Take a look at our
ThinkPads.com HOME PAGE
For those who might want to contribute to the blog, start here: Editors Alley Topic
Then contact Bill with a Private Message

What to do if Computrace is activated in your TP BIOS

General Questions, Rumors, Real news & More
Message
Author
Edward Mendelson
**SENIOR** Member
**SENIOR** Member
Posts: 892
Joined: Mon May 24, 2004 10:11 am

Re: What to do if Computrace is activated in your TP BIOS

#31 Post by Edward Mendelson » Sun Feb 07, 2016 12:01 pm

RealBlackStuff wrote:And to stay on the subject, today I "killed" Computrace on an X200s and it took me all of 4 minutes to get rid of it permanently...
YMMV.
Just to make (moderately) clear to anyone following this: You are a master of the obscure arts, and have spells and other magical equipment not available to ordinary mortals on this forum. Those of us who understand this therefore know whom to ask when there is nowhere else to turn.... ;-)

rkawakami
Admin
Admin
Posts: 10327
Joined: Sun Jun 04, 2006 1:26 am
Location: San Jose, CA 95120 USA
Contact:

Re: What to do if Computrace is activated in your TP BIOS

#32 Post by rkawakami » Sun Feb 07, 2016 3:39 pm

ajkula66 wrote:You would be the one to accomplish this... :bow:
Edward Mendelson wrote:Just to make (moderately) clear to anyone following this: You are a master of the obscure arts, and have spells and other magical equipment not available to ordinary mortals on this forum.
Hey! I helped guide him somewhat on that journey almost 8 years ago :) . Hmmm... I should be collecting royalties from that, huh? :lol: :wink:
Ray Kawakami
X22 X24 X31 X41 X41T X60 X60s X61 X61s X200 X200s X300 X301 Z60m Z61t Z61p 560 560Z 600 600E 600X T21 T22 T23 T41 T60p T410 T420 T520 W500 W520 R50 A21p A22p A31 A31p
NOTE: All links to PC-Doctor software hosted by me are dead. Files removed 8/28/12 by manufacturer's demand.

Edward Mendelson
**SENIOR** Member
**SENIOR** Member
Posts: 892
Joined: Mon May 24, 2004 10:11 am

Re: What to do if Computrace is activated in your TP BIOS

#33 Post by Edward Mendelson » Sun Feb 07, 2016 3:50 pm

rkawakami wrote:Hey! I helped guide him somewhat on that journey almost 8 years ago :) . Hmmm... I should be collecting royalties from that, huh? :lol: :wink:
Royalties?!?! :lol: It led me to spend money on ThinkPads that I'm about to start offering on the forum at very low prices because now I have more of them than I need... (But I'll PM you when I'm ready to spend some time on this, because I'll gladly send you one or two for the price of UPS shipping if you want them...)

rkawakami
Admin
Admin
Posts: 10327
Joined: Sun Jun 04, 2006 1:26 am
Location: San Jose, CA 95120 USA
Contact:

Re: What to do if Computrace is activated in your TP BIOS

#34 Post by rkawakami » Sun Feb 07, 2016 4:02 pm

Haven't looked at my .sig, huh? :) My wife will tell you that I absolutely don't need any more TPs, unless it's the kind that sits in a dispenser in the bathroom.
Ray Kawakami
X22 X24 X31 X41 X41T X60 X60s X61 X61s X200 X200s X300 X301 Z60m Z61t Z61p 560 560Z 600 600E 600X T21 T22 T23 T41 T60p T410 T420 T520 W500 W520 R50 A21p A22p A31 A31p
NOTE: All links to PC-Doctor software hosted by me are dead. Files removed 8/28/12 by manufacturer's demand.

Edward Mendelson
**SENIOR** Member
**SENIOR** Member
Posts: 892
Joined: Mon May 24, 2004 10:11 am

Re: What to do if Computrace is activated in your TP BIOS

#35 Post by Edward Mendelson » Sun Feb 07, 2016 4:32 pm

rkawakami wrote:Haven't looked at my .sig, huh? :) My wife will tell you that I absolutely don't need any more TPs, unless it's the kind that sits in a dispenser in the bathroom.
Hmm... That *is* an interesting sig. But I don't see an X201s on it... :wink:

Insulator_King
Posts: 18
Joined: Sat Jan 15, 2005 8:01 pm
Location: West Central Mountains of New Mexico

