Can malware survive on EFI Partition + Storage location connected BT devices

Hey Guys,

I am new in this forum but a long time mac user. I got a question and I am hoping you might be able to help me.

My general question is: Is it possible for malware etc. to be present on the EFI partition and thus survive a format of the regular partition?
If not: Is information about previously connected bluetooth devices saved on the bluetooth module and not the harddrive?

Let me briefly explain the circumstances.
I bought a new Macbook Pro 2015 13". I was looking for a used 2,9 GHz model with 16 Gb of RAM and 512 GB SSD. Since those are really hard to find (ebay, refurbished stores etc), I also looked on Ebay in other countries of the EU. In the end I got one for a decent price on Ebay UK. The vendor looked a bit sketchy but good a long history of good reviews. What made me mistrustful was a bunch of things: general appearance, no box included, new charging cable, he didnt answer for my question of the serial number to check somehow whether it might be stolen, full version of Office and Carbon Copy Cloner installed). On the other hand was the laptop also nearly new (only 22 battery cycles). I was sceptical but decided to purchase it anyways. I am are careful person and aware that professionals might be able to use this scenario to extract data when a preinstalled OS is used.
I checked for signs of use etc. I just saw a long list of known Bluetooth devices, some were named.

I wanted to completely wipe the harddrive but could not get DBAN or Partition Magic running due to UEFI. So I just booted into recovery (from the internet) and format the partition (a recovery partition was not present). I used a clean installation file I put on a USB stick using my old macbook. Everything looked fine so I continued setting up the system. I also installed Bootcamp and windows 10. When I was running windows 10 through VMWare Fusion. When I entered the bluetooth tab it showed a connected Bluetooth device. What shocked me was that the device had the same name as before the disk format and fresh install. How is that possible?

And I am very sure that the BT device in not located at my home. It does not show on my other devices. And the name was xy's mouse. "XY" is was a Asian name and there are no Asian people living nearby.
How could data remain (in the best case just data in the worst case spyware or similar)? Considering that the following was given:
- formatted the partition
- no recovery partition present
- used a new install file on a formated USB stick.
- Installation of High Sierra changed the partition from HFS+ to APFS
- have Avast Antivirus running

I hope you guys can help me since I am getting a bit paranoid here

G'day and welcome to the forums.

Bit of a mess and first suggestion dump Av ast as it is a real resource hog and does nothing for your Mac. Same with dban and partition Magic. Your Mac does not need them and Disk Utility is the best way to do these things..

Malwarebytes for Mac is the best recommended anti-malware here but sadly it does not run on external drives. The Recovery Partition on newer op[erating systems is not visible. Sure sounds like a used drive, and if it is an SSD, you have not said, I would clone it using SuperDuper or Carbon Copy Cloner after formatting the drive in Disk utility. Have Malwarebytes for Mac on the internal so it goes onto the clone when cloning is complete. Boot from the external and run MBFM over it that way.

Thank you for the reply.
I know that Avast does not improve my computers performance but I do not share the opinion that a Mac does not need Antivirus software. There is fewer malware for Mac but it exist. It also checks for Windows malware and thus preventing possibly embarrasing situation when handing files to windows users.
Dban and Partition Magic are not made for OS X but are general use unix based standalone OS that are booted instead of OSX for wiping the entire harddrive and / or partitioning the harddrive.

To be clear. I do not have any performance issues, nor is the computer behaving strangely. However, malware that slows down your computer to destroy or troll you is not that common anymore. Spysoftware in the other hand does not use a lot resources nowadays. The laptop came from someone with unlimited physical access to it. What made me suspiscious is that it showed a Bluetooth device it showed after a format and clean install, which was shown before as well and I am sure is not present in my house.
I just want to make sure that my system is not infected by a rootkit / bootkit that resides in the EFI partition or even rather rare malicious code in the SSD firmware or other firmware.

I tried "rkhunter" installed via homebrew. But it showed:
"Invalid BINDIR configuration option: Invalid directory found: Fusion.app/Contents/Public" when using sudo rkhunter --update.
I don't know what is wrong with the configuration of it.

Have you any tools or techniques for detection or does anyone know whether a history of Bluetooth devices are saved on the chip itself? That would explain it and would remove all suspicion.

The Bluetooth input devices, such as keyboards and mouse, need to be available prior to the OS starting up. It doesn't really matter if it's called BIOS, EFI or UEFI; in order to manage pre-OS boot environment, these devices need to be available.

The chances are that the Bluetooth mouse name in your case reside in the NVRAM. The VMVare Fusion probably red the hosts NVRAM and passed it over to Windows 10.

You can check in the terminal if that's the case by issuing the following command:

nvram -xp

Click to expand...

The "-xp" flag displays the content of the NVRAM in XML format, instead of the standard format with the "-p" flag.

You can also reset the content of the NVRAM:

https://support.apple.com/en-us/HT204063

Being paranoid makes you do wild goose chase, I've been there done that...;D