How to remove Computrace Lojack

= =

How to remove Computrace Lojack

= = =

I bought two new Gateway PC's a f= ew weeks ago. Typically I first uninstall all the bloatware/trialware r= ight away. Then I shut down all unecessary services and remove loads of= entries in the registry that are starting unwanted programs. When I wa= s done with all of this, one process remained in task manager that I did= n't recognize. rpcnet.exe. Now I know that there is a service called = Remote Procedure Call so I looked in the services. It listed Remote Pro= cedure Call as "C:\WINDOWS\system32\svchost -k rpcss" and also Remote Pr= ocedure Call (rpcnet.exe) by computrace. Figuring this was more bloatwa= re so I disabled it and rebooted. It was back! I started thinking it w= as a virus/trojan/spyware. I downloaded hijackthis which let me shut it= off. Reboot. It's back! Found the files rpcnet.exe, rpcnetp.exe rpcn= et.dll rpcnetp.dll and deleted them and rebooted. It's back! Those fil= es are back too! Now it really looks like a virus. So I google computr= ace and found out it is some program used to track stolen computers. St= range! I didn't order that on my computer. So I set out to remove it. = Many google hits indicated it lived in the mbr so I did a series of fdi= sk's and fdisk /mbr and reinstalls of Windows XP. Rpcnet.exe came back = running every time. Some Google hits also indicate that it may live in = the bios. I save a copy of my bios to disk and look at it with cbrom. = I got cbrom from http://www.biosmods.com/download.php I had to try sev= eral different versions till I found one that worked with my computer/bi= os.

So I ran...
cbrom32_149 gtgn105.bin /D - (cbrom crashed but still showed all the f= ile names.)

Then I look at all files with hex editor, specifically for something = that would indicate computrace.

Found optromg.rom listed at OEM2 CODE. Hex editor showed the string= "computrace".

ran cbrom32_149 gtgn105.bin /oem2 release

checked with cbrom32_149 gtgn105.bin /D

Yep, optromg.rom is gone.

So upload new bios....

Reboot. kill rpcnet.exe

delete rpcnet.exe
delete rpcnetp.exe
delete rpcnet.dll
delete rpcnetp.dll

disable service rpcnet.exe

done

Rpcnet.exe is no longer running as a process! Yeah!

(BTW - This procedure has risks that include making your computer non= -functional)

UPDATE! I posted optromg.rom in case anyone wants to look at it with= a hex editor or try to disassemble it.

Attachment	Size
OPTROMG.ROM	24 KB

Comments

Sat, 2011-03-26 22:16 =E2=80=94 anonymou= s = = =

I bought a brand new Acer<= /h3>

I bought a brand new Acer laptop early this year. I never paid= for a subscription. I didn't even know I had their damned spyware inst= alled in my BIOS (or in whatever other piece of hardware it is). No one= informed me. I've never even been invited to subscribe. Yet my firewa= ll one fine day warned me that rpcnet.exe was trying to access the net. = I googled it, and that's the only reason I know what it is.
So when Absolute says their spyware "lies dormant" in your BIOS until ac= tivated, they're LYING.

AND DON'T BELIEVE THEM WHEN THEY SAY THEY HAVE DEACTIVATED IT.
Think about it:
1) They've already stolen from you. Computer manufacturers pay them for= this "enhancement" -- or at least somebody does. Obviously the cost get= s passed onto the consumer who buys the laptop. And you were never info= rmed it was there, so they MADE you buy it without your consent. That's= fraud. Even if you weren't paying for it, they are giving you somethin= g dangerous to your right to privacy, and without your consent, or even = knowledge. That's criminal deception.
2) This stuff is installed in BIOS, and maybe even in the motherboard. = They can't uninstall anything unless they come to your house and do it m= anually. So obviously they're lying when they say they can. They just = want to get you off their back. They may actually deactivate it, but if= they can, then they can also reactivate it -- or maybe some hacker can.= The only assurance you have that they won't access your computer witho= ut your permission is their own word. How much is the word of a thief a= nd liar worth, hey?

