What to do if Computrace is activated in your TP BIOS

[cadillacmike68]

On a more serious note:
The T530 i ordered just arrived.

The FIRST THING I did was to go into the BIOS and "Permanently Disable" the computrace setting. This will be the first thing I do on all new to me machines going forward.

However, I also noticed something called Intel AT (for Anti Theft) Module. It is similar to compucrap in that is in the ROM option (EEPROM) chip in the system board. And it is capable (from my limited research) of being JUST AS NASTY as the compucrap stuff, i.e., downloads an agent, checks on a server, and if it gets a case of cranial rectal inversion it will lockup your system. It even shows you a countdown to de-activation timer.

Further they were partnered with notron and McAfee, but they pulled the plug with norton, leaving pc owners in an SOL situation if it was ever "activated", because now there's no way to "de-activate" it from norton. Not sure of McAfee, but norton users were screwed.

So I'm permanently disabling this one as well.

I can see how the big companies may want this, etc, but they should be responsible and thoroughly de-activate the thing when they sell or off-lease their machines.

For us small business and individual professional (and not so much pro) types, if you want to protect your machine, enable all the BIOS & HDD passwords and remember them, whenever you travel, or if the machine is at risk of theft. If it does get stolen, nobody else can use it which is just as much protection as compucrap could ever do without the hassles.

[skx]

For us small business and individual professional (and not so much pro) types, if you want to protect your machine, enable all the BIOS & HDD passwords and remember them, whenever you travel, or if the machine is at risk of theft. If it does get stolen, nobody else can use it which is just as much protection as compucrap could ever do without the hassles.

well, resetting supervisor password is like a 5min job on thinkpads upto xx30 series. better advice would be, encrypt your hard drives which should already have become SOP in 2020

[cadillacmike68]

For us small business and individual professional (and not so much pro) types, if you want to protect your machine, enable all the BIOS & HDD passwords and remember them, whenever you travel, or if the machine is at risk of theft. If it does get stolen, nobody else can use it which is just as much protection as compucrap could ever do without the hassles.

well, resetting supervisor password is like a 5min job on thinkpads upto xx30 series. better advice would be, encrypt your hard drives which should already have become SOP in 2020

Only if you are one of the VERY FEW who know what they are doing. The causal laptop thief will have no idea how to do this.

[lenadunz]

Hello Everyone,
I, too, have bought a used Lenovo laptop with Computrace and ATM a couple of weeks ago.
I have set Computrace and ATM in permanently disabled, updated the BIOS firmware to n22uj22P version.
I don't see any of them in the BIOS settings anymore, or the rpcnet services under Windows 10 task manager, nor in System32 and SysWOW64.

Please, forgive my "paranoia" and I hope you won't laugh (too much) but is it safe now to use my google accounts to login to this laptop, or use my webcam
without the fear that Computrace or anyone else can have access to my laptop or take screenshots or photos?

Many thanks for your replies,
Lena

[dr_st]

Hi Lena and welcome to the forum,

I believe you have nothing to worry about. If it's "Permanently Disabled", then it's not there and cannot be activated ever again, neither intentionally, not accidentally.

[bgravato]

I got an used motherboard for a Thinkpad X230 on ebay which had computrace enabled and activated. Enabled was greyed out and I could not disable it.
I had no disk on it, but the plan was to run only Linux on it.
Before putting a disk on it I run some live linux distro from USB pen with no issues apart from the annoying message about computrace being active, which I was trying to get rid of...

Google got me here... After reading this thread I decided to put some old disk on it and install Windows 10.
Rebooted a couple of times and miraculously the CT message is now gone and I was able to disable CT on the BIOS.
I didn't have to call any number or anything... it was just a matter of installing windows 10, rebooting and it was gone...

So if you're using Linux only and annoyed by this CT warning, before calling any number, try simply installing windows on it, reboot a few times and see if it goes away...


