What to do if Computrace is activated in your TP BIOS

[rails]

So i purchased a Thinkpad t540P second hand. It is supposed to be a decommissioned laptop from a corporation. Supposedly it got issued late and had very little use. It looks that way....no signs of wear and/or tear. The hard-drive was wiped. I have an OEM license for Windows 7 which I installed. So i did a fresh install of Windows 7. I also updated the bios since it is an older machine. When I went to make sure the bios updated correctly, i saw the note from absolute Computrace. Under security (anti-theft) it is listed as enabled/not activated. I cannot select anything on this screen. I contacted Absolute at the number provided and they have no record of the machine based on the information I provided, which sounds crazy in that their program is on the machine and based on what I have read in this forum ALL Thinkpads have this installed. Bottom-line there is nothing for them to deactivate as my machine apparently doesn't exist.

I read many articles on this forum (which is excellent btw) and all of the referenced services and programs are present. I can't stop them, delete them, or modify them. The seller says it is a used machine in excellent condition and will not offer a refund. I cannot tell for sure, but from what I read it seems there is no "end-user method" to deactivate or remove this program. I have seen a few references to enlisting someone who works at deep levels within the computer but i don't know what that means exactly or who such individuals are really or how to find one.

Based on everything I just said above, should I scrap the machine and just take it as a loss? I can't really afford that but I also can't take the risk of working on a potentially stolen machine and having my files/work compromised or remotely wiped-out later on.

any advice our counsel?

Roger

[RealBlackStuff]

Welcome to the Forum.
You should be able to click on Enabled and change that to Disabled or Permanently Disabled (HIGHLY recommended).
Can you change ANYthing in the BIOS?
If not, then you have a Supervisor Password in the BIOS.
In that case a motherboard replacement would be your best solution (or learn to live with it)

As such, no access to the BIOS does NOT mean that the machine has been stolen!

[rails]

I'm such a dummy. I got into the bios before I purchased but didn't attempt to change anything. No I can't change anything. It's read only. Uggggh! So the only work around for an I know supervisor bios password is a new motherboard?

[Cigarguy]

Yes, unless the previous owner knows the password.

Having Computrace enabled is bad enough but having supervisor password enabled is worse in my books. Personally a system with both enabled is a no go for me.

[rails]

So the seller is totally unwilling to take the machine back. I looked up motherboards for a t540P and saw a range of $149 to almost $400. What are the watchouts on ordering a mother board and is this really something that can be end-user installed? I'm fairly handy with electronics but this would be the biggest project ive undertaken. Is the motherboard the only item I would need? Any advice would be appreciated.

Roger

[RealBlackStuff]

If you bought it on eBay, you can try and open a case "Not as described" to (hopefully) return it and get your money back.

To find out exactly which motherboard you need, enter your Serial # (without any -) here: http://pcsupport.lenovo.com/us/en/partslookup
The motherboard there is also known as PLANAR or BDPLANAR and the P/N looks like e.g. 04X5257

The T540p comes with different mobos with either Integrated graphics or Discrete switchable graphics (Optimus).
It also has different Windows keys (W7 or W8) in BIOS, and comes with or without AMT and with or without TPM.

If you have Optimus, you can also look for an Integrated motherboard.
If you have Integrated and want Optimus, you would also need an additional discrete fan.
Anything else can be transferred from your "old" motherboard.
Just in case: T540 and T540p use the exact same motherboards.

Make sure there is NO password and NO enabled/activated Computrace on your purchase!

Get the partslist here: http://download.lenovo.com/parts/ThinkP ... 131107.pdf
Get the HMM manual here: https://thinkpads.com/support/hmm/hmm_p ... 003_01.pdf

Before you start taking the machine apart, read the HMM and make a drawing of the bottom, with all its screwholes marked.
Then tape the screws on the drawing as you remove them.
Do the same for the inside(s), so you don't mess/mix up the screws.
Don't force anything and don't rush.