This firmware/hardware trojan can do a HELL of a lot of things you do= n't want anyone but yourself to be able to do (that is, if you have any = common sense and knowledge of human nature). It can physically locate t= he comp by triangulation, monitor all your activities, erase all or part= of your hard disk to U.S. government security standards, and God knows = what else. Those things are only what the company ADMITS to on its own = website.

Which liars and thieves do you want to trust, the ones at Absolute or= the ones in the street?
Answer: Neither. But I'd feel a lot more comfortable if the thief in th= e street gets my comp. Chances are pretty good he won't be as computer = literate as the "friendly" professionals at Absolute Sukware.

I've already spent well over one entire working day trying to find a = reliable and permanent way to get their poison out of my system, and I'm= not nearly done yet. I'm faced with tampering with the BIOS or worse. = Time is money, and that's another way these bar stewards have ripped me= off. These people need to be sued right out of their scam business.
Check out these links, and get pissed, and keep making noise to these= axhole manufacturers who permit this stuff to be installed without your= consent:

From their website:
http://www.absolute.com/en/lojackforlaptops/technology.aspx The technolo= gy behind Absolute Software=E2=80=99s products is the Computrace Agent, = a small software client that is embedded into the BIOS firmware of most = computers at the factory. Or you can easily install yourself.
The Agent in your computer maintains daily contact with the Absolute Mon= itoring Center. If you report your computer stolen, Agent contact will i= ncrease to every 15 minutes. Increased contact allows us to obtain speci= fic details like the physical location of your computer, any activity th= at has occurred post-theft, and other important data that will aid us in= working with local law enforcement to catch the thief and return your p= roperty to you. Regardless of recovery status, you can remotely delete = data to remove some or all of the information stored on your computer. = It uses GPS or Wi-Fi to map your laptop=E2=80=99s current and past locat= ions.
[Any activity? Other important data? Remote delete? And past location= s? That=E2=80=99s pretty damned wide open!]

This http://www.absolute.com/en/partners/bios-compatibility.aspx list= s all manufactures that install it in the BIOS.

http://www.absolute.com/Shared/FAQs/L4L-FAQ-E.sflb.ashx says Flashin= g the BIOS will not remove it. Computrace works through firewalls. App= arently it does not work through dial-up, and the software must indeed b= e installed to get recovery services =E2=80=93 but of course all that me= ans is that you must pay if YOU want any advantage from the BIOS install= ation. Meanwhile THEY still have access to your computer through the BI= OS, if they want it, regardless =E2=80=93 though of course they won=E2=80= =99t tell you that). "(Upon theft notification) increased contact will a= llow the Absolute Theft Recovery Team to forensically mine your computer= using a variety of procedures including key captures, registry and file= scanning, geolocation, and other investigative techniques to determine = who has your computer and what they=E2=80=99re doing with it."

No one with more than two brains cells to rub together wants to give = this much power over their lives to ANYONE, and especially not to thieve= s, liars and sneaks like these people.

I will call Absolute, but it won't be to find out how to remove their= s***. I'm on my own on that since only a fool would believe a word the= y say about anything. I may end by returning my computer. Thought it m= ight be useful to some to know what I've done so far, after reading the = friendly tips posted here. Certainly Absolute Sukware is constantly upg= rading the "persistence" of this damm trojan, so how things are on a lat= er model with Win7 may be helpful.