Cheers

[Edward Mendelson]

Probably what happened was that the machine's serial number was deactivated by its previous owner. But the only way the machine can phone home and learn that it's been deactivated seems to be through Windows. It wasn't Windows that removed it - it was the fact that the BIOS was able to phone home through Windows and learn that the machine was no longer registered with CompuTrace.

But, as you say, anyone who buys a CompuTrace-enabled machine should at least try this. It won't do any good if the machine hasn't been unlisted by the previous owner.

[appwizcpl]

To check if Computrace is active on your machine, check this out: http://forum.thinkpads.com/viewtopic.ph ... 79#p795179

If you find Computrace settings in your BIOS,
make sure to set them to PERMANENTLY DISABLED.
Any other setting will "phone home" and allow others full remote access to your laptop!

Contact Absolute to stop their evil business.

@RealBlackStuff

I've been trying very hard to find info on the last bit, that it will phone home (and will give full remote access to others) even at the Disabled setting. Could you please provide me with source on where did you get the info for the above?

Thanks!

[RealBlackStuff]

Most links were published in earlier posts in this thread.
And if I would keep a copy of all the info I gathered over the years, I would need a data center!
Sorry, no can do.

[appwizcpl]

@RealBlackStuff

I've read every single link you've posted including both studies and inspected every reply in this thread, I sadly could not find any mention that Disabling is lesser than Permanently Disabling in terms of the service running on your machine.

Nearly every single post of yours about CT you mention to Permanently Disable instead. In the quoted post, you capsed and specifically pointed out that this is the only way for CT to stop working, so I assume that you could point me to something that suggests this is true as everything you linked has no mention of such. Maybe I am missing something, but like I said I tried really hard to find this information.

[cadillacmike68]

If you did not buy the machine new and only set computrace to disabled, there is the possibility that the original purchaser or lessee can activate it either intentionally or accidentally and then you are up schitts creek (with no paddle) as described all over this thread. Therefore set it to Permanently Disabled.

If you bought it NEW, then no one can activate except you, but since you have to PAY them to monitor it, unless you are a large corporate type, why bother? Again, unless you are going to actually PAY them then it is best to permanently disable it.

[skx]

I've been trying very hard to find info on the last bit, that it will phone home (and will give full remote access to others) even at the Disabled setting. Could you please provide me with source on where did you get the info for the above?

why do you need an article for this? computrace is business oriented service to allow stolen laptops to be remotely disabled. what does this tell you? there is a low sys calling home functionality active on your laptop controlled outside the user installed and controlled OS. if you want to read the more technical explanation:

https://www.blackhat.com/docs/us-14/mat ... isited.pdf

[cadillacmike68]

For those who didn't understan my earlier post here:
If you did not buy the machine new and only set computrace to disabled, there is the possibility that the original purchaser or lessee can activate it either intentionally or accidentally and then you are up schitts creek (with no paddle) as described all over this thread. Therefore set it to Permanently Disabled.

If you bought it NEW, then no one can activate except you, but since you have to PAY them to monitor it, unless you are a large corporate type, why bother? Again, unless you are going to actually PAY them then it is best to permanently disable it.


Simple. If you aren't going to PAY them to monitor your system, then PERMANENTLY DISABLE it.

[newbee123]

When you say Computrace is immune to BIOS flashing, you talk about flashing the bios with a software, right? Bc physically flashing the bios chip with an eeprom programmer should do the job.
I too have the luck of buying used hardware with computrace enabled on it, even after calling Absolue a week ago stating my problem and getting assured the hardware isn't registerd as stolen, nothing has happend yet.
Thought about trying it myself.

[RealBlackStuff]

No it doesn't.

[br1anstorm]

I happened across this lengthy thread by sheer chance (and I think I may need to read all 5 pages several times to understand all the complexities).

I just bought a used Thinkpad T430s from a well-established reseller on eBay. (Incidentally I was totally unaware even of the existence of Computrace, and happened across it by accident).

