What to do if Computrace is activated in your TP BIOS

[Edward Mendelson]

If you find Computrace activated on your machine:

Some of us have bought ThinkPads that come with the Computrace anti-theft service activated. You'll know that Computrace is activated if a mesage about it pops up when you enter the BIOS. Also, in the BIOS, the Security/Anti-Theft settings will show Computrace enabled and activated - and the options to disable it or permanently disable it will be grayed out or inaccessible.

And - just to get this out of the way at the start - don't be deluded by the plentiful advice out there for removing Computrace. All that advice is the work of trolls, and you'll only waste your time by trying to follow it. Read on for the details. As you'll see from the replies in this thread, what it says in this post is absolutely correct.

How it got there and why you want to get rid of it:

What probably happened to your machine is this (or so I'm told by a Computrace tech support guy): the original leaser or owner had a Computrace contract on the machine; the lease expired; Computrace was supposed to be disabled in the machine, but something happened to prevent it from being disabled. That "something" could have including flashing the BIOS, or almost anything else.

You really don't want someone else's Computrace setup activated on your machine. It phones home every time it starts up, and the original owner can remotely brick the machine if it's reported stolen. It replaces a crucial Windows file (autochk.exe). Also, some security researchers report that Computrace is written in a way that gives hackers a potential back door into your machine. But I'm not an expert, and you don't need to believe me on this subject. Just read this:

https://securelist.com/analysis/publica ... revisited/

A phone call may be all you need to get rid of it:

If your machine is off-lease, and hasn't been stolen, it should be easy to get Computrace removed. All you need to do is call the number that pops up when you go into the BIOS. You'll reach a tech at Absolute Software. Tell him you bought a used machine with Computrace activated and that you want to have it removed.

The tech will ask for the machine serial number, and possibly the motherboard serial number. Make sure you get a case number from the tech, and have him send you an e-mail with the case number on it! If he doesn't volunteer to give you a case number, insist on one. (The tech I spoke to the first time I called didn't create a case number, and so nothing happened until I called back the next day and spoke to a different tech.)

Anyway, about twenty-four hours after you file the case report, when you turn on the machine and Computrace phones home (as it does every time you boot, when it's enabled and activated), Computrace will disable itself; the software it installed from the BIOS will be removed; and the original version of autochk.exe will be restored.

You can then go into the BIOS and set Computrace to be permanently disabled.

If you spoke to the tech I spoke to the first time I called, it's possible that nothing will happen. Call again and tell them the case number.

The alternative route, for established forum members only:

Alternatively, if you can't get Computrace removed by Absolute Software, you can get it removed by someone with the expertise and equipment required for removing passwords and otherwise working with ThinkPads at a deep hardware level. Regular forum members will know how to find such an expert.

A few further details:

A few details: If you look at the Windows event log, you can see Computrace at work. In the System log, you'll see the rpcnetp service start up shortly after boot, and then shut down again, presumably after it has phoned home and got the OK not to brick your machine.

Lenovo makes Computrace available as an optional add-on when you order all the current models I've looked at online. It's up to you to decide if you want it (you can read lots of arguments on the forum about whether it's worth having) but you almost certainly don't want to have your machine potentially bricked through someone else's Computrace account. (What I do with all my machines is enable the supervisor, startup, and hard disk passwords. I think it would be crazy not to do that if the machine has even the remotest chance of being stolen.)

What absolutely not to do:

Just ignore all the advice you find online about disabling Computrace on your own. The methods offered don't work, can't work, never worked - and you'll only waste time if you try them. No, you can't get rid of Computrace by flashing the BIOS. No, you can't get rid of it by deleting some files and replacing another file. No, you can't get rid of it by reinstalling Windows. No, you can't get rid of it by installing a new hard drive. Don't take my word for it; read the article linked above for the details.

EDIT: Also, ignore any advice that says you can disable Computrace by installing Linux. Computrace can't be blocked by Linux. See a later message in this thread for details.

The advice you'll see most often was posted by some moronic troll who explained that you can use read-only files to keep Computrace from loading. If you believe that the read-only file attribute is enough to stop software that's powerful enough to inject itself from the computer BIOS, then get in touch with me about buying a bridge that goes across the East River between Manhattan and Brooklyn.

I hope this is useful to anyone who buys an off-lease machine with Computrace activated.

[brchan]

There is also another way to stop computrace from working if it is already installed: use linux. Computrace does not work under linux, so that can also be an option.

[Edward Mendelson]

There is also another way to stop computrace from working if it is already installed: use linux. Computrace does not work under linux, so that can also be an option.