[tyrant0101]

Very in-depth paper from blackhat.
https://www.blackhat.com/presentations/ ... -PAPER.pdf

I don't understand it hardly at all, but the gist is that it makes laptops vulnerable.

hey guys anyone know how to get that XML thing to work? I tried copy and pasting it to a notepad and saving it as XML but it didn't copy those weird underscore brackets and my dell is not accepting it/creating the error needed to reset the computrace

bought it from some guy that seemed semi knowing about computers, it had a bios password but he gave it to me when i tried to access it, paranoid he'd try and scam with computrace
interesting reading that their softwares not W10 compatible which is what I Was gonna put on it but I figure i'd try disabling it first for the person Im gonna give the computer to, but headache aghh lol

[RealBlackStuff]

See if this works:

Code: Select all

<root>
<command name=”Inventory”>
<property name=”OnBoardDevices.AGPSlot” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.BuiltinNIC” value=”3” errorcode=”0x0” />
<property name=”OnBoardDevices.BuiltinFloppy” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.BuiltinNIC2” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.BuiltinPointingDevice” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.IntegratedAudio” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.InternalMiniPCI” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.MediaCardAnd1394” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.Microphone” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.Onboard1394” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.OnboardModem” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.ParallelPortConfiguration” value=”3” errorcode=”0xFFFFFFFE” />
<property name=”OnBoardDevices.PCCard” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.PCCardAnd1394” value=”3” errorcode=”0x0” />
<property name=”OnBoardDevices.PCISlots” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.SmartCardReader” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”OnBoardDevices.TabletButtons” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”Drives.IDEController” value=”3” errorcode=”0x0” />
<property name=”Drives.IntegratedSATAController” value=”5” errorcode=”0x0” />
<property name=”USB.USBPortsExternal” value=”3” errorcode=”0x0” />
<property name=”USB.USBWake” value=”4” errorcode=”0x0” />
<property name=”MTN.ModuleBayDevice” value=”3” errorcode=”0x0” />
<property name=”PWR.AutoOn” value=”3” errorcode=”0x0” />
<property name=”PWR.AutoOnHour” value=”0” errorcode=”0x0” />
<property name=”PWR.AutoOnMinute” value=”0” errorcode=”0x0” />
<property name=”PWR.CPUVirtualization” value=”4” errorcode=”0x0” />
<property name=”PWR.HardDiskAcousticMode” value=”3” errorcode=”0x0” />
<property name=”PWR.MultiCore” value=”3” errorcode=”0x0” />
<property name=”PWR.SingleCoreTurboMode” value=”3” errorcode=”0x0” />
<property name=”PWR.SpeedStep” value=”3” errorcode=”0x0” />
<property name=”PWR.WakeupOnLAN” value=”3” errorcode=”0x0” />
<property name=”POST.ExternalHotkey” value=”3” errorcode=”0x0” />
<property name=”POST.FastBoot” value=”4” errorcode=”0x0” />
<property name=”POST.Keypad” value=”2” errorcode=”0x0” />
<property name=”POST.NumLock” value=”3” errorcode=”0x0” />
<property name=”POST.USBEmulation” value=”4” errorcode=”0x0” />
<property name=”Security.ChassisIntrusion” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”Security.ChassisIntrusionStatus” value=”4” errorcode=”0xFFFFFFFE” />
<property name=”Security.NoExecute” value=”4” errorcode=”0x0” />
<property name=”Security.PasswordBypass” value=”3” errorcode=”0x0” />
<property name=”Security.TrustedPlatformModule” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”Security.TrustedPlatformModuleActivation” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”Wireless.BluetoothDevices” value=”3” errorcode=”0x0” />
<property name=”Wireless.CellularRadio” value=”3” errorcode=”0x0” />
<property name=”Wireless.RadioTransmission” value=”2” errorcode=”0xFFFFFFFC” />
<property name=”Wireless.WiFiCatcherChanges” value=”4” errorcode=”0x0” />
<property name=”Wireless.WiFiLocator” value=”3” errorcode=”0x0” />
<property name=”Wireless.WirelessLAN” value=”3” errorcode=”0x0” />
<property name=”Wireless.WirelessSwitchBluetoothControl” value=”3” errorcode=”0x0” />
<property name=”Wireless.WirelessSwitchCellularControl” value=”3” errorcode=”0x0” />
<property name=”Wireless.WirelessSwitchWirelessLANControl” value=”3” errorcode=”0x0” />
<property name=”SS.AssetTag” value=”Hola_loco” errorcode=”0x0” />
<property name=”Configuration.PropertyOwnershipTag” value=”Tagservice” errorcode=”0x0” />
<property name=”SS.BIOSDate” value=”2006-06-09T00:00:00” errorcode=”0x0” />
<property name=”SS.BIOSVersion” value=”XXXX” errorcode=”0x0” />
<property name=”SS.SystemName” value=”Test” errorcode=”0x0” />
<property name=”SS.PowerMgtSupported” value=”5” errorcode=”0x0” />
<property name=”SS.Status” value=”” errorcode=”0x8004100E” />
<property name=”SS.ServiceTag” value=”______________” errorcode=”0x0” />
<property name=”SS.SystemDescription” value=”________________________________” errorcode=”0x0” />
<property name=”SS.SystemVendor” value=”______________” errorcode=”0x0” />
<property name=”SS.ProcessorType” value=”1” errorcode=”0x0” />
<property name=”SS.ProcessorSpeed” value=”2666” errorcode=”0x0” />
<property name=”SS.SystemClass” value=”1” errorcode=”0x0” />
<property name=”SS.AssetTag” value=”______________” errorcode=”0x0” />
<property name=”SS.ManufacturerDate” value=”” errorcode=”0x8004100E” />
</command>
</root>

