.$├
-rwxr-xr-x 1 root root 2.8G Dec 23  1988 ¢╛y╙áçHb.â
d????????? ? ?    ?       ?            ? ÉÖc├═+┐.5_
-r-xr-xr-x 1 root root 988M Jul  8  1986 Ü╨aæσ£í.xå
-r-xr-xr-x 1 root root 205M Mar  1  2009 î÷äl&ö.reJ
-r-xr-xr-x 1 root root 1.4G Mar 10  2039 î╕f3S°1).Θ1╪
-r-xr-xr-x 1 root root 173M Apr  2  2045 ñüh3╛hrΘ.pÉ`
d????????? ? ?    ?       ?            ? û»çb█╤	û.c╔]
d????????? ? ?    ?       ?            ? üäí;+≡d.ßτç
d????????? ? ?    ?       ?            ? σ.éæv1╤.æhî
d????????? ? ?    ?       ?            ? ₧╒q┘▓Ñ.jI
d????????? ? ?    ?       ?            ? ≡╗ö_uiº.1╦╔
-rwxr-xr-x 1 root root 3.9G Jan 16  2000 ≤┼ëπN.à█
d????????? ? ?    ?       ?            ? ≥mëσ'@(.ñÆy
-rwxr-xr-x 1 root root 4.0G Dec 25  2026 ≥z»╠~├⌡╜.2√¥
-r-xr-xr-x 1 root root 513M Jul  1  2007 ─░^æCAÄ;.<½
d????????? ? ?    ?       ?            ? ┌;┬ì,5vb.▒╣
d????????? ? ?    ?       ?            ? ╘jΘªΦΦ╟∙.æ└
-r-xr-xr-x 1 root root 1.3G Aug 20  1994 ╚
╕¢╖c..⌠(x
-r-xr-xr-x 1 root root 2.3G Jan 20  2033 ╣ª▄á*┐ j.A'g

/efi/EFI/arch/═δ≥1└═.═Ω:
total 9.5G
d????????? ? ?    ?       ?            ? ∩╕«ú╟e⌠.╚*
-r-xr-xr-x 1 root root 3.8G Jun 19  2102 	└┌«3╫░¬.M┌:
d????????? ? ?    ?       ?            ? fgôé▀5.¼│ª
d????????? ? ?    ?       ?            ? wƒ≡å╠¡k.φ6╗
-rwxr-xr-x 1 root root 153M Nov 17  2070 ₧╛▒n}⌠.║π
d????????? ? ?    ?       ?            ? ½Ω8]╧
Θí.4
d????????? ? ?    ?       ?            ? å⌠æ└Ü⌐δ. ▐
d????????? ? ?    ?       ?            ? ê┴·É1X_4.├
-rwxr-xr-x 1 root root 939M Jan 31  2033 ùε┴█6%.å0ê
-r-xr-xr-x 1 root root 1.1G Sep 30  1989 ÿ╓w'Ñóà╪.£w▌
d????????? ? ?    ?       ?            ? │x=4DE.
d????????? ? ?    ?       ?            ? ╩Gσâ╥πσ½.}3╣
-r-xr-xr-x 1 root root 3.6G Apr 19  2011 ▐Æñƽ1┼.e╙

/efi/System Volume Information:
total 0

Last edited by etc (2023-03-01 13:23:08)

Offline

#7 2023-03-01 13:39:13

d.ALT
Member
Registered: 2019-05-10
Posts: 959

Re: [SOLVED] Compromised Laptop after Windows Update

etc wrote:
lsblk

giving me an output of 4 partitions under /dev/nvme0n1:

/dev/nvme0n1p1 259:1 100M (win EFI)
/dev/nvme0n1p2 259:2 16M
/dev/nvme0n1p3 259:3 366.2G (win partition)
/dev/nvme0n1p4 259:4 98.9G (arch partition)

So... /dev/nvme0n1p1 is Windows' ESP. OK. But, now, where's the ArchLinux's ESP (the one you want to mount into /efi)?

<49,17,III,I>    Fama di loro il mondo esser non lassa;
<50,17,III,I>    misericordia e giustizia li sdegna:
<51,17,III,I>    non ragioniam di lor, ma guarda e passa.

Offline

#8 2023-03-01 13:55:33

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

d.ALT wrote:
etc wrote:
lsblk

giving me an output of 4 partitions under /dev/nvme0n1:

/dev/nvme0n1p1 259:1 100M (win EFI)
/dev/nvme0n1p2 259:2 16M
/dev/nvme0n1p3 259:3 366.2G (win partition)
/dev/nvme0n1p4 259:4 98.9G (arch partition)

So... /dev/nvme0n1p1 is Windows' ESP. OK. But, now, where's the ArchLinux's ESP (the one you want to mount into /efi)?

From the installation guide (https://wiki.archlinux.org/title/installation_guide under 1.9):

If the disk from which you want to boot already has an EFI system partition, do not create another one, but use the existing partition instead.

I thought this applies to my case as well. Also, refer to my post above, mentioning https://wiki.archlinux.org/title/Dual_boot_with_Windows

Note: To dual-boot with Windows on same disk, Arch should follow the same firmware boot mode and partitioning combination used by the Windows installation.
Windows Setup creates a 100 MiB EFI system partition (except for Advanced Format 4K native drives where it creates a 300 MiB ESP), so multiple kernel usage is limited. Workarounds include: Mount ESP to /efi and use a boot loader that has file system drivers and is capable of launching kernels that reside on other partitions.

Last edited by etc (2023-03-01 15:49:00)

Offline

#9 2023-03-01 14:04:59

d.ALT
Member
Registered: 2019-05-10
Posts: 959

Re: [SOLVED] Compromised Laptop after Windows Update

etc wrote:
d.ALT wrote:
etc wrote:
lsblk

giving me an output of 4 partitions under /dev/nvme0n1:

/dev/nvme0n1p1 259:1 100M (win EFI)
/dev/nvme0n1p2 259:2 16M
/dev/nvme0n1p3 259:3 366.2G (win partition)
/dev/nvme0n1p4 259:4 98.9G (arch partition)

So... /dev/nvme0n1p1 is Windows' ESP. OK. But, now, where's the ArchLinux's ESP (the one you want to mount into /efi)?

From the installation guide ( https://wiki.archlinux.org/title/installation_guide under 1.9):

If the disk from which you want to boot already has an EFI system partition, do not create another one, but use the existing partition instead.

I thought this applies to my case as well. Also, refer to my post above, mentioning https://wiki.archlinux.org/title/Dual_boot_with_Windows

Note: To dual-boot with Windows on same disk, Arch should follow the same firmware boot mode and partitioning combination used by the Windows installation.
Windows Setup creates a 100 MiB EFI system partition (except for Advanced Format 4K native drives where it creates a 300 MiB ESP), so multiple kernel usage is limited. Workarounds include: Mount ESP to /efi and use a boot loader that has file system drivers and is capable of launching kernels that reside on other partitions.

etc wrote:
/efi:
total 96M
drwxr-xr-x 3 root root 1.0K Feb 28 20:56 EFI
drwxr-xr-x 2 root root 1.0K Mar 10  2022 System Volume Information
-rwxr-xr-x 1 root root  53M Feb 28 22:00 initramfs-linux-fallback.img
-rwxr-xr-x 1 root root  32M Feb 28 21:59 initramfs-linux.img
-rwxr-xr-x 1 root root  12M Feb 28 21:59 vmlinuz-linux

Are kernel and initrd installed into /boot now?