Re: What to do if Computrace is activated in your TP BIOS

#36 Post by Insulator_King » Wed Mar 23, 2016 10:40 pm

Very in-depth paper from blackhat.
https://www.blackhat.com/presentations/ ... -PAPER.pdf

I don't understand it hardly at all, but the gist is that it makes laptops vulnerable.

jaspen-meyer
Senior Member
Senior Member
Posts: 837
Joined: Wed May 19, 2010 11:21 pm
Location: Pardubice, Czech Republic
Contact:

Re: What to do if Computrace is activated in your TP BIOS

#37 Post by jaspen-meyer » Thu Mar 24, 2016 3:37 am

Insulator_King wrote:Very in-depth paper from blackhat.
https://www.blackhat.com/presentations/ ... -PAPER.pdf

I don't understand it hardly at all, but the gist is that it makes laptops vulnerable.
The libreboot project aims to make 'free software' bios. They spell out several components which make one's laptop 'vulnerable':
https://libreboot.org/faq/#intel

One would assume there are lots and lots and lots of ways to compromise a computer system.
You'd likely need a phD in an obsecure corner of computer science in order to run an unhackable system.
T420 i7 3612QM seabios; T420 i7 3630QM; T400 Q9100 seabios; T61 P9600; T60 libreboot; x62; x60s libreboot, led; x24 xiphmont led

jm206
Posts: 1
Joined: Mon Apr 11, 2016 9:09 pm
Location: Seattle, WA USA

Re: What to do if Computrace is activated in your TP BIOS

#38 Post by jm206 » Mon Apr 11, 2016 9:21 pm

Just ran into this software on a couple of retired corporate T420 machines.

Before I discovered this I actually updated the BIOS to 1.48 from Feb or sometime this year, and also installed W10. Had a hell of a time trying to disable Computrace.

A quick call to Absolute and they actually tell me the company that used to own the laptops had deactivated the service and that Computrace should deactivate itself the next time it phones home. Obviously it was still active for me in the BIOS.

Apparently however, and this may be solely limited to my configuration, the latest T420 BIOS update actually did not bring W10 compatibility to the T420, and thus Computrace didn't try to install itself, but this also meant it could not phone home and deactivate. So I booted up a W7 install disc, wiped W10, installed W7, checked for rpcnetp, and sure enough it was there. I connected to the internet, rebooted once or twice, searched for rpcnetp again, and all but one of the results disappeared. Booting back into BIOS confirmed that Computrace had been deactivated.

So for anyone having trouble deactivating it and can't even find a trace of it in W10, it may just be that the software isn't compatible and was never installed on your system. Though it is worth the time to install a compatible OS so that it can deactivate itself. :D

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23810
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: What to do if Computrace is activated in your TP BIOS

#39 Post by RealBlackStuff » Tue Apr 12, 2016 4:36 am

Thanks for that info.
It'll only be a matter of time for Computrace to be usable under W10.
This probably only applies to older machines (up to and including T420/T520/X220/W520, possibly also xx30) from before W10 was introduced.
But that would require a modified BIOS version (from Lenovo), which would then probably modify the EEPROM.
However, it's not all that difficult to throw Computrace out, even without the "help" of Absolute.
Lovely day for a Guinness! (The Real Black Stuff)
Lenovo: X240, X250, T440p, T480, M900 Tiny.

PS: the old Boardroom website is still available on the Wayback Machine
.

hhhd1
Senior Member
Senior Member
Posts: 500
Joined: Mon Nov 17, 2014 7:23 pm
Location: Cairo, Egypt

Re: What to do if Computrace is activated in your TP BIOS

#40 Post by hhhd1 » Thu Apr 14, 2016 10:57 am

RealBlackStuff wrote:Thanks for that info.
It'll only be a matter of time for Computrace to be usable under W10.
This probably only applies to older machines (up to and including T420/T520/X220/W520, possibly also xx30) from before W10 was introduced.
But that would require a modified BIOS version (from Lenovo), which would then probably modify the EEPROM.
However, it's not all that difficult to throw Computrace out, even without the "help" of Absolute.
http://support.lenovo.com/uu/en/downloads/ds029188

x230 bios, released on 3/29/2016 (2 weeks ago)

and contains:
(New) Updated the Computrace module to 945_VN.
===

dwilsonfl
Senior Member
Senior Member
Posts: 648
Joined: Thu Feb 16, 2006 1:29 am
Location: Valparaiso, FL
Contact:

Re: What to do if Computrace is activated in your TP BIOS

#41 Post by dwilsonfl » Sat Oct 22, 2016 12:08 pm

Still dealing with this on some old TPs.