I first of all tried F2 on startup and disabling it through Security,= as suggested by the entry above, Tue, 2009-08-04 22:25. That didn=E2=80= =99t work. There simply were no options available.
I then tried what was suggested in Mon, 2008-11-17 02:10. First of all = I noted that a standard search through the Start menu did not reveal the= files, even though I have the comp set to show hidden files. But a dir= ect search of C drive did find
rpcnet.dll
rpcnetp.dll
rpcnetp.exe/system 32
rpcnet.exe/syswow64
rpcnetp.exe/syswow64
When I tried to change permissions on these files (as administrator), th= e Deny could be selected, but the default Allow remained checked, althou= gh grayed out. Windows did give a dialog box on applying that said =E2=80= =9CDeny entries take precedence over Allow entries. A user that is a mem= ber of 2 groups, one allowed, one denied, will be denied.=E2=80=9D
= Permissions window for these files later showed System, Administrator an= d Users all both denied & allowed. Effective Permissions tab showed= all boxes empty, but grayed.
When I closed Properties for these files, boxes came up =E2=80=9CError=E2= =80=A6access denied=E2=80=9D. Rechecking Properties showed permissions = I had set were still in place, except that I had checked Read Only, and = this was now unchecked again. Apparently there=E2=80=99s no way to set = these files as Read Only.
When rechecking permissions for rpcnetp/sys32, additionally I found anot= her User that hadn=E2=80=99t been there before, called Authenticated Use= r. Very interesting. I set that to Deny as the others.
On reboot, rpcnet, rpcnetp and rpclocator show in Taskmanager, but as st= opped, whereas before they were always running. So far so good.
Searched also for the file called agremove, but did not find it, even un= der similar names: Agremove & remove.exe.
On another reboot, found in Task Manager something running called igfxpe= rs.exe, description: Persistence Module, and Services shows something ca= lled RpcSs (Remote Procedure Call), and RpcEptMapper (RPC Endpoint Mappe= r) running. Don=E2=80=99t know what these are, but they surely look sus= picious.

In any case, Event Viewer in Administrative Events shows that rpcnet.= exe and rpcnetp.exe failed to execute because =E2=80=9Caccess is denied=E2= =80=9D. Moreover, the time stamp shows this happening right at start up= , and not repeated later.
Event Viewer Windows Logs:
=E2=80=98Applications=E2=80=99 shows no events for RPC (it does show fr= iggin Google updater trying and failing to update every half hour =E2=80= =93 I recently uninstalled the Google toolbar)
Security shows nothing.
System, at startup, shows The RPC Endpoint Mapper service entered the ru= nning state. The Remote Procedure Call (RPC) service entered the running= state. Not good. These occurred before Avast anti-vi started, and som= etime later, the firewall starts. Immediately after firewall starts we = see: The Remote Procedure Call (RPC) Net service failed to start due to = the following error: Access is denied., and The rpcnetp service failed t= o start due to the following error: Access is denied. Sometime later, t= he WLAN (net access) was started, so it seems that Computrace is stymied= . By the time internet access is enabled, it=E2=80=99s already stopped,= so it can=E2=80=99t talk to the criminals at Absolute. Yes!
However, all this was from a startup where WLAN startup had been reset t= o manual. This meant that WLAN did not start on startup, and I had to s= tart it later manually. This is inconvenient, so I reset it to automati= c, and checked startup logs again. Results were same as before, with on= e critical difference:
System, at startup, shows The RPC Endpoint Mapper service entered the ru= nning state. The Remote Procedure Call (RPC) service entered the running= state. WLAN AutoConfig service has successfully started. These occurre= d BEFORE Avast anti-vi started, and sometime later, the firewall started= . Immediately after, we see again: The Remote Procedure Call (RPC) Net = service failed to start due to the following error: Access is denied., a= nd The rpcnetp service failed to start due to the following error: Acces= s is denied.
So, it seems possible that Computrace may have had enough time to commun= icate with the net, because it wasn=E2=80=99t stopped until after the WL= AN was up and running.
This means you have to set WLAN to manual in Services (right click>Pr= operties), and, after the computer has fully booted, manually start it i= n Services when you want to use wifi. Automatic start will result in at= least the possibility that Computrace will at least reveal your compute= r=E2=80=99s location. It probably won=E2=80=99t be able to do anything = else before being shutdown by the later denial of permission to run, but= even that=E2=80=99s not certain. I still don=E2=80=99t like those grey= ed out Allow checkmarks in permissions for Computrace=E2=80=99s files. Note: WLAN has RPC Endpoint Mapper listes as a dependency in Services>= ;Properties>Dependencies. I'm not even sure if the RPC Endpoint Mapp= er or the Remote Procedure Call (RPC) services are connected to Computra= ce's functionality or not.

Because of these doubts, I will eventually totally reinstall BIOS. A= nd I'll have to be sure it's a TOTAL reinstall, and that Computrace isn'= t living somewhere else on my hardware as well. If I can't be, I will d= emand a refund of the computer, plus payment for the time out of my life= that has been stolen from me.