So, then just proceed removing from /efi now-unneeded files and re-install your BootLoader.

<49,17,III,I>    Fama di loro il mondo esser non lassa;
<50,17,III,I>    misericordia e giustizia li sdegna:
<51,17,III,I>    non ragioniam di lor, ma guarda e passa.

Offline

#10 2023-03-01 14:35:57

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

d.ALT wrote:

Are kernel and initrd installed into /boot now?

So, then just proceed removing from /efi now-unneeded files and re-install your BootLoader.

Here's the content of my /boot folder: 

amd-ucode.img
grub
initramfs-linux-fallback.img
initramfs-linux.img
vmlinuz-linux

And of my /efi folder: 

EFI
System Volume Information
initramfs-linux-fallback.img
initramfs-linux.img
vmlinuz-linux

So does this mean that I can delete the three entries that are identical?

Offline

#11 2023-03-01 14:49:17

d.ALT
Member
Registered: 2019-05-10
Posts: 959

Re: [SOLVED] Compromised Laptop after Windows Update

etc wrote:
d.ALT wrote:

Are kernel and initrd installed into /boot now?

So, then just proceed removing from /efi now-unneeded files and re-install your BootLoader.

Here's the content of my /boot folder: 

amd-ucode.img
grub
initramfs-linux-fallback.img
initramfs-linux.img
vmlinuz-linux

And of my /efi folder: 

EFI
System Volume Information
initramfs-linux-fallback.img
initramfs-linux.img
vmlinuz-linux

So does this mean that I can delete the three entries that are identical?

If you correctly fixed your fstab and BootLoader's accordingly, yes.

<49,17,III,I>    Fama di loro il mondo esser non lassa;
<50,17,III,I>    misericordia e giustizia li sdegna:
<51,17,III,I>    non ragioniam di lor, ma guarda e passa.

Offline

#12 2023-03-01 14:59:12

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 76,358

Re: [SOLVED] Compromised Laptop after Windows Update

/efi/EFI/arch:
total 213G
-rwxr-xr-x      1 root root 528M Nov  7  1980 g8ò└f.╢└
…

ESP looks corrupted?

You'll also have to configure grub to find the kernel and initramfs in that path (in doubt w/ grub-mkconfig)

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#13 2023-03-01 15:39:34

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

Ok, so I am starting to see a few problems.

d.ALT wrote:

If you correctly fixed your fstab and BootLoader's accordingly, yes.

Haven't figured out how to post fstab yet, but it looks off:  there are two entries for /dev/nvme0n1p1, one at /efi, one at /boot. One entry for /dev/nvme0n1p5 as an ext4 at /, but this partition doesn't exist according to lsblk. Finally, there's also an entry for /dev/nvme0n1p4 as an ext4 at /.


seth wrote:
/efi/EFI/arch:
total 213G
-rwxr-xr-x      1 root root 528M Nov  7  1980 g8ò└f.╢└
…

ESP looks corrupted?

You'll also have to configure grub to find the kernel and initramfs in that path (in doubt w/ grub-mkconfig)

I thought it looked suspicious, yes :-/

Here's the output for 

grub-mkconfig

I can't quite wrap my head around it:

#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#

### BEGIN /etc/grub.d/00_header ###
insmod part_gpt
insmod part_msdos
if [ -s $prefix/grubenv ]; then
  load_env
fi
if [ "${next_entry}" ] ; then
   set default="${next_entry}"
   set next_entry=
   save_env next_entry
   set boot_once=true
else
   set default="0"
fi

if [ x"${feature_menuentry_id}" = xy ]; then
  menuentry_id_option="--id"
else
  menuentry_id_option=""
fi

export menuentry_id_option

if [ "${prev_saved_entry}" ]; then
  set saved_entry="${prev_saved_entry}"
  save_env saved_entry
  set prev_saved_entry=
  save_env prev_saved_entry
  set boot_once=true
fi

function savedefault {
  if [ -z "${boot_once}" ]; then
    saved_entry="${chosen}"
    save_env saved_entry
  fi
}

function load_video {
  if [ x$feature_all_video_module = xy ]; then
    insmod all_video
  else
    insmod efi_gop
    insmod efi_uga
    insmod ieee1275_fb
    insmod vbe
    insmod vga
    insmod video_bochs
    insmod video_cirrus
  fi
}

if [ x$feature_default_font_path = xy ] ; then
   font=unicode
else
insmod part_gpt
insmod ext2
search --no-floppy --fs-uuid --set=root 03601300-763d-48bd-8fe7-26118b9bb4e6
    font="/usr/share/grub/unicode.pf2"
fi

if loadfont $font ; then
  set gfxmode=auto
  load_video
  insmod gfxterm
fi
terminal_input console
terminal_output gfxterm
if [ x$feature_timeout_style = xy ] ; then
  set timeout_style=menu
  set timeout=5
# Fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
  set timeout=5
fi
### END /etc/grub.d/00_header ###

### BEGIN /etc/grub.d/10_linux ###
menuentry 'Arch Linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-03601300-763d-48bd-8fe7-26118b9bb4e6' {
	load_video
	set gfxpayload=keep
	insmod gzio
	insmod part_gpt
	insmod ext2
	search --no-floppy --fs-uuid --set=root 03601300-763d-48bd-8fe7-26118b9bb4e6
	echo	'Loading Linux linux ...'
	linux	/boot/vmlinuz-linux root=UUID=03601300-763d-48bd-8fe7-26118b9bb4e6 rw  loglevel=3 quiet
	echo	'Loading initial ramdisk ...'
	initrd	/boot/amd-ucode.img /boot/initramfs-linux.img
}
submenu 'Advanced options for Arch Linux' $menuentry_id_option 'gnulinux-advanced-03601300-763d-48bd-8fe7-26118b9bb4e6' {
	menuentry 'Arch Linux, with Linux linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-advanced-03601300-763d-48bd-8fe7-26118b9bb4e6' {
		load_video
		set gfxpayload=keep
		insmod gzio
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 03601300-763d-48bd-8fe7-26118b9bb4e6
		echo	'Loading Linux linux ...'
		linux	/boot/vmlinuz-linux root=UUID=03601300-763d-48bd-8fe7-26118b9bb4e6 rw  loglevel=3 quiet
		echo	'Loading initial ramdisk ...'
		initrd	/boot/amd-ucode.img /boot/initramfs-linux.img
	}
	menuentry 'Arch Linux, with Linux linux (fallback initramfs)' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-fallback-03601300-763d-48bd-8fe7-26118b9bb4e6' {
		load_video
		set gfxpayload=keep
		insmod gzio
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 03601300-763d-48bd-8fe7-26118b9bb4e6
		echo	'Loading Linux linux ...'
		linux	/boot/vmlinuz-linux root=UUID=03601300-763d-48bd-8fe7-26118b9bb4e6 rw  loglevel=3 quiet
		echo	'Loading initial ramdisk ...'
		initrd	/boot/amd-ucode.img /boot/initramfs-linux-fallback.img
	}
}

### END /etc/grub.d/10_linux ###

### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###

### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###

### BEGIN /etc/grub.d/30_uefi-firmware ###
if [ "$grub_platform" = "efi" ]; then
	fwsetup --is-supported
	if [ "$?" = 0 ]; then
		menuentry 'UEFI Firmware Settings' $menuentry_id_option 'uefi-firmware' {
			fwsetup
		}
	fi
fi
### END /etc/grub.d/30_uefi-firmware ###

### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###

### BEGIN /etc/grub.d/41_custom ###
if [ -f  ${config_directory}/custom.cfg ]; then
  source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f  $prefix/custom.cfg ]; then
  source $prefix/custom.cfg
fi
### END /etc/grub.d/41_custom ###

I guess the question is: how do I proceed? What do I put in fstab, what to do against the corrupted esp? And then how to unclutter /efi?