Just one hopefully clarifying question for me.

Does the Computrace go with a hard drive removed from a system that has it enabled?

In other words, if I remove the hard drive from a system with it enabled, and place it in another TP, does that TP then enable the "service" on that laptop?

Thanks,

David
Vocavit autem servirent

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23810
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: What to do if Computrace is activated in your TP BIOS

#42 Post by RealBlackStuff » Sat Oct 22, 2016 2:12 pm

Lovely day for a Guinness! (The Real Black Stuff)
Lenovo: X240, X250, T440p, T480, M900 Tiny.

PS: the old Boardroom website is still available on the Wayback Machine
.

dwilsonfl
Senior Member
Senior Member
Posts: 648
Joined: Thu Feb 16, 2006 1:29 am
Location: Valparaiso, FL
Contact:

Re: What to do if Computrace is activated in your TP BIOS

#43 Post by dwilsonfl » Sat Oct 22, 2016 2:49 pm

Thanks.

So then Computrace is really malware.

My problem is I have so many TPs and have swapped HDs so often I don't know where to start with getting rid of it. Based on what the other thread says there should then be a way to eliminate it from a hard drive like any other boot virus.

Otherwise I may wind up taking a hammer to a few laptops. This is incredibly aggravating.
Vocavit autem servirent

Nebel
Posts: 3
Joined: Thu Dec 01, 2016 12:43 pm
Location: Kiev, UA

Re: What to do if Computrace is activated in your TP BIOS

#44 Post by Nebel » Thu Dec 01, 2016 12:59 pm

Hi everybody!

I've bought a post-leasing ThinkPad T400, which had Computrace activated in its BIOS, Unfortunately, I didn't know about this... thing. At first it injected rcpnetp.exe process, and that was all its' activity.

Then I contacted Absolute software, and their agent sent me an email, which said "I've confirmed that DDS (formerly Computrace) is no longer active on the device". Nothing changed at all. After a bunch of emails, they sent me Computrace.msi, asking to install it, hold PC online and then restart a number of times.

After installing it, rpcnetp.net disappeared, replaced by rpcnet.exe, and two new processes appeared, rpcld.exe and AbtSvcHost_.exe. rpcnet.exe began to start Firefox.exe and hold it for some time online.
A few more emails later, the support said that they had deactivated the software on their side.

I connected the notebook to the Internet and then rebooted several times. The rpcld.exe and AbtSvcHost_.exe processes disappeared, but rpcnetp.exe appears, starts iexplore.exe, then starts a bunch of other processes, then starts rpcnet.exe, which starts firefox.exe, then taskkill.exe, cmd.exe, agremove.exe and so on.
That activity takes place after every system boot. The support keeps saying that the cannot do anything, because the BIOS setting is one-time only.

I'm a bit desperate already. Should I get rid of the notebook and replace it, or something can be done with the [...] thing?

Maybe changing OS, installing or deleting some drivers may somehow help this thing to deactivate itself? The notebook is now running Win7 64-bit.

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23810
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: What to do if Computrace is activated in your TP BIOS

#45 Post by RealBlackStuff » Thu Dec 01, 2016 2:57 pm

Check your Private messages at the top of this Page.

nivlac
Posts: 1
Joined: Fri Dec 02, 2016 11:43 pm
Location: Jarrettsville, Maryland

Re: What to do if Computrace is activated in your TP BIOS

#46 Post by nivlac » Fri Dec 02, 2016 11:51 pm

RealBlackStuff wrote:Check your Private messages at the top of this Page.
Hi, I've read through this post and a lot of other posts regarding this Computrace stuff. It's activated on a Thinkpad T420 that I recently bought and I'm also getting the idunnolol from Absolute. I was about to start flashing bios', but then I came across this thread that says that's a waste of time. I dunno how to permanently remove this thing if none of the other 'tricks' actually work. What do I need to do to be rid of this nuisance?
Thanks in advance for any assistance.

dwilsonfl
Senior Member
Senior Member
Posts: 648
Joined: Thu Feb 16, 2006 1:29 am
Location: Valparaiso, FL
Contact:

Re: What to do if Computrace is activated in your TP BIOS

#47 Post by dwilsonfl » Sat Dec 03, 2016 12:54 pm

It makes me want to toss them all. Super aggravating. I teach 3rd grade and we rely on our laptops every day. I don't have time to play footsie with Absolute software over computers which at their newest were made in 2005.
Vocavit autem servirent

