
Asus Z390 Motherboards Automatically Push Software In2 Your Windows Installation - tapper
https://www.techpowerup.com/248827/asus-z390-motherboards-automatically-push-software-into-your-windows-installation
======
4cao
Looks like it's the WPBT ACPI table again. Lenovo was caught doing the same
back in 2015:
[https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nas...](https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nasty/)

Windows will just blindly execute the binary from the WPBT table on boot.
Specifically, it's done by the Session Manager, the first user-mode process
(%SystemRoot%\System32\smss.exe).

The WPBT table is dumped as %SystemRoot%\System32\wppbin.exe and then
executed.

This behavior can apparently be disabled by a registry setting:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]

"DisableWpbtExecution"=dword:00000001

The previous time this happened, didn't Microsoft promise to keep this
behavior on by default only in a corporate setting? Or maybe I'm
misremembering.

(Edited to add more details.)

------
rbanffy
I would tolerate if the board exposed a small romdisk that's visible to the
OS, but running stuff without my express consent is waaaaay too much.

------
navjack27
Old article is old. Old news.