Last edited by etc (2023-03-01 15:51:09)

Offline

#14 2023-03-01 16:05:51

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 76,358

Re: [SOLVED] Compromised Laptop after Windows Update

I can't quite wrap my head around it:

https://wiki.archlinux.org/title/GRUB#G … ation_file

what to do against the corrupted esp

https://wiki.archlinux.org/title/Fsck

What do I put in fstab

What does the fstab look like right now?

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#15 2023-03-01 16:52:58

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

seth wrote:

I can't quite wrap my head around it:

https://wiki.archlinux.org/title/GRUB#G … ation_file

Right, so I think this should come in after a successful grub-install, if I am not mistaken.

what to do against the corrupted esp

https://wiki.archlinux.org/title/Fsck

So I should 

fsck /dev/nvme0n1p1

while it's unmounted? The thing worrying me is the windows bit of the partition. Or do I 

fsck /efi

on /dev/nvme0n1p4 while having /dev/nvme0n1p1 mounted to /efi? Sorry for these simple questions, I am just worried about my ignorance making things worse.

What do I put in fstab

What does the fstab look like right now?

Edit: managed to get the actual output:

# Static information about the filesystems.
# See fstab(5) for details.

# <file system> <dir> <type> <options> <dump> <pass>
# /dev/nvme0n1p5
UUID=03601300-763d-48bd-8fe7-26118b9bb4e6	/         	ext4      	rw,relatime	0 1

# /dev/nvme0n1p1
UUID=DA4B-C681      	/efi      	vfat      	rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro	0 2

# /dev/nvme0n1p4
UUID=03601300-763d-48bd-8fe7-26118b9bb4e6	/         	ext4      	rw,relatime	0 1

# /dev/nvme0n1p1
UUID=DA4B-C681      	/boot     	vfat      	rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro	0 2

So my guess would be to delete the entry for /dev/nvme0n1p1 at /boot and the entry for /dev/nvme0n1p5 - or am I missing something? There is also no mention of a Windows partition.

Last edited by etc (2023-03-01 17:03:33)

Offline

#16 2023-03-01 17:07:39

d.ALT
Member
Registered: 2019-05-10
Posts: 959

Re: [SOLVED] Compromised Laptop after Windows Update

You need to understand the actual layout of partitions in your nVME; that will clear up the fog for you wink

Once mastered it, fsck.fat the ESP (FAT32 Partition) which you're mounting into /efi.

<49,17,III,I>    Fama di loro il mondo esser non lassa;
<50,17,III,I>    misericordia e giustizia li sdegna:
<51,17,III,I>    non ragioniam di lor, ma guarda e passa.

Offline

#17 2023-03-01 17:14:10

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 76,358

Re: [SOLVED] Compromised Laptop after Windows Update

https://man.archlinux.org/man/fsck.fat.8.en and ideally the FS is not mounted.

You don't want nvme0n1p1 (the ESP) on /boot
What even is nvme0n1p5 ? You didn't list that in your lsblk.
Hoever, teh UUID for nvme0n1p5 and nvme0n1p4 is the same and what matters.
What also matters is the order of fstab, so keep the first and remove the second entry (and maybe fix nvme0n1p5 to nvme0n1p4)

Instead of deleting, you can also just comment the lines (easier to restore)

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#18 2023-03-01 17:27:28

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

d.ALT wrote:

You need to understand the actual layout of partitions in your nVME; that will clear up the fog for you wink

Once mastered it, fsck.fat the ESP (FAT32 Partition) which you're mounting into /efi.

So if I understand correctly, the actual layout is the one detailled by lsblk:

NAME        MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
loop0         7:0    0 710.1M  1 loop 
sda           8:0    1   3.8G  0 disk 
├─sda1        8:1    1   809M  0 part 
└─sda2        8:2    1    15M  0 part 
nvme0n1     259:0    0 465.8G  0 disk 
├─nvme0n1p1 259:1    0   100M  0 part /efi
├─nvme0n1p2 259:2    0    16M  0 part 
├─nvme0n1p3 259:3    0 366.2G  0 part 
└─nvme0n1p4 259:4    0  98.9G  0 part /
seth wrote:

https://man.archlinux.org/man/fsck.fat.8.en and ideally the FS is not mounted.

You don't want nvme0n1p1 (the ESP) on /boot
What even is nvme0n1p5 ? You didn't list that in your lsblk.
Hoever, teh UUID for nvme0n1p5 and nvme0n1p4 is the same and what matters.
What also matters is the order of fstab, so keep the first and remove the second entry (and maybe fix nvme0n1p5 to nvme0n1p4)

Instead of deleting, you can also just comment the lines (easier to restore)

Will do, and once this is done I can delete this unnecessary files in /boot and try reinstalling grub?
It looks like /dev/nvme0n1p3 is the Windows partition, should it figure in fstab?

Thanks again for your advice.

Offline

#19 2023-03-01 20:52:06

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 76,358

Re: [SOLVED] Compromised Laptop after Windows Update

Will do, and once this is done I can delete this unnecessary files in /boot and try reinstalling grub?

Yes.

It looks like /dev/nvme0n1p3 is the Windows partition, should it figure in fstab?

Do you intend to access the partition from the linux sessions?

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#20 2023-03-02 01:33:22

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

seth wrote:

Will do, and once this is done I can delete this unnecessary files in /boot and try reinstalling grub?

Yes.

Ok, some progress. grub-install seems to work without issues now. I also created a new cfg file.

Unfortunately, this hasn't solved my problem yet. I still can't do anything without the live USB, grub doesn't load, the only thing I see is the Boot Manager and I can't load anything from there (no reaction when I select an entry)

It looks like /dev/nvme0n1p3 is the Windows partition, should it figure in fstab?

Do you intend to access the partition from the linux sessions?

The most important thing is being able to boot it via grub, but if I can access the files via Linux that's even better.

I haven't run fsck.fat on the esp yet, unsure about some decisions. I get the following output:

fsck.fat 4.2 (2021-01-31)
There are differences between boot sector and its backup.
This is mostly harmless. Differences: (offset:original/backup)
65:01/00
1) Copy original to backup
2) Copy backup to original
3) No action

When I choose option 1 I get:

/EFI/arch/M2É
Expected a valid '.' entry in this slot.
1) Drop entry
2) Drop parent
3) Move entry down

I don't feel competent to proceed. Can I trust fsck.fat -a to do the right thing?