If your copy/paste does not work completely, carefully compare between the source and your editor.
Manually enter any missing characters where needed.

FYI: this is a Thinkpad forum.
For anything Dell related, please go to a Dell forum.

[oeuvre]

Just wanted to let you guys know, recently 2 ThinkPads I've bought on eBay came with Computrace enabled. I called the # provided on the BIOS screen and just gave the serial # over the phone. Installed Windows + wifi drivers, left machines on overnight and restarted the next morning. Gone. So yeah it works if you are polite.

[Jbloodwo]

Let’s try this again

A fried and I bought x131’s over the weekend at frys because he had a savings code that made them too good to pass on. unfortunately, no one in the chain appears to have released these machines because computrace is still active. What I am wondering is will I need to reinstall windows or boot from a windows thumb drive to get this junk disabled. The first thing I did on my system is increase he ram and install a Ubuntu re-spin (pop!). Can computrace talk back to Linux. The tread was not clear. Also, I noticed the BIOS was still at the factory 1. Whatever. It was and I installed the latest update due to the IME JTAG exploit. Am I screwed? As I was writhing thi I started to wonder if the JTAG exploit could have been a method to get around disabling.


Sent from my iPad using Tapatalk

[Edward Mendelson]

Absolutely all your questions are answered in the very first post in this thread (and a later post makes clear, or ought to make clear, that, yes, CompuTrace talks to Ubuntu). Make sure to look at the section that says what NOT to do as well as the sections that tell what you ought to do.

But, in summary, don't even think of wasting your time doing any of the things that you ask about in your message. Just read the first post and follow its instructions.

[Jbloodwo]

Well I am part of the way there. Called absolute and the system is “disabled” in the database. However, the agent stated no way to ever disable in bios. Which we known is BS


Sent from my iPhone using Tapatalk

[Edward Mendelson]

Wait a day until it's deactivated and then disable it.

[Jbloodwo]

Wait a day until it's deactivated and then disable it.

Actually it was only about 2 hours and 3 reboots. I shrank my Linux install by 32 gig and installed win 10 an after like 4 boots I went in to bios and no more warning. Thanks to all of you. Computrace is now permi ally disabled....


Sent from my iPad using Tapatalk

Admin note: please read this: viewtopic.php?f=61&t=124261

[edik]

Although it may work with Linux (and phone home) not so sure about the BSD variants

You may get away with FreeBSD, NetBSD and such on your machines... (as well as Solaris, OS/2 etc.) ??

The BSD's especially run almost anything Linux can (and even run Linux SW in compatibility mode) and are reputably even more secure than Linux.

