Frequently Asked Question
ESET reports a UEFI detection. What should I record and how should I respond?
QUICK ANSWER
A UEFI detection can concern system firmware, which needs a different response from deleting an ordinary infected file. Record the exact detection and follow the computer manufacturer's firmware-remediation guidance.
Applies to: ESET UEFI detections. The detection name, location and exact computer/board determine the appropriate response.
Work through these checks
- Record the full detection. Save the exact detection name, reported location, ESET product/version and detection time. Do not assume every UEFI-labelled finding has the same cause or severity.
- Keep protection and evidence intact. Update ESET through its normal supported channel and preserve the relevant detection log. Keep a separate backup of important files before firmware maintenance.
- Identify the exact platform. Record the computer or motherboard model and existing firmware version. Use the system manufacturer's approved firmware and instructions, rather than a generic image for a similar board.
- Follow the supported firmware remedy. ESET explains that hardware-firmware UEFI detections cannot be removed by its normal cleaning process. Arrange the appropriate vendor-supported update or remediation with reliable power and the required recovery preparations.
- Recheck after the approved change. Repeat the supported scan and record whether the same finding remains. If it does, give the system vendor the detection and firmware evidence for further investigation.
Confirm the result
The vendor-supported remediation is documented and a follow-up scan result is saved. Do not claim the system is clean merely because an alert has been hidden.
Before going further: Do not add blanket exclusions, disable potentially unsafe-application detection or attempt a DIY SPI flash rewrite to silence a firmware alert. These actions are not a general repair.
If you need help
Include these details in your ticket: Exact detection, ESET version, system/board model, firmware version and follow-up result. Share diagnostic logs privately.
Related guidance: ESET LiveGrid is not accessible or Limited Direct Cloud connectivity appears. What should I check?
Updated 261110