True, but I don't think I've ever met anyone who is likely to think, "Oh, my new machine has Computrace, so I won't use the dozen Windows applications I planned to use every day - I'll just switch to Linux." And even if someone does think that way, Computrace is still there waiting to bite the Windows user who may buy the machine at some future date, and who probably won't be happy when the Computrace software gets injected into Windows the first time he boots it up.

EDIT: Actually, not true. As RealBlackStuff reports in a message below (and as I didn't realize until I read that), Computrace works with many Linux variants and presumably with variants based on Ubuntu, Debian, etc. Possibly you can find one that's resistant to it, but you would need to find out how to identify which one it is. That may not be easy.

[Saucey]

Computrace still works with a clean install of Windows?
I sold a few TPs via eBay with them. I had a warning that they did have it however...

[RealBlackStuff]

Computrace can be "activated" on virtually all Thinkpads (and Ideapads, Essentials, Edges, etc. plus Thinkcentres) from T43/R52/X41 onwards, as well as on a slew of other brands.

@brchan: forgot to do your homework?
Computrace works not only under Windows (XP or newer), but also under several major Linux versions, Android and Mac OS X.
Details see here: http://www.absolute.com/en/products/abs ... quirements
And it doesn't care if you do fresh installs...

However, it is NOT invincible!

[Edward Mendelson]

Just to emphasize what RBS said:

Computrace is not stopped by a fresh install. It injects itself from the BIOS into the OS every time the machine starts up. It doesn't matter how often you put a new Windows system on the machine - Computrace will phone home the first time you boot up. It doesn't matter if you aren't connected to the internet when you boot. It will phone home as soon as you connect.

Read the article linked in the original post. It explains how it works. As the article explains, Computrace uses the same techniques used by the most persistent malware - but it's even worse, because it's in the BIOS.

But read RBS's post closely to see something that the Computrace people don't say about it.

[rumbero]

A nice analysis of the inner workings of Computrace can be found here: corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=Deactivate_the_Rootkit.

I wonder why nobody of our most gifted BIOS modders didn't have a go yet at the removal of this rather dangerous BIOS ingredient.

[Edward Mendelson]

I wonder why nobody of our most gifted BIOS modders didn't have a go yet at the removal of this rather dangerous BIOS ingredient.

Because the part of the BIOS that Computrace is in can't be affected by a mod. You'll see the details in the patent described in the article linked in the first post. The whole point of it is that it simply cannot be disabled via software. As RBS says, it isn't invincible, but you can absolutely not defeat it by flashing or doing anything else that you can do by running a program. People have been trying for years without success.

Again, please read the whole article linked in the first post. It really does answer these questions in a very complete way - and with a lot more direct knowledge than I can bring. (I'm simply repeating what it says in the article itself.)

[brchan]

@RBS. Thanks for the clarification. I should have checked if newer versions of computrace supported Linux. However, the older versions from October 2008 and older are not compatible with Linux (said by the CEO himself) : http://www.mguhlin.org/2008/10/computra ... sited.html. This would theoretically protect most T61 units and older (assuming the computrace version in BIOS can't be updated).

[Edward Mendelson]

(assuming the computrace version in BIOS can't be updated).

But it can be updated - and almost certainly was updated if the BIOS got flashed after 2008.

If you (or a previous owner) updated the BIOS, then you updated the Computrace part of the BIOS, and you can't get rid of it by flashing back to the old BIOS. It seems at least possible that the "critical" BIOS updates from Lenovo were "critical" in the sense that they updated the anti-theft features to work with Linux etc. The article linked in the first message makes it very clear that the Computrace code gets updated when you flash a new BIOS. That article really is worth reading.

Anyway, if you actually have a machine with Computrace activated, and it isn't stolen, it seems a lot simpler to call the number and get it disabled permanently. Even if the BIOS date is ancient, you have no way of knowing whether the BIOS was updated at some earlier time (putting in the new Computrace code) and then flashed with the older version (which leaves the new Computrace code unchanged).

[cyclops13]

So I got a used T440 off amazon and it came with Computrace enabled. I followed the suggestion on this thread and opened a ticket, however they are saying they are not able to get response from the account holder, its been 3 days now. I contacted the seller (mostly re-seller) is offering a refund if I ship it back. I like the laptop for the bargain price I got, dont really want to return it..

Anybody can offer help here? To prove I am no thief, I can send the receipt and ticket details from absolute/computrace.


Thanks! Stumbled across this forum due to this thread and registered, hope to stick around this awesome resourceful forum.