The content of /efi/EFI/arch still looks weird:

a8┴t	 ┴.a ╚
  ┼δ╜1└[.]a\
 ┐.┬H┴
$ïδ
ï.Hëδ
)µHqH.2Θ├
+hâ─┐
2hphq.hë
7.╨hà
?π.┐&
@`Hï╕°
ATIë╘1└H.║≥π
ATLëΩI╝à.
A\A]├AVI.╛╨@
C
D$@HëD$(.LëL
Hc╔IëL$.H╣6
Hë
y.ëj
Hë∙Hë≥H┐.·π
HïD$HìP. Hë
LëΩ╛U.H╣ï
LëεI╜╨@
PE
[]a\a]a^.A_ 
]h╣φû
_├UAë╤A╕.0
fâ>tH.╛_π
hlìv ië.ΘH╙
hâ∞(hë± .╫Hâ
hë± ╫hâ─.X├H
hë√╛z.hâ∞
hë╤h≈┘h!.┴H╕
h╕≡w
iï}.<$ 
mzé.
tAÇ°cu9.H╕`
t be run. in
t$r
hü√
u1φshâ∞(.Hët
 Lïc Hë┌.╛d
 αz1└[]a.\A]
 ╨Hà└u1.█ΘQ
·urè@<.t	
·π.H╣┐
ä╙.$║
êe.z[]
ë·╛=.┐5π
ëαh┐·π
ëτ╛S.╣sΓ
ë╫H≡I┬.L9╨
ïL$Lë■H.╕ü
ïxa ╒à└.t[à
ò
ó1H┴Γ ë.└╛Φ
÷HE┬├Lï.╛
û.╥Dï
ΘE1└H╕ê!
Θm    ┼ü.²
ΦrXM)Φ1└.I╜6
αZ1└[]A\.a]├
εh┴Θ i».H(I
∞hú8!
≥╛.τi╕
┌ë┴âαⁿ∩â.ßì
┐Σ.H║≥
└Ië°H║≥π
┬┴Φ=  
┴τ  ╨úα.
┼δå1└hâ─.[]
║╫σ
╘1└H║≥π
╨Hë├Hà└.ä¿
╨[]úα 
╪{.IëU
╫	≈ë°
█tl9πu.Hï[
░fδH╕`.
░hà╥u:H╕.p

Last edited by etc (2023-03-02 01:39:09)

Offline

#21 2023-03-02 07:46:43

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 76,358

Re: [SOLVED] Compromised Laptop after Windows Update

Can I trust fsck.fat -a to do the right thing?

There is no "right" thing on a corrupted base.
Since the entire path seems to contain only garbage anyway (and at best would host the grub efi, I guess), try to delete it before running fsck to prevent it from blurring the check results.

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#22 2023-03-02 19:13:09

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

Some more progress: couldn't remove the content of the /efi/EFI/arch folder due to it being read-only, but proceeded to do fsck.fat -a on /dev/nvme0n1p1 which lead to a lot of beeps but was completed. I then reinstalled grub and made the config file and - hooray - the laptop boots into grub without the USB and I can load arch! But no mention of Windows in grub and I still can't load the boot manager. Any ideas on how to recover that? I considered making a win11 .iso and try to repair the bootloader this way, but I'm going to hold back for now as I don't know the requirements and how this affects arch.

So upon boot I still get the error message 

[     0.475821] Initramfs unpacking failed: ZSTD-compressed data is corrupt
Starting systemd-udevd version 253-1-arch
/dev/nvme0n1p4: clean, 174813/6488064 files, 3459445/25932544 blocks

/efi/EFI/arch now looks like this:

