You can't necessarily remove it. For example, there's a mechanism called the Windows Binary Platform Table that automatically copies an EXE from the UEFI image and executes it with kernel-level privileges on each boot. It's intended to be used to deliver drivers or anti-theft software after a clean install, but Lenovo was using it to deliver malware, and there's nothing you can do about it unless you have a signed image without the malware included.

http://thenextweb.com/insider/2015/08/12/lenovo-used-a-hidde...