[Edward Mendelson]

Call the number again. After a while, they'll probably release the system, but you may need to talk to a couple of their techs. It typically took me two or three tries over the course of a week.

[cyclops13]

Call the number again. After a while, they'll probably release the system, but you may need to talk to a couple of their techs. It typically took me two or three tries over the course of a week.

Thanks for your consoling reply.

Today morning I got an email from them that they are closing the case as they have not heard back from the customer to release the laptop and advised me to return the system back to Amazon.

Considering this, should I call again and open another case? Wouldn't they review the history and deny opening another case?

[Edward Mendelson]

I don't know! I've never faced that situation, so I have no suggestions at all. In your shoes, I would return the laptop to the seller, but that's only my opinion - it shouldn't affect anyone else's decision! I certainly don't want the original buyer to be able to brick my machine at any moment.

[cyclops13]

I don't know! I've never faced that situation, so I have no suggestions at all. In your shoes, I would return the laptop to the seller, but that's only my opinion - it shouldn't affect anyone else's decision! I certainly don't want the original buyer to be able to brick my machine at any moment.

Thanks again for a prompt response.

As soon as I posted my earlier reply, I got a call from absolute that they got a response back from customer to release the system! So I should reboot the system a few times and it should be removed.. Cant wait to get home in the evening to try it out...

[Edward Mendelson]

That's great news! It might take a day or two before it finally clears out. Please let us know how prompt they are these days at freeing up the machine.

When you get the ability to control Computrace, I think it's best to choose the option to disable it permanently, along with any other similar options that may be in there.

[cyclops13]

That's great news! It might take a day or two before it finally clears out. Please let us know how prompt they are these days at freeing up the machine.

When you get the ability to control Computrace, I think it's best to choose the option to disable it permanently, along with any other similar options that may be in there.

Sure, I will try it tonight or over the weekend and report back. Cheers!

[dr_st]

So is a valid account with Absolute required to actually enable the Computrace BIOS module? Does it ask for a key or something?

[Edward Mendelson]

Never tried it. Does anyone know?

[cyclops13]

That's great news! It might take a day or two before it finally clears out. Please let us know how prompt they are these days at freeing up the machine.

When you get the ability to control Computrace, I think it's best to choose the option to disable it permanently, along with any other similar options that may be in there.

So I came home early today, tornado warning yeah!

Happy to report that the option to disable it permanently was now enabled! Disabled it in a second along with the other security chip option.

Now I am thinking of flashing the latest version of BIOS and a clean install of windows 8. Any simple guides?

Thanks again for creating this thread and sharing your knowledge!

[Edward Mendelson]

That was quick! No special advice on installing. Lenovo System Update should give you any new BIOS. I would go for Windows 7 or 10, not Windows 8, but that's only because I can't bear Windows 8. I don't have TP 440 myself, but Windows 7 is very speedy on a friend's 440. (PS: Probably the best thing you can do for the machine is replace the hard disk with a solid state drive.)

[thinkpadcollection]

Is this too late because I have a ebay purchased T60 motherboard had it's bios updated with computrace enabled? Just one more question is there any driver to finish the disable process after a call to computrace?

Cheers, thinkpadcollection

[Edward Mendelson]

Please read the first post in this thread, which answers your questions entirely.

[n2ri]

the OP link is dead

[Edward Mendelson]

I've now replaced the dead link with a good link to the same page. Thanks for catching this!

[RyanR]

I have a question or 3! I too am dealing with Computrace on a w510. Cheap ebay buy great machine. I notice when rpcnetp is doing its thing (usually a daily occurrence sometimes twice a day). I loose access to the internet for varied amounts of time. If i ping 8.8.8.8 or 8.8.4.4 The time is in the 2000ms plus or looses 3-4 of the packets. This lasts for 1 -2 minutes! I purchased this machine to replace a t60p for tech support I purchased recently. I loved the t60p but the Ram limitation was a killer. (I work on POS machines for restaurants remotely, I generally need 1-5 PDFs open with 5-10 browser tabs).
Anyway
I have contacted Absolute twice. The first tech said it is "on the list" to be removed. That was a week ago. Still no change so today I call them and speak with a guy and he takes the serial number and puts me on hold. Comes back and has me verify the Serial in a CMD prompt with a get bios serialnumber command. He seems stumped and tells me it is still active, and last time it phoned home was today. So the first tech (who gave me a case number) lied to me outright? I bet if it was his system he would want NO part of their software on HIS machine.
The New tech said he "did some things" on his end and what troubled me the most was he assured me he will "monitor my system from here". He began to explain the machine was once part of a "holding account" then said ohh I shouldn't go into that. I explained I believe the machine originally was sold as part of an education package and was sold off with a pallet of others just like it. He sort of agreed and told me it is 100% not stolen and should have been previously removed already!
I restarted my system 3 times within a few hours hoping for removal. I notice the rpcnetp service is being modified every reboot. On one reboot I got a blue screen of death, after the dump it booted normal.
I am left feeling the blue screen might have been caused my Computrace attempting to change the windows files.
For Cyclops or anyone else is there any settings I should set in bios or windows to help this process along.
Also As of now the options in the Computrace area of the Bios are greyed out. I read that on Cyclops machine after they removed it he gained control of this option and was able to disable it? If this is so I would like to know so I can PUSH them to make this happen!