$@LëL$H .╨║(
$ñeñyñhñ.¢ñ╛
╨1└Z├AWA.vau
A^├AWE1╔.ië≈
`áhápáxá.çáê
alignmen.t %
ap from.EFI
ATIë╘1└H.║≥π
╬à╔uTδfë.≥âΓ
b_list_p.ush
çá₧á¿á╟á.╤á÷
~■@Ç ,t∩.A ╤
_device_.nam
efi part.LIC
ë┌Lëτ[Hë.Φ╛│
ëΓHë▐Hë∩.A ╒
ëτH ┬ ╨H.ë┼H
FSCK0000.001
FSCK0000.003
FSCK0000.004
FSCK0000.005
FSCK0000.006
FSCK0000.007
FSCK0000.008
FSCK0000.009
fsck0000.010
fsck0000.011
FSCK0000.012
fsck0000.013
FSCK0000.014
fsck0000.015
fsck0000.016
FSCK0000.017
FSCK0000.018
FSCK0000.019
FSCK0000.020
FSCK0000.021
FSCK0000.022
fsck0000.023
FSCK0000.025
fsck0000.027
FSCK0000.028
fsck0000.029
FSCK0000.030
fsck0000.032
FSCK0000.033
fsck0000.034
FSCK0000.035
fsck0000.036
fsck0000.037
fsck0000.038
fsck0000.039
FSCK0000.040
FSCK0000.041
fsck0000.042
FSCK0000.043
FSCK0000.044
FSCK0000.045
FSCK0000.046
FSCK0000.047
fsck0000.048
FSCK0000.049
FSCK0000.050
fsck0000.051
fsck0000.052
FSCK0000.053
FSCK0000.054
FSCK0000.055
fsck0000.056
FSCK0000.057
fsck0000.058
fsck0000.059
FSCK0000.060
FSCK0000.061
FSCK0000.062
FSCK0000.063
FSCK0000.064
FSCK0000.065
fsck0000.066
FSCK0000.067
fsck0000.068
fsck0000.069
fsck0000.070
FSCK0000.071
FSCK0000.072
FSCK0000.073
FSCK0000.074
fsck0000.075
FSCK0000.076
FSCK0000.078
FSCK0000.079
FSCK0000.080
FSCK0000.081
FSCK0000.082
FSCK0000.083
fsck0000.084
FSCK0000.085
fsck0000.086
FSCK0000.087
FSCK0000.088
fsck0000.090
fsck0000.091
FSCK0000.092
FSCK0000.093
FSCK0000.094
FSCK0000.095
FSCK0000.097
FSCK0000.098
fsck0000.100
fsck0000.101
FSCK0000.102
FSCK0000.103
fsck0000.104
FSCK0000.105
FSCK0000.106
FSCK0000.107
fsck0000.108
FSCK0000.109
FSCK0000.110
fsck0000.111
FSCK0000.112
FSCK0000.113
fsck0000.114
FSCK0000.115
FSCK0000.116
FSCK0000.118
FSCK0000.119
FSCK0000.120
FSCK0000.121
FSCK0000.122
FSCK0000.123
FSCK0000.124
FSCK0000.125
fsck0000.126
FSCK0000.127
fsck0000.128
FSCK0000.129
FSCK0000.130
FSCK0000.131
FSCK0000.132
FSCK0000.133
FSCK0000.136
FSCK0000.137
fsck0000.138
fsck0000.140
fsck0000.141
FSCK0000.142
FSCK0000.143
FSCK0000.144
FSCK0000.145
FSCK0000.146
fsck0000.147
FSCK0000.149
FSCK0000.150
FSCK0000.152
FSCK0000.153
FSCK0000.154
FSCK0000.155
FSCK0000.156
FSCK0000.157
FSCK0000.159
FSCK0000.160
FSCK0000.161
FSCK0000.162
FSCK0000.163
fsck0000.164
FSCK0000.167
FSCK0000.168
fsck0000.171
FSCK0000.172
FSCK0000.173
FSCK0000.175
FSCK0000.177
FSCK0000.178
fsck0000.179
FSCK0000.180
FSCK0000.182
fsck0000.184
FSCK0000.186
FSCK0000.187
fsck0000.188
FSCK0000.189
fsck0000.190
FSCK0000.191
FSCK0000.193
fsck0000.195
FSCK0000.196
FSCK0000.197
fsck0000.199
FSCK0000.200
fsck0000.201
FSCK0000.202
FSCK0000.203
FSCK0000.204
FSCK0000.205
FSCK0000.206
FSCK0000.207
FSCK0000.208
fsck0000.209
fsck0000.210
fsck0000.211
fsck0000.212
FSCK0000.213
fsck0000.214
FSCK0000.215
FSCK0000.216
FSCK0000.217
FSCK0000.218
FSCK0000.219
fsck0000.220
FSCK0000.221
fsck0000.222
FSCK0000.223
fsck0000.224
fsck0000.225
FSCK0000.226
FSCK0000.227
fsck0000.228
FSCK0000.229
FSCK0000.232
FSCK0000.233
FSCK0000.235
FSCK0000.237
fsck0000.238
FSCK0000.239
FSCK0000.240
fsck0000.241
FSCK0000.242
FSCK0000.243
FSCK0000.244
FSCK0000.246
FSCK0000.247
FSCK0000.249
FSCK0000.250
fsck0000.251
FSCK0000.252
fsck0000.254
FSCK0000.255
FSCK0000.256
fsck0000.257
FSCK0000.258
fsck0000.260
FSCK0000.262
fsck0000.263
FSCK0000.265
FSCK0000.268
FSCK0000.269
FSCK0000.270
FSCK0000.271
FSCK0000.272
fsck0000.274
fsck0000.276
FSCK0000.278
fsck0000.279
FSCK0000.280
FSCK0000.281
FSCK0000.282
fsck0000.283
FSCK0000.284
FSCK0000.286
FSCK0000.287
fsck0000.288
fsck0000.289
FSCK0000.290
FSCK0000.291
fsck0000.292
FSCK0000.293
FSCK0000.294
FSCK0000.295
FSCK0000.296
FSCK0000.297
FSCK0000.298
fsck0000.299
FSCK0000.300
fsck0000.301
FSCK0000.302
FSCK0000.303
fsck0000.304
FSCK0000.305
FSCK0000.306
FSCK0000.307
fsck0000.310
fsck0000.312
fsck0000.313
FSCK0000.314
fsck0000.315
fsck0000.316
FSCK0000.317
FSCK0000.319
FSCK0000.321
FSCK0000.322
fsck0000.323
fsck0000.324
FSCK0000.325
FSCK0000.326
fsck0000.328
FSCK0000.329
FSCK0000.331
fsck0000.332
FSCK0000.333
fsck0000.334
fsck0000.335
FSCK0000.336
FSCK0000.337
FSCK0000.338
fsck0000.339
FSCK0000.340
FSCK0000.342
FSCK0000.343
FSCK0000.344
FSCK0000.347
FSCK0000.348
FSCK0000.349
FSCK0000.350
fsck0000.351
FSCK0000.352
FSCK0000.353
fsck0000.354
FSCK0000.355
FSCK0000.356
FSCK0000.357
fsck0000.358
FSCK0000.359
FSCK0000.360
fsck0000.362
fsck0000.363
fsck0000.364
FSCK0000.365
FSCK0000.366
FSCK0000.367
FSCK0000.368
fsck0000.369
FSCK0000.370
fsck0000.372
FSCK0000.373
fsck0000.374
FSCK0000.375
FSCK0000.376
FSCK0000.377
FSCK0000.378
fsck0000.379
FSCK0000.380
FSCK0000.381
FSCK0000.382
fsck0000.383
FSCK0000.384
fsck0000.385
FSCK0000.386
FSCK0000.389
fsck0000.390
fsck0000.391
FSCK0000.392
FSCK0000.393
FSCK0000.394
FSCK0000.396
FSCK0000.397
FSCK0000.398
FSCK0000.399
FSCK0000.400
FSCK0000.401
fsck0000.402
fsck0000.403
FSCK0000.404
FSCK0000.405
fsck0000.407
fsck0000.408
fsck0000.409
fsck0000.410
FSCK0000.413
FSCK0000.414
fsck0000.415
fsck0000.416
fsck0000.417
fsck0000.418
FSCK0000.419
FSCK0000.420
FSCK0000.421
FSCK0000.422
FSCK0000.423
fsck0000.424
fsck0000.425
FSCK0000.426
FSCK0000.427
FSCK0000.428
FSCK0000.429
fsck0000.432
fsck0000.433
FSCK0000.434
FSCK0000.435
FSCK0000.436
fsck0000.437
FSCK0000.438
fsck0000.439
FSCK0000.440
fsck0000.441
FSCK0000.442
fsck0000.444
FSCK0000.445
FSCK0000.446
FSCK0000.449
fsck0000.450
fsck0000.451
FSCK0000.452
FSCK0000.453
FSCK0000.455
FSCK0000.457
FSCK0000.459
FSCK0000.461
FSCK0000.463
FSCK0000.464
FSCK0000.465
FSCK0000.466
fsck0000.467
FSCK0000.468
FSCK0000.469
FSCK0000.470
fsck0000.472
FSCK0000.474
FSCK0000.475
FSCK0000.476
fsck0000.477
FSCK0000.478
fsck0000.480
fsck0000.481
FSCK0000.482
FSCK0000.484
FSCK0000.485
FSCK0000.487
fsck0000.488
FSCK0000.489
FSCK0000.491
FSCK0000.493
fsck0000.494
fsck0000.495