Nebel
Posts: 3
Joined: Thu Dec 01, 2016 12:43 pm
Location: Kiev, UA

Re: What to do if Computrace is activated in your TP BIOS

#48 Post by Nebel » Mon Dec 05, 2016 1:49 pm

Just to be sure... Do these settings - Image - mean that Computrace is OFF on the notebook? (This isn't the T400 from the previous post, to be fully clear)

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23810
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: What to do if Computrace is activated in your TP BIOS

#49 Post by RealBlackStuff » Mon Dec 05, 2016 2:05 pm

You must IMMEDIATELY set it to PERMANENTLY DISABLED.
You'll also need to clean up your hard disk by either reinstalling from scratch, if you don't mind, or
go here: https://securelist.com/analysis/publica ... revisited/
and here: https://bartblaze.blogspot.com/2014/11/ ... trace.html
and follow instructions found there.

Nebel
Posts: 3
Joined: Thu Dec 01, 2016 12:43 pm
Location: Kiev, UA

Re: What to do if Computrace is activated in your TP BIOS

#50 Post by Nebel » Mon Dec 05, 2016 2:35 pm

Reinstalling OS from scratch is planned, of course. I was just checking if that really means that Computrace isn't active. I worked with another Thinkpad, without any problems with that unholy thing, but its settings for Computrace were "Disabled - Not activated". So I decided to check if that's safe - to get a pc with "Enabled-Not activated".

TPFanatic
Senior ThinkPadder
Senior ThinkPadder
Posts: 2213
Joined: Thu Jul 30, 2015 11:29 pm
Location: Boston, Massachusetts

Re: What to do if Computrace is activated in your TP BIOS

#51 Post by TPFanatic » Mon Dec 05, 2016 5:16 pm

My t500 was also set to Enabled - Not Activated.
Now it is Disabled - Not Activated.

Now I will save energy since power is not going to the Computrace chip?

T3f4l
Posts: 44
Joined: Sat Dec 31, 2016 10:06 am
Location: Exeter, UK

Re: What to do if Computrace is activated in your TP BIOS

#52 Post by T3f4l » Sat Jan 28, 2017 5:13 pm

Has anyone managed to chop it out of the bios? Or manually change the value from activated to someone else by editing a rom read directly from the bios chip?
X220, 2.8 i7, 16gb 1866mhz, 512gb Samsung msata boot and 480gb Sandisk ssd storage
T22, 1ghz PIII, 512mb PC100 Ram, 128gb ssd boot and 320gb Weston Digital Storage
T21, ???ghz PIII, ???mb PC100 Ram, Its a parts donor that may see life again!

dwilsonfl
Senior Member
Senior Member
Posts: 648
Joined: Thu Feb 16, 2006 1:29 am
Location: Valparaiso, FL
Contact:

Re: What to do if Computrace is activated in your TP BIOS

#53 Post by dwilsonfl » Mon Jan 30, 2017 9:08 pm

I would love to kill this crap.
Vocavit autem servirent

darknight18
Posts: 1
Joined: Tue Jan 31, 2017 11:46 am
Location: richmond, virginia

Re: What to do if Computrace is activated in your TP BIOS

#54 Post by darknight18 » Tue Jan 31, 2017 11:51 am

My Thinkpad t540p was activated computrace. I contacted them and they said they disable it and told me to contact the manufacture to reset the bios. My question is how do i know that it is disable because they look like a shady company. If anyone can give me some tips to check it out if it is true that the device is disable.

T3f4l
Posts: 44
Joined: Sat Dec 31, 2016 10:06 am
Location: Exeter, UK

Re: What to do if Computrace is activated in your TP BIOS

#55 Post by T3f4l » Tue Jan 31, 2017 1:20 pm

With mine I contacted them, booted into Windows to allow the laptop to "Call Home". I then restarted into the Bios, went to the security tab and opened the Computrace section, I then set it to Disabled in that screen. It will only let you do that IF they really have disabled it remotely AND the laptop has been able to communicate with their servers
X220, 2.8 i7, 16gb 1866mhz, 512gb Samsung msata boot and 480gb Sandisk ssd storage
T22, 1ghz PIII, 512mb PC100 Ram, 128gb ssd boot and 320gb Weston Digital Storage
T21, ???ghz PIII, ???mb PC100 Ram, Its a parts donor that may see life again!