[n2ri]

looking at the link about issues and auto activated events with several new systems not associated with the security agency that is supposed to have authority to do so. it seems just as reported years ago China (the country of origin for all hardware for these computers and parts. is indeed embedding tracking/hacking programs in BIOS/hardware just as Seagate and prior manufacturers was found out about years ago. maybe this explains lots of massive hacks World wide the last couple years and likely who is profiting from it. they also have been buying up all entertainment venues besides electronics and communication related even from neighboring countries as well as leading nations.

[tecmes]

Thanks to the OP.

One point is not fully clear for me: in what situations can Computrace "infect" another computer's BIOS when a Computraced HD is swapped in?


(I'm asking because I bought a used TP with it. It ran a (presumably) freshly-installed Ubuntu and I never connected it to the Internet myself. Then I swapped that HD to another similar TP, installed Win7 on it, but *never* connected to the internet either. The BIOS does NOT show the Computrace message, and rpcnet does not appear. Is it simply because it never connected, but it will activate when it will connect? I find that odd that the BIOS would not already show the warning.)

[RealBlackStuff]

If your Thinkpad is an R52/T43/X41 or newer, then it will have Computrace (CT), whether active or not.
If in the BIOS the CT has been set to Permanently Disabled, then there is nothing to worry about.

For a HD with CT to affect another laptop, read this: https://forum.thinkpads.com/viewtopic.php?t=121913
That should answer both your questions.

And if you never connect it to the internet, you have also nothing to worry about.

[n2ri]

I dont think the HDD was the issue or had any thing to do with CT. since BIOS had no warning. It may be just the setting for SATA can work with Unbutu OS but not WIndows on my other HDD. I still have to try that but HDD is in ultra bay on my Dock now for files transfer to my W500 TPs. will update when I test that.

[ztof]

I bought a T430 with Computrace activated. So I've read this post carefully (and many other writings about Computrace) and I've decided to call them.

They first said "bla bla bla you should look forward to your computer manufacturer..." then I told that my computer is a Thinkpad and I can disable it by myself only if they do remove it through their remote agent. Then It was told to contact them by mail and to give them the serial of both machine and system board.

I received this mail :

The device has had the absolute agent uninstalled by an Unenroll Device request however the persistence module interface status will remain as "Activate" because the removal process is unable to change the setting to "Deactivate", the persistence agent will however be switched off. Similarly, if set to "Disable" it will not be possible to ever activate the BIOS persistence feature.

This device has not called in to our servers since 01/03/2018.

I guess the previous user has somehow blocked Computrace agent process on Windows, and by the way he prevented the proper removal.

So I replied by mail that I don't know what kind of mess the previous owner did on his system, and that I'll do a fresh installation of Win7 and plug this laptop back online.

So then I installed a good old Win7 (because yeah my laptop is from 2013, the BIOS version also... and so is the Computrace agent. So prefer Win7 to ensure proper smooth removal), added the Intel Ethernet driver, plug the laptop to the network and watched the process manager. rcpnet did its stuff and came, next reboot it disappeared, next reboot it was back and took twice memory usage as first time then disappeared... Rebooted the laptop one more time and no more Computrace warning and the option to disable Computrace permanently was available... so I did permanently.

It took me 1h30 to get Computrace removed from my machine, and the main part of this time was to install Windows from an old win7 x86 ISO on a slow USB key to a spare 5400rpm HDD from 2008 located in the ultrabay caddy.

The best way to get rid of Computrace is to call them.

[skx]

Interesting topic, I honestly didn't know what Computrace was about and left the bios on disabled. Today I permanently disabled Computrace on my 4 Thinkpads Does anyone have an idea if this Computrace service was/is heavily used by companies?

[twsavant]

Just completed a call to Computrace to deactivate the service on a laptop I own. Very easy phone call, request a ticket# for follow up. The service rep welcomed questions I had about the service. Typically expect 2-3 days for the original owner to drop the device from their account. Worst case scenario is the original owner doesn't respond for weeks or months. I'll post again and let you know how long it takes for my laptop.This automatically deactivates Computrace on your system in 1-2 reboots. When this happens, go to your BIOS. You can know click on Computrace and "ACTIVATE" will no longer be greyed out so now you can deactivate it in your BIOS. Done. If you have issues, just follow up with a call to Computrace and refer to your ticket#. My advice: if you want to buy a used laptop always check to make sure Computrace is not activated. If so, get the current owner to call Computrace and don't buy if this is not taken care of. Or just move on. I have bought just one like this and now will always check first before I buy. ALSO, disregard all the s/w patches, fixes, etc. that you see online, it's a waste of time! Call Computrace FIRST! The toll-free number is on their notice when you log in to the BIOS. The Rep did tell me that calls like I made average 40% of his workload.