FSCK0000.496
fsck0000.497
FSCK0000.498
FSCK0000.499
FSCK0000.500
FSCK0000.501
FSCK0000.502
FSCK0000.503
FSCK0000.504
fsck0000.505
FSCK0000.506
FSCK0000.508
fsck0000.509
fsck0000.510
FSCK0000.512
FSCK0000.513
FSCK0000.514
fsck0000.515
FSCK0000.516
fsck0000.517
FSCK0000.518
fsck0000.519
fsck0000.520
fsck0000.522
FSCK0000.523
fsck0000.524
FSCK0000.526
FSCK0000.528
FSCK0000.529
FSCK0000.530
FSCK0000.531
FSCK0000.532
FSCK0000.533
fsck0000.534
FSCK0000.535
FSCK0000.536
fsck0000.537
FSCK0000.538
FSCK0000.539
fsck0000.540
FSCK0000.542
FSCK0000.544
FSCK0000.545
FSCK0000.546
FSCK0000.547
fsck0000.548
fsck0000.549
FSCK0000.552
fsck0000.553
FSCK0000.554
fsck0000.555
FSCK0000.556
FSCK0000.557
FSCK0000.558
fsck0000.559
fsck0000.560
FSCK0000.561
FSCK0000.562
FSCK0000.563
fsck0000.564
FSCK0000.566
FSCK0000.567
FSCK0000.568
FSCK0000.569
fsck0000.570
FSCK0000.571
FSCK0000.572
fsck0000.573
FSCK0000.574
FSCK0000.576
FSCK0000.577
fsck0000.578
fsck0000.579
fsck0000.581
FSCK0000.583
fsck0000.584
FSCK0000.585
fsck0000.586
fsck0000.588
fsck0000.590
fsck0000.591
fsck0000.592
FSCK0000.595
fsck0000.596
FSCK0000.597
fsck0000.598
FSCK0000.599
fsck0000.600
fsck0000.601
FSCK0000.602
FSCK0000.604
FSCK0000.605
FSCK0000.606
FSCK0000.607
FSCK0000.608
FSCK0000.609
FSCK0000.611
fsck0000.612
FSCK0000.613
FSCK0000.614
FSCK0000.615
FSCK0000.616
FSCK0000.617
fsck0000.618
FSCK0000.619
fsck0000.621
FSCK0000.622
FSCK0000.623
FSCK0000.624
FSCK0000.625
FSCK0000.626
FSCK0000.628
fsck0000.629
FSCK0000.630
FSCK0000.631
FSCK0000.632
fsck0000.633
fsck0000.634
fsck0000.635
FSCK0000.636
FSCK0000.637
FSCK0000.638
fsck0000.640
fsck0000.641
FSCK0000.642
fsck0000.644
FSCK0000.645
FSCK0000.646
FSCK0000.647
fsck0000.648
FSCK0000.649
fsck0000.651
fsck0000.652
fsck0000.654
FSCK0000.658
fsck0000.659
FSCK0000.661
FSCK0000.662
FSCK0000.663
FSCK0000.664
fsck0000.665
FSCK0000.666
fsck0000.667
fsck0000.670
fsck0000.671
fsck0000.672
fsck0000.673
fsck0000.674
FSCK0000.676
fsck0000.677
FSCK0000.679
FSCK0000.682
FSCK0000.683
FSCK0000.684
FSCK0000.685
FSCK0000.686
FSCK0000.687
FSCK0000.688
FSCK0000.689
FSCK0000.690
FSCK0000.691
FSCK0000.692
FSCK0000.693
FSCK0000.694
fsck0000.695
FSCK0000.696
FSCK0000.697
FSCK0000.698
FSCK0000.699
FSCK0000.700
FSCK0000.701
FSCK0000.702
FSCK0000.703
FSCK0000.704
FSCK0000.705
FSCK0000.706
FSCK0000.707
FSCK0000.708
fsck0000.709
FSCK0000.710
FSCK0000.711
FSCK0000.712
fsck0000.713
fsck0000.714
FSCK0000.715
FSCK0000.716
fsck0000.717
fsck0000.718
FSCK0000.719
fsck0000.720
FSCK0000.721
fsck0000.722
FSCK0000.723
fsck0000.724
fsck0000.725
fsck0000.726
fsck0000.727
fsck0000.728
fsck0000.729
FSCK0000.730
fsck0000.731
fsck0000.732
FSCK0000.733
fsck0000.734
FSCK0000.735
fsck0000.736
FSCK0000.737
FSCK0000.738
FSCK0000.739
fsck0000.740
fsck0000.741
FSCK0000.742
fsck0000.743
FSCK0000.744
FSCK0000.745
fsck0000.746
FSCK0000.747
FSCK0000.748
fsck0000.749
FSCK0000.750
FSCK0000.751
fsck0000.752
FSCK0000.753
FSCK0000.754
fsck0000.755
FSCK0000.756
FSCK0000.757
fsck0000.758
FSCK0000.759
FSCK0000.760
FSCK0000.761
FSCK0000.762
FSCK0000.763
FSCK0000.764
FSCK0000.765
FSCK0000.766
FSCK0000.767
FSCK0000.768
FSCK0000.769
FSCK0000.771
FSCK0000.772
FSCK0000.773
FSCK0000.774
fsck0000.775
fsck0000.776
FSCK0000.777
FSCK0000.778
fsck0000.780
FSCK0000.781
FSCK0000.782
FSCK0000.783
fsck0000.784
FSCK0000.785
FSCK0000.786
FSCK0000.787
fsck0000.788
fsck0000.789
FSCK0000.790
FSCK0000.791
FSCK0000.792
fsck0000.793
fsck0000.794
fsck0000.795
FSCK0000.796
fsck0000.797
FSCK0000.798
FSCK0000.799
fsck0000.800
FSCK0000.801
FSCK0000.802
FSCK0000.803
FSCK0000.804
FSCK0000.805
FSCK0000.806
fsck0000.807
FSCK0000.808
fsck0000.809
FSCK0000.810
FSCK0000.811
FSCK0000.812
FSCK0000.813
fsck0000.814
FSCK0000.815
FSCK0000.816
FSCK0000.817
FSCK0000.818
FSCK0000.819
FSCK0000.820
FSCK0000.821
fsck0000.822
fsck0000.823
FSCK0000.824
FSCK0000.825
FSCK0000.826
fsck0000.827
fsck0000.828
FSCK0000.829
fsck0000.830
FSCK0000.831
FSCK0000.832
fsck0000.833
FSCK0000.834
FSCK0000.835
FSCK0000.836
fsck0000.837
FSCK0000.838
FSCK0000.839
fsck0000.840
fsck0000.841
fsck0000.842
fsck0000.843
fsck0000.844
FSCK0000.845
FSCK0000.846
FSCK0000.847
fsck0000.848
FSCK0000.849
FSCK0000.850
FSCK0000.851
fsck0000.852
FSCK0000.853
FSCK0000.854
FSCK0000.855
FSCK0000.856
FSCK0000.857
FSCK0000.858
FSCK0000.859
fsck0000.860
FSCK0000.861
FSCK0000.862
FSCK0000.863
FSCK0000.864
fsck0000.865
fsck0000.866
FSCK0000.867
FSCK0000.868
FSCK0000.869
FSCK0000.870
FSCK0000.871
FSCK0000.872
fsck0000.873
fsck0000.874
fsck0000.875
FSCK0000.876
FSCK0000.877
fsck0000.878
fsck0000.879
FSCK0000.880
FSCK0000.881
FSCK0000.882
FSCK0000.883
FSCK0000.884
fsck0000.885
FSCK0000.886
FSCK0000.887
FSCK0000.888
FSCK0000.889
FSCK0000.890
FSCK0000.891
FSCK0000.892
FSCK0000.893
FSCK0000.894
FSCK0000.895
FSCK0000.896
FSCK0000.897
FSCK0000.898
FSCK0000.899
FSCK0000.900
FSCK0000.901
FSCK0000.902
FSCK0000.903
FSCK0000.904
FSCK0000.905
FSCK0000.906
FSCK0000.907
FSCK0000.908
FSCK0000.909
FSCK0000.910
FSCK0000.911
FSCK0000.912
FSCK0000.913
FSCK0000.914
FSCK0000.915
FSCK0000.916
FSCK0000.917
FSCK0000.918
FSCK0000.919
FSCK0000.920
FSCK0000.921
FSCK0000.922
FSCK0000.923
FSCK0000.924
FSCK0000.925
FSCK0000.926
FSCK0000.927
FSCK0000.928
FSCK0000.929
FSCK0000.930
FSCK0000.931
FSCK0000.932
FSCK0000.933
FSCK0000.934
FSCK0000.935
FSCK0000.936
FSCK0000.937
FSCK0000.938
FSCK0000.939
FSCK0000.940
FSCK0000.941
FSCK0000.942
FSCK0000.943
FSCK0000.944
FSCK0000.945
FSCK0000.946
FSCK0000.947
FSCK0000.948
FSCK0000.949
FSCK0000.950
FSCK0000.951
FSCK0000.952
FSCK0000.953
FSCK0000.954
FSCK0000.955
FSCK0000.956
FSCK0000.957
FSCK0000.958
FSCK0000.959
FSCK0000.960
FSCK0000.961
FSCK0000.962
FSCK0000.963
FSCK0000.964
FSCK0000.965
FSCK0000.966
FSCK0000.967