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23810
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: What to do if Computrace is activated in your TP BIOS

#56 Post by RealBlackStuff » Tue Jan 31, 2017 1:55 pm

To check if Computrace is active on your machine, check this out: http://forum.thinkpads.com/viewtopic.ph ... 79#p795179

If you find Computrace settings in your BIOS,
make sure to set them to PERMANENTLY DISABLED.

Any other setting will "phone home" and allow others full remote access to your laptop!

Contact Absolute to stop their evil business.
Lovely day for a Guinness! (The Real Black Stuff)
Lenovo: X240, X250, T440p, T480, M900 Tiny.

PS: the old Boardroom website is still available on the Wayback Machine
.

NASCAR_Biffle
Posts: 1
Joined: Sat May 13, 2017 5:50 pm
Location: Mishawaka, IN

Re: What to do if Computrace is activated in your TP BIOS

#57 Post by NASCAR_Biffle » Sat May 13, 2017 6:23 pm

Got my used Lenovo Laptop from Ebay Tuesday this week and discovered it had Computrace.
Best info I found is in the OP (Original Post) by Edward Mendelson. I did not read Edward's links but read his post and found it to be the best source of information to get Computrace removed.

The key is contacting Computrace and getting a case number if possible. Please note per Computrace once the Admin has set your device to deactivate you need to leave your laptop connected to the internet for 24 hours and do several reboots. I called them at 2:30 AM EST and got a hold of someone right away on the first call. Same thing happen on the second call at 1PM EST.

Below is other useful info but not has useful as the OP.

1. Below link shows you how to tell if Computrace is active by Vitaly Kamluk of Kaspersky
Also note Computrace works on Linux.
https://securelist.com/analysis/publica ... isited/#17

2. Below link may give some exrta info on Computrace from blogspot website.
https://bartblaze.blogspot.com/2014/11/ ... trace.html

Some Youtube Videos on Computrace.
1. Youtube video titled "Computrace Backdoor Revisited" by Vitaly Kamluk (From kaspersky) 1HR Video
Learn fun facts how Computrace is white listed by popular security software.
https://www.youtube.com/watch?v=AKmNf-JmjKQ

2. Youtube video titled "How To Remove LoJack" by User Frog Master
This video is what I believe does not work according to the Original Post by Edward Mendelson
I think this is the read only trick.
https://www.youtube.com/watch?v=Z5WifO_7s7k

3. Youtube video titled "Computrace removal Lenovo X201"
I do not believe it will only take an half an hour. It just shows how it looks like to really deactivate Computrace in the BIOS.
https://www.youtube.com/watch?v=AqmgiQfjKMg

As for RealBlackStuff, yes make sure to set them to PERMANENTLY DSABLED.

t-bills
Posts: 2
Joined: Tue May 16, 2017 1:19 pm
Location: NY, NY

Re: What to do if Computrace is activated in your TP BIOS

#58 Post by t-bills » Tue May 16, 2017 1:22 pm

1. Below link shows you how to tell if Computrace is active by Vitaly Kamluk of Kaspersky
Also note Computrace works on Linux.
Just curious - where does it say that it works on Linux? Linux isn't listed as one of the accepted requirements:

https://www.absolute.com/en/products/dds/requirements

RealBlackStuff
Admin Emeritus
Admin Emeritus
Posts: 23810
Joined: Mon Sep 18, 2006 5:17 am
Location: Loch Garman, Éire

Re: What to do if Computrace is activated in your TP BIOS

#59 Post by RealBlackStuff » Tue May 16, 2017 3:15 pm


t-bills
Posts: 2
Joined: Tue May 16, 2017 1:19 pm
Location: NY, NY

Re: What to do if Computrace is activated in your TP BIOS

#60 Post by t-bills » Tue May 16, 2017 4:23 pm

Thanks for the quick response! However the sources he/she cited were 1. the Absolute page that I linked to in my previous comment, and 2. The only mention that is likely to mention Linux in the Securelist article is:

"The first natural reaction of PC owners was to remove or disable this feature as soon as possible. One user decided to completely stop using Windows on his PC due to Absolute Computrace functions. That created certain difficulties for us in post-mortem analysis, but we managed to collect enough information to find the key timestamps of Computrace Agent activity."

Personally I don't mind using a laptop with Computrace activated as long as nobody can negatively affect its functions, but the thought that someone can remotely take screen shots of your laptop is pretty scary.

Post Reply
  • Similar Topics
    Replies
    Views
    Last post

Return to “GENERAL ThinkPad News/Comments & Questions”

Who is online

Users browsing this forum: No registered users and 28 guests