Ryan

[cyclops13]

I have a question or 3! I too am dealing with Computrace on a w510. Cheap ebay buy great machine. I notice when rpcnetp is doing its thing (usually a daily occurrence sometimes twice a day). I loose access to the internet for varied amounts of time. If i ping 8.8.8.8 or 8.8.4.4 The time is in the 2000ms plus or looses 3-4 of the packets. This lasts for 1 -2 minutes! I purchased this machine to replace a t60p for tech support I purchased recently. I loved the t60p but the Ram limitation was a killer. (I work on POS machines for restaurants remotely, I generally need 1-5 PDFs open with 5-10 browser tabs).
Anyway
I have contacted Absolute twice. The first tech said it is "on the list" to be removed. That was a week ago. Still no change so today I call them and speak with a guy and he takes the serial number and puts me on hold. Comes back and has me verify the Serial in a CMD prompt with a get bios serialnumber command. He seems stumped and tells me it is still active, and last time it phoned home was today. So the first tech (who gave me a case number) lied to me outright? I bet if it was his system he would want NO part of their software on HIS machine.
The New tech said he "did some things" on his end and what troubled me the most was he assured me he will "monitor my system from here". He began to explain the machine was once part of a "holding account" then said ohh I shouldn't go into that. I explained I believe the machine originally was sold as part of an education package and was sold off with a pallet of others just like it. He sort of agreed and told me it is 100% not stolen and should have been previously removed already!
I restarted my system 3 times within a few hours hoping for removal. I notice the rpcnetp service is being modified every reboot. On one reboot I got a blue screen of death, after the dump it booted normal.
I am left feeling the blue screen might have been caused my Computrace attempting to change the windows files.
For Cyclops or anyone else is there any settings I should set in bios or windows to help this process along.
Also As of now the options in the Computrace area of the Bios are greyed out. I read that on Cyclops machine after they removed it he gained control of this option and was able to disable it? If this is so I would like to know so I can PUSH them to make this happen!

Ryan

Sorry I just saw your post and sorry I cant help much!

Yes, the Computrace options were disabled in the BIOS settings earlier. Once they confirmed the release, the BIOS options were enabled and I was able to permanently disable it. The computrace options still show up in BIOS but are disabled now, not sure if I can remove it completely.

I did not have to do any other settings change, all I did is start the machine, leave it one for some time connected to internet, then restart, enter BIOS and it worked.

Hope you are able to get it removed!

[RyanR]

w510 UPDATE

So after a little under a month I have gotten Absolute to remove their crap. It took a LOT of phone calls and emails, restarts etc... They blamed the trouble on my w510 being "old". After moving my case to the escalation team and agreeing to let them have my machine "call-in frequently" (like they needed my permission) after 24 hours of escalation and a few weird issues with audio/Video playback (they asked I leave the machine on and connected) (things would play then stop for 3-4 seconds and a ERRRRRRR sound would be present) after a restart I was able to disable it Permanently.

I wish I would have known to ask about Computrace status before buying my machine like recommended here, but glad it is removed. I almost feel like they bullsh!t you to try and get you to give up so they can keep their software running for future potential customers, or for spying but maybe I am just paranoid. Everyone I have spoke to claims how much of a pain they are to deal with and it seems they CAN remove it very easily if they decide to.

Bottom line if you have this issue and want it removed, do as above mentioned and just STAY on them. Call every 2 days, and stay patient!

[RealBlackStuff]

And to stay on the subject, today I "killed" Computrace on an X200s and it took me all of 4 minutes to get rid of it permanently...
YMMV.

[ajkula66]

And to stay on the subject, today I "killed" Computrace on an X200s and it took me all of 4 minutes to get rid of it permanently...
YMMV.

You would be the one to accomplish this...

Congrats!