Tue, 2010-12-14 00:00 =E2=80=94 donnasan= der = = =

Anony-you OBVIOUSLY don't

Anony-you OBVIOUSLY don't have enough techi skills to be playin= g around with it. It's clear from your question, so just leave it alone.= You'll break the damn thing.

Mon, 2010-11-15 13:17 =E2=80=94 musketba= ll = = =

All of you trying to disable

All of you trying to disable this thinking it is the software b= y itself are idiots!

It's not just the software and you don't have to be on-line to be tra= ced with a stolen computer that contains LoJack.

If you steal a Car protected by LoJack do you think the car dials up = the Internet and then tells the owner where it is, of course it does not= .

USE YOUR BRAIN IF YOU HAVE ONE, ITS WHY GOD GAVE YOU IT!

If you try to disable a LoJack activated Bios you will Hose the compu= ter, meaning it will destroy itself for security reasons.

Mon, 2010-12-13 23:55 =E2=80=94 donnasan= der = = =

All these people stressing=

All these people stressing over LoJack that claim they are not = criminals with stolen laptops are doing so uselessly. "IF" the laptop is= not stolen, the service phones in ONCE day to do a test call, and that= 's it. Nothing else. It uses no resources, does not slow down your machi= ne, NOTHING! The only time it constantly calls in, is IF the machine has= been REPORTED Stolen!! Then it reports constantly yes. But it has to ac= tually be REPORTED STOLEN first! If no one reports the laptop stolen, it= doesn't do anything. So all the hype against computrace is just because= the criminals are upset they can't so easily beat it. I for one am glad= . And the service is not free. So if you didn't pay for anything, I guar= antee it's not doing anything. Just sitting there waiting to be activate= d after you pay for the service, unless you get a 6 mos free with a new = machine or something. Worth every penny I say.

Sun, 2011-03-27 09:33 =E2=80=94 anonymou= s = = =

Nothing personal, but you<= /h3>

Nothing personal, but you know nothing of human nature, and you= lack common sense.
How do you know "the service phones in once a day...unless the machine i= s reported stolen"?
Answer: Absolute Sukware told you.
Yet these same people sold you their trojan without even informing you. = That's fraud.
They say it "lies dormant" until activated with a subscription. That's = CERTAINLY a dammed lie, because my firewall caught it trying to access t= he net, and I didn't have a subscription. I didn't even know that Compu= trace existed until that happened.
These people themselves are criminals, but yet you want to trust their w= ord.
Go ahead.
But those with common sense don't have to follow your foolish example.

Mon, 2010-09-13 21:55 =E2=80=94 jemanyu<= /span> = = =

hi all I'm from chile and I<= /span>

hi all I'm from chile and I got a laptop or notebook HP EliteBo= ok 6930p and I can not enter the bios I get a message such a jak and I w= ill not let me use the mandaronp or parcel as I can clean the bio to sol= ve this problem or will I have to leave it idle help please

Tue, 2010-06-29 22:23 =E2=80=94 Col Alph= a Male = = =

I used the info in the last

I used the info in the last post. But I had to set to disabled = instead of automatic. I didn't have the stop option available. May be du= e to killing it fisrt with Sysinternals Process Explorer. XP Pro SP3 on = Dell XPS M1730. It works after reboot it's not running. I found this pro= blem when the program was using 50% of CPU time.

Wed, 2010-09-08 14:28 =E2=80=94 Southern= Comfort = = =

I dont know if any of these

I dont know if any of these is the program or not ?

rpcdiag
rpcepmap
rpchttp
rpcndfp
rpcns4
rpcnsh
rpcping
rpcrt4
rpcrtremote
rpcss
rpc

Sun, 2010-06-27 07:48 =E2=80=94 erasmios= = = =

I have a friend who just

I have a friend who just bought an HP mini 2133. How do we know= if the Computrace LoJack is activated or not? If it is, can anyone tell= me how to deactivate it, or how to get into the BIOS? Help Please!

Erasmios K

Sat, 2010-04-10 02:16 =E2=80=94 kopax = = =

I permit myself to post

I permit myself to post information about rpcnet.exe from Absol= ute Software Corp to ease information queries in Google.

