SOLVED how to clean reinstall without losing drivers? or should i look for malware?

I am having trouble doing a clean install. On a different PC, I made a USB but when I tried to do the clean install, I got a message that it couldn't find any drives, not C, not anything. Then I got a BIOS menu, I made sure USB is listed first. but restarting again didn't do anything, I don't know how to get a clean install to work. This is kind of different I guess so going to make a new thread? Feel free to put it back here if you think that is better.

editing to add - I did the clean reinstall (at least I think I did, ran into some roadblocks). It does seem to be running better, not sure whether that relates to malware or something else. But for example, Hypersnap before was doing this odd thing of capturing itself as the active window, now it is working normally. A few little things I guess.

Which means I still have the question though - is there any chance that there was a series of events like
-- laptop connected to Asus router with malware
--laptop infected
--laptop then connected to a different brand router, might that router have been infected? how to tell?

Done, but supposedly Cyclops Blink can survive that. I think I'm tossing the Asus router as the easiest solution, it is EOL so won't get additional firmware updates and supposedly this survives a factory reset.

more from techspot --

"The new Asus module is built to access and replace a router's flash memory. The botnet reads 80 bytes from the flash memory, writes it to the main communication pipe, and then waits for a command with the data needed to replace the content. A second module gathers data from the infected device and sends it to the C2 server. A third module, "file download (0x0f)," downloads files from the internet using DNS over HTTPS (DoH)."


and from here

"
Malware overview
The malware itself is sophisticated and modular with basic core functionality to beacon (T1132.002) device information back to a server and enable files to be downloaded and executed. There is also functionality to add new modules while the malware is running, which allows Sandworm to implement additional capability as required.
The NCSC has published a malware analysis report on Cyclops Blink which provides more detail about the malware.
Post exploitation
Post exploitation, Cyclops Blink is generally deployed as part of a firmware ‘update’ (T1542.001). This achieves persistence when the device is rebooted and makes remediation harder.
Victim devices are organized into clusters and each deployment of Cyclops Blink has a list of command and control (C2) IP addresses and ports that it uses (T1008). All the known C2 IP addresses to date have been used by compromised WatchGuard firewall devices. Communications between Cyclops Blink clients and servers are protected under Transport Layer Security (TLS) (T1071.001), using individually generated keys and certificates. Sandworm manages Cyclops Blink by connecting to the C2 layer through the Tor network.....................
Mitigations
Cyclops Blink persists on reboot and throughout the legitimate firmware update process. Affected organizations should therefore take steps to remove the malware.
WatchGuard has worked closely with the FBI, CISA, NSA and the NCSC, and has provided tooling and guidance to enable detection and removal of Cyclops Blink on WatchGuard devices through a non-standard upgrade process. Device owners should follow each step in these instructions to ensure that devices are patched to the latest version and that any infection is removed.
The tooling and guidance from WatchGuard can be found at: Web Detector.
In addition:

• If your device is identified as infected with Cyclops Blink, you should assume that any passwords present on the device have been compromised and replace them (see NCSC password guidance for organizations.
• You should ensure that the management interface of network devices is not exposed to the internet.

Indicators of Compromise
Please refer to the accompanying Cyclops Blink malware analysis report for indicators of compromise which may help detect this activity"

so.... I don't know much but definitely stressing over this.

I did get into the Bios but ---

It is a Lenovo ideapad 17in, not an Asus computer.

I got into the Bios, I disabled then reenabled Secure Boot. I was not able to find the UEFI setting or hard drive setting.

Then it was asking me for a Bitlocker key, I have never used Bitlocker, I did get the key though so now I can start the computer normally.

But please look at these screenshots of BIOS settings (some stuff redacted , I wasn't sure what was more personal so may have over-redacted)
I don't see where to get into the choices you mentioned above,
Advanced and look for Hard Drive mode. Is it set to IDE/Legacy? Or AHCI? it should be AHCI, If not this will not recognize the drive.
Also, Go to the Boot tab, is the computer setup for UEFI Bios, or Legacy/CSM
in fact I didn't see any advanced setting at all.

Here is the link to the Lenovo support for this model


but I couldn't find anything to help me get into advanced Bios settings.

When I have the USB disk with the Windows media loaded, it sees it (that usb is ESD-USB and it calls it C even though it is an external USB drive) and what it calls Boot drive letter X is actually the internal C drive. But I still get the error message when I try to reinstall Windows. When I take out the USB and restart everything looks ok and the C drive is definitely ok and working.

Please help.

hi, it is

IdeaPad 3-17ITL6 Laptop - Type 82H9

that link is the support page i get after entering my serial number.
the USB drive is the first thing listed on the Boot menu, but weirdly the others sem to be internet, not C? it boots totally normally so definitely I am not understanding something.


Just followed your instructions.
I get this far
To do a Clean Install, In the Windows Installer, Select your Language, then Custom Install-----then..........
then I don't get an option to choose a drive,
instead I get the same message,
No signed device drivers were found.

And it does not show any drives at all in the list, even though if Click Browse to find a driver folder, I get the same menu ( showing the USB drive as C and the internal drive as X) same as picture above. Selecting either of those, I get " no signed device drivers were found. make sure that the installation media contains the correct drivers"
then I cannot progress further.

I think when I tried yesterday it might have pulled drivers off the internet? now I am trying without an internet connection, just the Windows media, created directly off Microsoft support as you describe above.

I probably will go to sleep soon but will pick up from here tomorrow evening. Thank you! Sorry, I am sure I am doing something stupid wrong but no idea what it is.

Drive letters will change in the Recovery Environment.
In the Select the Drive to Install window, the only drive showing is the USB Flash drive.
You Have Blocked out the Make and Model # of the NVMe Drive.
The only Bootable devices are the Flash drive and the Ethernet Network Adapter.
There is something wrong with the NVMe drive. Try Removing it and Reseating it into the computer. If that fails, you can use a Standard SATA drive
It should look like this:

hi, what is the nvme drive? is that the normal C drive? see screenshot re make and model but everything works ok the rest of the time. doesn't that mean the C drive is ok? i don't know anything about partitions, i didn't partition it but i guess maybe it came with drivers in a different partition?

i am worried about pulling out the c drive (i would definitely be taking it to someone, way past what i can do in terms of hardware) if it seems to work fine in every other way. but do you think this is possibly malware? (have already been cleared in Malware forum though, just a day or two ago).

Definitely the BIOS isn't showing a bootable C drive and i don't understand that at all but especially that it powers on and boots completely normally.