FSCK0000.968
FSCK0000.969
FSCK0000.970
FSCK0000.971
FSCK0000.972
FSCK0000.973
FSCK0000.974
FSCK0000.975
FSCK0000.976
FSCK0000.977
FSCK0000.978
FSCK0000.979
FSCK0000.980
FSCK0000.981
FSCK0000.982
FSCK0000.983
FSCK0000.984
FSCK0000.985
FSCK0000.986
FSCK0000.987
FSCK0000.988
FSCK0000.989
FSCK0000.990
FSCK0000.991
FSCK0000.992
FSCK0000.993
FSCK0000.994
FSCK0000.995
FSCK0000.996
FSCK0000.997
FSCK0000.998
FSCK0000.999
FSCK0001.000
FSCK0001.001
FSCK0001.002
FSCK0001.003
FSCK0001.004
FSCK0001.005
FSCK0001.006
FSCK0001.007
FSCK0001.008
FSCK0001.009
FSCK0001.010
FSCK0001.011
FSCK0001.012
FSCK0001.013
FSCK0001.014
FSCK0001.015
FSCK0001.016
FSCK0001.017
FSCK0001.018
FSCK0001.019
FSCK0001.020
FSCK0001.021
FSCK0001.022
FSCK0001.023
FSCK0001.024
FSCK0001.025
FSCK0001.026
FSCK0001.027
FSCK0001.028
FSCK0001.029
FSCK0001.030
FSCK0001.031
FSCK0001.032
FSCK0001.033
fsck0001.034
FSCK0001.035
FSCK0001.036
FSCK0001.038
FSCK0001.039
FSCK0001.040
FSCK0001.041
fsck0001.042
fsck0001.043
FSCK0001.044
FSCK0001.045
FSCK0001.046
FSCK0001.048
FSCK0001.050
FSCK0001.051
FSCK0001.052
FSCK0001.054
FSCK0001.055
FSCK0001.056
FSCK0001.057
FSCK0001.058
FSCK0001.059
fsck0001.060
FSCK0001.061
fsck0001.063
FSCK0001.064
FSCK0001.065
FSCK0001.066
FSCK0001.067
FSCK0001.068
FSCK0001.069
FSCK0001.070
FSCK0001.071
FSCK0001.072
FSCK0001.073
fsck0001.075
FSCK0001.076
FSCK0001.077
FSCK0001.078
FSCK0001.079
fsck0001.080
FSCK0001.081
FSCK0001.082
FSCK0001.083
FSCK0001.084
FSCK0001.085
FSCK0001.086
FSCK0001.087
FSCK0001.088
FSCK0001.089
FSCK0001.090
FSCK0001.091
FSCK0001.092
FSCK0001.093
fsck0001.094
FSCK0001.095
FSCK0001.096
fsck0001.097
FSCK0001.098
FSCK0001.099
FSCK0001.100
FSCK0001.101
fsck0001.102
FSCK0001.103
FSCK0001.104
FSCK0001.105
FSCK0001.106
FSCK0001.107
FSCK0001.108
FSCK0001.109
FSCK0001.110
FSCK0001.111
FSCK0001.112
FSCK0001.113
FSCK0001.114
FSCK0001.115
FSCK0001.116
FSCK0001.117
FSCK0001.118
FSCK0001.119
FSCK0001.120
FSCK0001.121
FSCK0001.122
FSCK0001.123
FSCK0001.124
fsck0001.126
fsck0001.127
fsck0001.128
fsck0001.129
FSCK0001.130
fsck0001.132
fsck0001.133
fsck0001.134
FSCK0001.135
FSCK0001.137
fsck0001.138
FSCK0001.139
FSCK0001.140
FSCK0001.141
FSCK0001.142
fsck0001.143
fsck0001.145
fsck0001.146
FSCK0001.147
fsck0001.148
fsck0001.149
fsck0001.150
FSCK0001.152
FSCK0001.153
FSCK0001.154
FSCK0001.155
FSCK0001.156
FSCK0001.157
FSCK0001.158
FSCK0001.159
fsck0001.160
fsck0001.162
FSCK0001.164
FSCK0001.165
fsck0001.167
FSCK0001.168
FSCK0001.169
FSCK0001.170
fsck0001.171
FSCK0001.172
FSCK0001.173
FSCK0001.174
FSCK0001.175
FSCK0001.177
FSCK0001.178
fsck0001.179
FSCK0001.180
FSCK0001.181
fsck0001.182
FSCK0001.183
FSCK0001.184
FSCK0001.185
FSCK0001.186
FSCK0001.187
FSCK0001.188
FSCK0001.189
FSCK0001.190
FSCK0001.191
FSCK0001.192
FSCK0001.193
FSCK0001.194
FSCK0001.195
FSCK0001.196
FSCK0001.197
FSCK0001.198
FSCK0001.199
FSCK0001.200
FSCK0001.201
fsck0001.202
FSCK0001.203
FSCK0001.204
FSCK0001.205
FSCK0001.206
FSCK0001.207
FSCK0001.208
FSCK0001.209
FSCK0001.210
FSCK0001.211
FSCK0001.212
FSCK0001.213
FSCK0001.214
FSCK0001.215
fsck0001.216
FSCK0001.217
FSCK0001.218
FSCK0001.219
FSCK0001.220
FSCK0001.221
FSCK0001.222
FSCK0001.223
FSCK0001.224
FSCK0001.225
FSCK0001.226
FSCK0001.227
FSCK0001.228
FSCK0001.229
FSCK0001.230
FSCK0001.231
FSCK0001.232
FSCK0001.233
fsck0001.234
FSCK0001.235
FSCK0001.236
FSCK0001.237
FSCK0001.238
fsck0001.239
FSCK0001.240
fsck0001.241
FSCK0001.242
FSCK0001.243
FSCK0001.244
FSCK0001.245
FSCK0001.246
FSCK0001.247
FSCK0001.248
FSCK0001.249
FSCK0001.250
FSCK0001.251
FSCK0001.252
FSCK0001.253
fsck0001.254
FSCK0001.255
fsck0001.256
FSCK0001.257
FSCK0001.258
FSCK0001.259
FSCK0001.260
FSCK0001.261
FSCK0001.262
FSCK0001.263
FSCK0001.264
FSCK0001.265
FSCK0001.266
FSCK0001.267
FSCK0001.268
FSCK0001.269
FSCK0001.270
FSCK0001.271
FSCK0001.272
FSCK0001.273
FSCK0001.274
FSCK0001.275
FSCK0001.276
FSCK0001.277
FSCK0001.278
FSCK0001.279
fsck0001.281
fsck0001.282
fsck0001.283
fsck0001.284
fsck0001.285
FSCK0001.286
FSCK0001.287
fsck0001.288
FSCK0001.289
fsck0001.290
fsck0001.291
FSCK0001.292
FSCK0001.293
FSCK0001.294
FSCK0001.295
FSCK0001.296
FSCK0001.297
FSCK0001.298
fsck0001.299
FSCK0001.300
FSCK0001.301
FSCK0001.302
FSCK0001.303
fsck0001.304
FSCK0001.305
FSCK0001.306
FSCK0001.307
FSCK0001.308
fsck0001.309
FSCK0001.310
fsck0001.311
FSCK0001.312
FSCK0001.313
FSCK0001.314
FSCK0001.315
fsck0001.316
FSCK0001.317
FSCK0001.318
FSCK0001.319
FSCK0001.320
FSCK0001.321
FSCK0001.322
FSCK0001.323
FSCK0001.324
FSCK0001.325
FSCK0001.326
FSCK0001.327
FSCK0001.328
FSCK0001.329
FSCK0001.330
FSCK0001.331
FSCK0001.332
fsck0001.333
fsck0001.334
fsck0001.335
FSCK0001.336
FSCK0001.337
fsck0001.338
FSCK0001.339
fsck0001.340
FSCK0001.341
fsck0001.342
fsck0001.343
FSCK0001.344
fsck0001.345
FSCK0001.346
fsck0001.347
FSCK0001.348
fsck0001.349
FSCK0001.350
fsck0001.351
FSCK0001.352
fsck0001.353
FSCK0001.354
fsck0001.355
fsck0001.356
fsck0001.357
fsck0001.358
FSCK0001.359
FSCK0001.360
fsck0001.361
FSCK0001.362
FSCK0001.363
FSCK0001.364
FSCK0001.365
FSCK0001.366
fsck0001.367
fsck0001.368
FSCK0001.369
FSCK0001.370
fsck0001.371
FSCK0001.372
FSCK0001.373
fsck0001.374
fsck0001.375
fsck0001.376
fsck0001.377
fsck0001.378
fsck0001.379
fsck0001.380
fsck0001.381
fsck0001.382
fsck0001.383
fsck0001.384
fsck0001.385
fsck0001.386
grub_str.wor
grubx64.efi
h9┼sahëφ.Iïw
hà╔tαaïd.$,9
Hc╔IëL$.H╣6
 ╨Hë├Hà└.t#╞
hë╙hâ∞xl.ëD$
╒Hë▀LëεH.╕▄å
hì]_hâπα.HïE
i ─ä┬u░h.à█u
ìT$&Dë∩H.╕Ç┬
iteratin.g E
≈i╙αë┴i≈.╪H╙
ld not s.et
`ñmñwñüñ.╤Ñ°
ñº╣º├ºπº.⌡º 
no signa.tur
,ºjºwºlº.}ºä
¬ó╕ó╞ó▀ó.Θó÷
P(HëkXLë.c`H
póùó█ó1ú.ªú╡
T$0HëL$8.LëD
u1φshâ∞(.Hët
ub_xaspr.int
UEFI Sec.ure
UHë╒SHë╦.Hâ∞
us1█hâ∞x.HëL
%úvúbúäú.Æú╕
αí·ídóæó.£ó╘
╒Θw   Lë.τLë
ΦrXM)Φ1└.I╜6