I sent an email to Absolute Software Corp. (www.absolute.com) and ask= ed what is the process rpcnet.exe and procedures to remove it.
Here's the exchange I had with Chris Librel , working for Absolut Softwa= re Corp support .

From: Me to Absolut Software Corp
Sent: Friday, April 09, 2010 11:01
Subject: What is rpcnet.exe

Hi,

I have on my computer a spyware from your company called rpcnet.exe What is it exactly and how did it arrived on my laptop?
How can I uninstall it?

Cordially,

From: Absolut Software Corp to Me
Sent: Friday, April 09, 2010 14:47
Subject: Re : What is rpcnet.exe

Hi,

Rpcnet.exe deals with the Computrace asset tracking and asset recover= y software. Computrace may have been purchased with your machine and pr= e-installed at the factory. Please provide the serial number associated= with your machine.

If you did not purchase Computrace, please scan and email a copy of t= he receipt showing the purchase of the machine and we can then flag the = machine for removal to remove Computrace once we can confirm that you ar= e the owner of the machine.

Regards,

Chris Librel
Global Support | Absolute Software Corporation

From: Absolut Software Corp to Me
Sent: Saturday, April 10, 2010 13:43
Subject: Re : Re : What is rpcnet.exe

Hi, thanks for your answer :

> Computrace may have been purchased with your machine and
> pre-installed at the factory

After buying the computer (at first it was on Windows Vista), I forma= t and
install my own personal of Windows XP PRO, and install just the minimals= driver
with no add-on software and advertising software. So this might be impos= sible.

> Please provide the serial number associated with your machine. >
> If you did not purchase Computrace, please scan and email a copy of= the
> receipt showing the purchase of the machine and we can then flag th= e machine
> for removal to remove Computrace once we can confirm that you are t= he owner
> of the machine.

I don't know you, and I will not sent to you a scan of the receipt. Do you have the right to monitor my computer without my knowledge?
= I am sure you don't.
Do you have the right to refuse to help me to remove your spyware?
= I have not been warned that I will have spyware on my computer.

Please indicate me the procedure to remove rpcnet.exe without giving = you my
serial number, or any other personal information.
Otherwise I'll forward your message on the forums that talks about this = process,
and also transmit it to the authority in effect for the protection of co= nsumers.

Cordially,

I hope that I am not the only one to complain, and you know where to = contact them now, if you have the spyware rpcnet.exe to survey your comp= uter.

kopax

Sat, 2011-02-26 13:16 =E2=80=94 anoymous= = = =

i am not so concerned about

i am not so concerned about the computrace software being on la= ptops as i am about getting a computer with it already activated....the = laptop came from a computer repair and service store..

Sat, 2010-09-04 01:06 =E2=80=94 Kestrel7= 12 = = =

There's your problem. You

There's your problem. You just don't know what Compu-trace is = doing on your computer, and you're alarmed when you hear the words "com= puter" & "trace" used together, (or you're afraid you have a virus

1) Computrace is NOT Spyware, Malware, nor Adware.

2) Computrace is NOT self-installing, however it *is* possible that i= t comes with your computer as firmware - on one of the motherboard chips= , so that it naturally re-installs, regardless of the formatting & n= ew O/S install.

(I freely admit I don't know the policy of the company that manufactu= res that specific lojack, there could be an "added up-grade feature", l= ike chip-set on the motherboard, requested by the manufacturer & use= d as a bonus feature. )

3) Computrace is one of the lojack programs. When you log on the int= ernet, the Lojack "phones home", updates that it's still here by checkin= g in with the server, basically saying "Hi Ma, I'm at IP ADDRESS: 255.25= 5.255.200 (for example. I work for an ISP, I understand the whole "IP= Schema". Please don't try to school me.)

Pay attention, because this next part is the part that bother's you, = and it is important.

4) The ONLY TIME COMPUTRACE, or any other Lojack, would ever use mor= e than the minimum required effort & Clock tics worth of ATTENTION T= O YOUR COMPUTER, is when the software phones home, & it it fails the= interrogative handshake.

(Hi Mom, I'm at XXX.XXX.XXX.XXX.) The server goes through an interro= gative handshake, which looks Vaguely like this: IF THIS, Definition = +a True/False response; THEN (Action)=3D ELSE =3D Send an alert to= the operator queue for human intervention.

