Solved Lenovo Services running on newish Asus laptop ?

Setting up an Asus TUF Gaming A16 FA608UM, I was surprised to see in the Process Explorer a couple of active service processes from a competitor, Lenovo.
The parent of this Service is C:\Windows\System32\DriverStore\FileRepository\lenovofnandfunctionkeys.inf_amd64_{a whole bunch of random characters}\LenovoUtilityService.exe
The description of this service is: Lenovo Fn and function keys service.
Then there are two child processes: FnHotKeyCapsLKNumLK.exe, the full path of which is Access Denied, and another child process: C:\Windows\System32\DriverStore\FileRepository\lenovofnandfunctionkeys.inf_amd64_{a whole bunch of random characters}\FnHotkeyUtility.exe
the description of which is: This utility controls special keyboard functions and like hotkeys and function keys, on your Lenovo notebook.
This seems quite reasonable, except it is not a Lenovo notebook!
The function keys are working on the laptop.
I disabled the service, and the function keys continue to work.

Looking further, it turns out that there are 4 Lenovo services running on this Asus laptop.
The other 3 are:
Lenovo Intelligent Sensing Service – SmartSense.exe also located under DriverStore\Filerepository\
Universal Device Client Service – C:\WINDOWS\System32\drivers\Lenovo\udc\Service\UDClientService.exe
System Interface Foundation Service – C:\WINDOWS\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe

I disabled them all and rebooted. The boot was a bit slow. Possibly because it was trying to start services that were disabled?
So I switched them to Manual, to see if any of them would be started. The SystemInterfaceFoundationService was started, the other 3 were not. Then the SystemInterfaceFoundationService changes its own startup type to Automatic (Delayed Start) from Manual.

I ran a virus scan of C:\Windows\System32 and then on the entire system and it found nothing.
I ran a complete scan with a second antivirus scanner and it also found nothing suspicious.

I ran Dism /Online /Cleanup-image /ScanHealth and it found nothing to report.
I ran Dism /Online /Cleanup-image /CheckHealth and it found nothing out of order.
I ran sfc /scannow and it found nothing to fix.

I have downloaded and installed the latest drivers from ASUS TUF Gaming A16 (2025)

I have only installed a few application programs so far, mostly open source. I queried perplexity and none of those programs install any Lenovo services.

So what’s up – is Asus shipping Lenovo software or did malware somehow creep in?

Johnson said:

So what’s up – is Asus shipping Lenovo software or did malware somehow creep in?

Click to expand...

Some genius probably used a driver updater, which found the latest drivers from Lenovo rather than ASUS.
You do not need any of those mentioned, since they are literally designed to maintain Lenovo devices.
On top of it, Lenovo has a bad reputation, when it comes to preinstalled software/spyware.

As mentioned, a driver updater could do it (horrible things), a cloned drive could also do it. Another possibility is the system was not a brand new, factory sealed device when you got it.

Hello @Johnson and welcome to Eleven Forum.



I suggest you grab a copy of the free REVO uninstaller, and install it
Then open the program and look for any Lenovo entries on the Uninstaller tab or the Windows Apps tab.


The best thing about REVO is that when you highlight and entry and choose: Uninstall, it uninstalls the highlighted item, AND....

You'll see a "scan" option pop up. Click that and it will find ALL the leftovers that the uninstaller missed.





If this was a desktop, I'd say nuke that stuff.
But laptops are strange and mysterious things. As someone mentioned... it could be a driver updater (avoid those like the plague), or some weird thing ASUS is doing.

TairikuOkami said:

Lenovo fined $3.5m for pre-installed adware that hijacks HTTPS connections

In addition to paying $3.5 million to 32 states in the US, the Chinese hardware manufacturer will also be subject to audited security checks of its software for the next two decades.

www.zdnet.com

Click to expand...

Info from 2017, not very significant today.

Anibor_11 said:

Info from 2017, not very significant today.

Click to expand...

That would be an accurate assessment if we were talking about software, but we're talking about criminals. People don't change. Especially when there are no consequences sufficient to make them stop.

Obtain your Recovery Media from ASUS or use the Recovery Partition. I do not know what is the case for ASUS.
That will return the Laptop to an as bought state along with all correct drivers.

Much easier than doing forensics.

The usual scenario is users do a so-called clean install and mess up drivers, lose system drivers, policies for CPU/GPU, Power Plans and so forth.
Another scenario maybe a store selling returned Laptops that have not been restored properly.

Thank you all for your helpful answers.
The system was indeed an open box, but the store was adamant that they cleaned it up and reset it to OOBE before putting it up for sale - I guess they did not do that very thoroughly.
I deleted the services and related drivers, creating restore points along the way, then had a look in Revo uninstaller for anything suspicious, but did not find any more.
It boots normally now as far as I can tell.