The laptop arrived with a 120GB SSD as its main/only disk drive, and Win10 installed, when the listed details said that it had a 240GB SSD. So I contacted the seller, who immediately sent out a 240GB SSD, again with Win10 installed, for me to swap in. Which was fine.... except that with the replacement drive inserted I could not get it to boot. I called the seller's tech support, who advised changing a couple of settings in BIOS. In fact it seems that the 120GB disk had been configured as UEFI/GPT, and the 240GB one was MBR/Legacy boot, so changing the startup settings in BIOS from UEFI to "both" enabled the system to boot up normally.

However.... when going into the BIOS I happened to see the popup window saying Computrace was installed. Curious, having never heard of it, I have since been researching, and came across this thread. Now I am seriously concerned.

I've just looked at the Security tab in the BIOS and, sure enough, Computrace is Enabled and Activated, and the option to enable/disable is greyed out.

I have no way of knowing - now - whether Computrace was already in the laptop before the swap-over of the SSDs, or whether it was introduced with the replacement 240GB SSD.

I'm in UK. The phone number for Absolute in the popup (which I didn't note down) is in the US. Is there any alternative way of contacting them (eg by email?) to get this unwelcome software disabled and removed? If not, I assume my only alternative is to return the computer to the seller and seek a refund (which may be simple, or may be a headache).

Any advice would be appreciated.....!

[skx]

Any advice would be appreciated.....!

I would try to send back the laptop to the 'reputable' ebay seller to avoid the hassle. In case you do want to have Absolute deactivating their computrace malware, you can try to reach out to these numbers or idle in their support chat:

https://www.absolute.com/customers/support/
https://www.absolute.com/customers/support/contact/

If the laptop was not reported as stolen, together with your ebay invoice, you should be able to have it deactivated. Good luck, never had to do this myself, please keep us updated!

PS: computrace activation is set on motherboard (not SSD or HDD), it is lowlevel machine backdoor independent of any installed OS

[RealBlackStuff]

Br1anstorm's problem was already solved here.

[skx]

Br1anstorm's problem was already solved here.

great, boring night, browsed the board while not being focused

[xevman]

I just want to say thanks to this thread, I was able to remove computrace from my t61 machine after many years of it being enabled. All I did was install Windows 7 SP1 (the appropriate operating system given the date of the middleton bios) connected it to the internet and let the machine run overnight. Sure enough when I woke up rpcnetp.exe was no longer running and when I went to the bios the Computrace splash screen had disappeared! Can't believe that's all it took!

[byte.size.life]

I too have the luck of buying used hardware with computrace enabled on it, even after calling Absolue a week ago stating my problem and getting assured the hardware isn't registerd as stolen, nothing has happend yet.

Have you been able to resolve the issue? I have the same problem, the used TP I bought has Computrace enabled (no BIOS password or any further locks tho). Called them multiple times, even got a case number. The guy on the hotline told me the machine isn't stolen, but belongs to an active account, and he has to ask the client to release it. Unfortunately the client does not respond to Absolute, and they also don't have a policy of automatically releasing hardware after a certain period of time. Not sure what to do at this point, they kinda keep my machine as hostage.

[RealBlackStuff]

Return the machine for a refund.
As an aside, which model Thinkpad is that?

[byte.size.life]

It's an X13 Gen2. Lovely machine btw, really like it.

[Module0815]

This thread seems to be one of the best places on the internet for Computrace info, so I made an account to share what I found. I bought a used motherboard off ebay for my Lenovo that while it had no passwords restricting config, did have Computrace active. I run Linux on this machine, and swapped out the motherboard after the old one failed.

