Chinese computer maker Acemagic has admitted that some of its products have been shipped with malware pre-installed.
YouTuber The Net Guy found malware on Acemagic minicomputers when he tested them in early February. He didn't have to look hard to find it: within minutes of booting up the machine, Windows Defender reported the presence of the Bladabindi malware – a known backdoor which steals users information and can also install more malware.
Last week, Acemagic confirmed that Bladabindi had entered some of its computers and admitted that there is probably redline malware. Redline is an information stealing software that can perform system inventory, take information from browsers and recently gained the ability to steal cryptocurrencies.
Acemagic's explanation for the infection was strange and a bit inconsistent. In a February 21 statement, the company explained the malware as follows:
“Our software developers, in an effort to improve the user experience by reducing the initial boot time, made adjustments to the Microsoft source code, including network settings, without obtaining digital software signatures. This oversight has led to isolated reports of virus-infected minicomputers manufactured before November 18, 2023.”
But in a statement which was sent to The Register and dated February 27, the company said "The incident resulted from software adjustments made by developers to reduce boot times, which inadvertently affected network settings and omitted digital signatures."
Acemagic promised to strengthen its use of digital certificates "to prevent unauthorized modifications", suggesting that strangers may have accessed its computers – or perhaps even the master copy of Windows – to serve up the malware.
Whatever the developers did and whoever they worked for, it remains unclear whether the infections came from the factory or were done when the computers were booted by their new owners.
Acemagic will refund the cost of machines manufactured between September and November 2023 and has advised owners that the date of manufacture is recorded on stickers affixed to the relevant models: AD08, AD15 and S1.