[twsavant]

As a follow up to my first post where I called Computrace,their service was deactivated in less than 24 hours. I went into the BIOS and permanently deactivated Computrace. Technical Support was outstanding with this company, a pleasant surprise since I have had nightmare calls with other companies. The Tech that took my call followed up my open ticket with a response once the original leaseholder verified that my laptop had been legitimately returned to the vendor. I cannot guarantee that you have the same experience, but I'd like to hear from anyone who does call and let me know what their experience is. Also, for those of you that read other forums, etc., pass along my results please, thanks!

[paulz1]

Got T450s from eBay, installed Linux and couple days later, after I opened a cover, entering BIOS on the very first boot after (and all times after, of course) shows Computrace message. Called the support, they asked for SN and confirmed that the anti-thief is disabled on their side. To get it disabled on my side - I need... to install Windows. The support person also said their software does not work on Linux at all, and therefore no agent application exists (even a utility to download) to disable Computrace in BIOS.

Wonder why did it appear after opening the cover and replacing DIMM module. Any thoughts?

[ajkula66]

Welcome to the forum!

To get it disabled on my side - I need... to install Windows. The support person also said their software does not work on Linux at all, and therefore no agent application exists (even a utility to download) to disable Computrace in BIOS.

Based on my very limited interaction with their supposed support group, I wouldn't trust anything that a Computrace employee tells me in regards to their lack of tracking.

There are ways to wipe this bug out completely but are out of the scope of discussion on this forum.

Good luck.

[RealBlackStuff]

Computrace also works with several Linux versions, but they just won't admit that.
I suggest you get a spare HD or SSD with a very basic W7 on it, doesn't even have to be activated/updated.
Run that, go online to a safe website, then call Absolute again and tell them (again) you want CT deactivated.
Leave that machine on with W7 during the night.
In the morning, reboot W7, switch off and put Linux back for the day.
In the evening put W7 in again, boot, go online and leave on overnight.
Check BIOS every once in a while if you can switch CT to "Permanently Disabled".
Once done, that's it.

Any other way for your model is rather complicated (AND expensive), and cannot be discussed here.

[paulz1]

Thank you for advice! Although I had some exp crunching BIOS, installing Windows for few days looks much more time effective. Will report back if/when get it solved.

[Edward Mendelson]

"Crunching" the BIOS by rewriting it and flashing it won't do anything - repeat, will NOT DO ANYTHING - to fix the CompuTrace issue. Only someone with specialized tools that physically modify the BIOS chip (not just flash it) can accomplish that.

Of course, calling CompuTrace and getting CompuTrace disabled for you is a lot easier.

[paulz1]

It was a nice second call to Absolute support, the representative gave me a ticket number this time and sent an email with the following text:

The agent has been removed from device XYZ, make sure that the device is connected to a wired network,
must have Windows O.S. installed, perform some reboots and please allow 24.5 hours in order to complete the whole process.

So 2 hours later I got "Permanently Disable" option available in BIOS and immediately applied it . Thank you for your help!

"Crunching" the BIOS by rewriting it and flashing it won't do anything - repeat, will NOT DO ANYTHING - to fix the CompuTrace issue. Only someone with specialized tools that physically modify the BIOS chip (not just flash it) can accomplish that.

From my understanding, if there is an option in BIOS, if the Computrace message is conditional, then it can be located somehow in the firmware and fixed. In theory, of course

[RealBlackStuff]

Congratz on that quick CT-problem solving!

To set things straight: Computrace is NOT (and never was) part of the BIOS.
The only 'links' to the BIOS are the settings: Enabled/Disabled/Permanently disabled.
The rest is stored in different chips, initially in the likes of 24RF08 or PC8394, lately in much more complicated chips like MEC1633L.
These chips go under a lot of different names, depending on who makes them.
How to access and treat those is beyond allowed discussion.