My question was whether the Computrace firmware was able to place its agent onto the machine OS if the machine OS is Linux. It seems that there are Linux agents available, but the question is whether they can be installed from your firmware as is done on Windows. Here's what I found:

A follow-up from Kaspersky about Computrace
https://securelist.com/absolute-computr ... ons/58258/
says this:

5. Should non-Windows users worry about unauthorized activations of Computrace?
As of now, we are not aware of EFI Firmware or BIOS Optional ROMS that have executables for non-Windows platforms, which means that the agent code will not be installed on non-Windows partitions. For details on how the agent is installed from BIOS please see our full research paper.

On reddit, a user claims to have worked for the Computrace vendor, and clarifies that the firmware doesn't have the ability to place an agent onto a Linux system, and without that agent it can't phone home since it uses the OS's network stack to do that, rendering it inert. Link here:
https://www.reddit.com/r/thinkpad/comme ... ing_to_be/

It only calls home if you install Windows. The Bios code re-installs the agent into Windows.

If you install Linux it won't call home.

Source: Used to work for Absolute.

It will still 'phone home' even with Linux.

No it won't. It needs the Windows network stack to 'phone home.'

EDIT: There is a Linux agent and if you install it it will "phone home."

But if you disable the agent or reinstall Linux then the agent is gone and the Linux agent will not self-heal like the Windows agent will.

Absolute Software has a Linux Agent, in the same way they have a Mac agent. Once it is installed it runs in the OS and will phone home, report location, provide asset tracking & management data, installed software etc. However, like with the Mac agent, if you wipe the machine and reinstall Linux it will not "self-heal" back into the OS.

The only platform where that works is Windows.

Of course none of that is authoritative, it does point to the right question, which is "yes, there's a linux agent, but can it install itself from the firmware?"

The vendor of Computrace is Absolute software. Their current name for the feature of reinstalling the agent from firmware in their marketing materials is called "Absolute Persistence".
https://www.absolute.com/resources/faq/ ... rsistence/
None of their marketing materials that I've seen explicitly specify whether this works on Linux, but what I've found suggests it doesn't. Take a look at the features listed for their current products at this link:
https://www.absolute.com/platform/compa ... -products/
Scroll to "Remotely Freeze Devices" > "Freeze a device via the firmware for an extra layer of protection" expand it, and note the "OS Support: Windows". Scroll further to "Absolute Platform Components" > "Absolute Persistence", expand the drop down and note the "OS Support: Windows".

You can also look at their product feature list for Absolute Resilience for Chromebooks (an OS built off the linux kernel) here:
https://www.absolute.com/platform/absol ... romebooks/
Scroll to "Absolute Platform Components" and note that Absolute Persistence is missing across the board.

All of this points to the idea that the reddit user is telling the truth and that Computrace enabled firmware doesn't have the capability to itself install the agent onto a non-Windows machine. And if you check the URL of the Absolute Persistence documentation, none of the remote control/access features work without the OS agent installed. From the Absolute Persistence doc:

If a device has the Persistence module embedded into the firmware, is it already protected?
No. Even though the Persistence module is built into the device, it still requires activation by installing the Absolute agent.
Once installed, the first call from the software agent to the Absolute Monitoring Center will detect and enable the Persistence
module. Once enabled, the self-healing feature of the Persistence module in the device will initiate the reinstallation of the
software agent if it is removed.

None of this is a guarantee, but Computrace would appear to be DOA if you're running Linux that has not had the agent installed via some means other than the firmware. It's on the motherboard, yes, but it doesn't seem to be able to install the OS agent via that route alone, and without the OS agent, none of its advertised features work. It also doesn't seem likely that a software vendor would hide a potentially lucrative capability from customers who want to secure their Linux machines.

[darbie348]

@RBS You wrote in several posts that computrace works on at least some linux variants. Have you personally experienced this? Does it work similarly to the windows version by writing to disks? Filenames or processes to look for?

[RealBlackStuff]

I only ever work(ed) with machines in which I can remove the BIOS password and/or Computrace (or don't have them).
The Windows Computrace files have been named and shamed.
No idea what the Linux Computrace files might be.
But check this.