Something's still off.

Am I right in assuming that the EFI partition can't be "saved" anyway, so that I can just play around with it without fearing a data loss (as the data I am afraid to lose on the esp in unrecoverable anyway)?

Last edited by etc (2023-03-03 00:31:18)

Offline

#23 2023-03-03 07:54:07

d.ALT
Member
Registered: 2019-05-10
Posts: 959

Re: [SOLVED] Compromised Laptop after Windows Update

etc wrote:

(as the data I am afraid to lose on the esp in unrecoverable anyway)?

Could be recoverable (maybe).

Anyway...
At this point I suggest you to new-format ESP (the FAT32 partition): you'll lose all boot files (GRUB+Windows)!!
Then, enter Recovery Mode from booting a Windows 11 ISO: from there repair / re-create Windows' Boot Files and BootLoader.
Verify Windows is booting fine.
Then, at this point you just need to boot into ArchLinux's Live Environment, mount partitions (remember to mount the FAT32 partition into /efi) and chroot into.
Install and configure GRUB (pointing to /wherever-you-decided-to -mount-the-ESP/efi).
Re-install kernel and re-execute mkinitcpio.
Reboot

Ask here if in doubt.

<49,17,III,I>    Fama di loro il mondo esser non lassa;
<50,17,III,I>    misericordia e giustizia li sdegna:
<51,17,III,I>    non ragioniam di lor, ma guarda e passa.

Offline

#24 2023-03-03 21:15:20

etc
Member
Registered: 2023-02-28
Posts: 16

Re: [SOLVED] Compromised Laptop after Windows Update

d.ALT wrote:
etc wrote:

(as the data I am afraid to lose on the esp in unrecoverable anyway)?

Could be recoverable (maybe).

Anyway...
At this point I suggest you to new-format ESP (the FAT32 partition): you'll lose all boot files (GRUB+Windows)!!
Then, enter Recovery Mode from booting a Windows 11 ISO: from there repair / re-create Windows' Boot Files and BootLoader.
Verify Windows is booting fine.
Then, at this point you just need to boot into ArchLinux's Live Environment, mount partitions (remember to mount the FAT32 partition into /efi) and chroot into.
Install and configure GRUB (pointing to /wherever-you-decided-to -mount-the-ESP/efi).
Re-install kernel and re-execute mkinitcpio.
Reboot

Ask here if in doubt.

Thank you so much. It all went well until I wanted to run mkinitcpio. I get the output 

==>ERROR: '/lib/modules/6.1.8-arch1-1' is not a valid kernel module directory

Offline

#25 2023-03-03 21:45:54

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 76,358

Re: [SOLVED] Compromised Laptop after Windows Update

uname -a

You seem to be booting a rather old kernel - maybe from the install iso?
You should™ not have to run mkinitcpio explicitly, installing the kernel would do that for the new kernel.
You can in doubt specify a kernel w/ the "-k" option.

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

Pages: 1 2

Board footer

Powered by FluxBB