So, breaking it down for ya'all,

The Laptop checks-in initiates an interrogative handshake & UPDAT= ES STATUS to Server *PING* (This is who I am, Who I belong to, Where I a= m, And someone is using me.)

IF : (UPDATE OF STATUS) =3D CONDITION
* STATUS =3D I Am "Here"
* SERVER COMMAND =3D VERIFY EITHER T/F
LISTED AS LOST OR STOLEN =3D True or False CONDIT= ION
CONDITION: (Lost or Stolen) =3D
THEN : =3D IGNORE
ELSE: Condition =3D TRUE
THEN: TRIANGULATE LOCATION
AND: CONTACT AN OPERATOR with UPDATE ALERT:

"Hey, I've got a Lojack that failed Verification"
"Here's a window bullet items &/options"

[POP-UP WINDOW FOR OPERATOR]
"Hey, Bob Smith!
A COMPUTER LOJACK is CALLING HOME, AND CONDITION =3D TRUE
I highlighted which option you need to click.

A) Why is Lojack Server asking for Operator intervention= ?
B) Registered Equipment Info (Cell phone, Laptop, Car Kin= dle)
C) Registered Owner(s)/User(s) Info
D) Lojack Registry w/user account highlighted
1) Registry Is/ Current: T/F
2) Renew Registration
3) Recently Sold: New Owner/Change of Owner Form 4) Register New Users
5) Cancel Registered Account
6) Miscellaneous

E) Incident Report
1) Ticket number
2) Incident Date & Status

F) Police Report
1) Ticket number
2) Incident Date & Status
3) Police Report Number

G) Registered Customer Report
1) Registry Current: T/F
2) Renew Registry
3) Ticket/Action Number
4) Incident Date & Status

H) Registered User's Report
I) Miscellaneous information
J) Account Activity Log (updated by operator with status aft= er each operator/Client r consult)

5) Then, Police, or a detective, or SOMEONE will come around to pick = up the computer, & it's user. The computer goes into evidence, and = is soon returned to the owner, just like a lojacked car, after a hijacki= ng

Lojack is great, man. IF THEY CAN'T RECOVER your computer,THEY REPL= ACE YOUR COMPUTER! I'm buying it for 2 laptops I just bought. I just d= ropped $620.99 APIECE for them. I'm going to keep them within my person= al circle of influence, so I doubt they will get stolen. **BUT** If ei= ther of them DOES happen to get stolen, I'm counting on the Lojack Compa= ny to get the laptops back for me, or replacing them if they fail to rec= over them!

I was thinking about why it took up so much CPU. There are 2 reasons= that would take up 50% of your CPU.

One reason is that if you were fussing with the software I would bet = that it's supposed to call home, and hold the line, While it "flashes a = beacon saying, for all intent and purpose: "HELP! I've been kidnapped",= all while notifying local law enforcement to hunt it down. I don't kno= w, I wasn't there, & didn't see what it was doing, & I don't kno= w how long you were fussing with it. If I were Corporate I wouldn't tel= l anyone that was how my lojack system worked, & if *I* were doing t= he coding I guarantee you that my software would automatically assume th= at being it was being fussed with was an attempt to get around an automa= tic anti-theft mechanism by the thief, himself!!!

It might just call home and say "Help me Daddy, I've been kidnapped a= nd some fool is trying to take away my cell phone so I can't call for he= lp"

6) I'm glad to hear that the company didn't just give you the info y= ou asked for. They were well & perfectly within appropriate boundar= ies asking you to provide them with solid documentation that you IN FACT= own the machine. By denying to share harmless information cost you the= assistance you were asking for, and for hella good cause, AND you antag= onized them for no good reason.... Basically you stood there & sho= uted" F*CK YOU Lojack!" for the entire world to hear, then you come here= , pounding your chest, strutting like you're some kind of big bad boogy-= man, bad-ass, and brag about how you lost a fight with a potential ally,= and then shit on him. That company is the one that would have to repla= ce your laptop, if it was stolen and could not be recovered.

Now you've violated their warranty and completely fucked yourself bec= ause I'll bet that by damaging it and disabling it they are not any long= er constrained to recover OR replace your laptop if it's stolen.

Frankly, I'm NOT convinced you came by that laptop, as a new, out of = the box, computer that you took home to set up. I've been wrong, I cou= ld be wrong now, but refusing to provide that information tells me all I= need to know about your character.

7) By the way,

Computrace is a piece of STORE BOUGHT SOFTWARE, unless it is bundled = with your computer. That means THEY SELL IT!!! They aren't 't going to= go giving it away free to people like you. Tell me, did you have to wo= rk very hard to be this intelligent, or was it just an accident of birth= ?

It will not self install it on your machine for without a payment of = some kind, so, somewhere, some how, it got bought and paid for by someon= e who wanted their computer protected and traced when it got stolen. A = company like that expects to earn money writing that software, and they = sell it to people, who want to protect their computers, so that they can= earn money for stock-holders.

Where did you ever get the idea it was spyware? You see, if you had = BOUGHT the machine, you'd have known it was a value added feature, and n= ot come in here telling us what a Johnny Bad-ass you think you are, cuz = you called some tech support guy a Wanker, when he offered to help you, = and all he asked for was for you to confirm the serial number that THEY = ALREADY HAD ASSIGNED TO THAT COMPUTER, AND THEN THEY'D HAVE HAD YOU id Y= OURSELF WITH THE WARRANTY INFORMATION THAT WE ALL PROVIDE WHEN WE BUY AN= D PAY FOR A MACHINE.

Some people's children.

There isn't any kind of freedom, or privacy you give up. It's a harm= less verification call, made by either a hardware or software Lojack, to= verify that the person using it actually owns it. If you own it the se= rver and the company basically benignly ignores you UNTIL THE NEXT TIME = YOU TURN THE COMPUTER ON AND GO ONLINE. tHEN IT WILL RE-VERYFYING THAT= IT WASN'T STOLEN, AND GO BACK TO IGNORING YOU.

Sun, 2011-03-27 10:14 =E2=80=94 anonymou= s = = =

You, sir, sound like a

You, sir, sound like a policeman. Your tone is very similar to= that of another who posted here: arrogant and patronizing, with that Li= beral attitude that you know better than other people what is good for t= hem. It was disturbing to read on Absolute's website that many of their= employees are ex-law enforcement officers, for it goes to show that the= y are infected with a Hitlerian notion of morality: the end justifies th= e means, and if "authority" says it's good, then it is good, never mind = obvious reality.
Answer me this: If Absolute has already stolen my money by making me pay= for something I didn't even know existed, and stolen my time by making = me spend literally days trying to get rid of their stinking trojan, and = has told absolutely undoubtable lies about the capabilities or nature of= what this thing does, how are they any better than any thief that might= steal my laptop?
You forget to mention that they only guarantee a return of a stolen mach= ine under their premium subscription, which costs over $50 PER YEAR, if = I recall correctly. The standard subscription isn't much cheaper.
= Let's do a little math.
Let's say I have a $700 machine. The moment I start to use it, it has a= lready depreciated by about a $100, and it's values goes down, say as a = conservative estimate, $75 per year thereafter.
So I pay $50 to protect this investment, which is worth $600 at the time= I do so. Well, that $50 now has to be subtracted from the value of the= machine, like a "cost of carry", because if I tried to resell it, I'd b= e out that amount, so my comp is really worth only $550 now. Next year = it depreciates another $75, and I pay another $50 for theft protection. = Now it's worth $425.
Need I go on?
You will say that it's not the value of the machine, but of what's on it= , that counts.
I agree. But chances are that a thief is going to get my information be= fore the police get him, and who knows where he has put it or to whom he= has already transferred it?
If you want to protect your information, there are far better and cheape= r ways than lojack. The problem with this country is we have forgotten = the principle of individual responsibility that the nation is founded on= . As someone here said, the best protection is simply to keep your mach= ine under your surveillance and control, and/or encrypt the contents, an= d/or purchase insurance. But no, we want to turn our personal responsib= ilities over to Big Brother.
That's what the Germans did to Hitler, the Russians to Lenin, etc., the = Chinese to Mao, and so on.
They paid a HUGE price for the priviledge of not having to think, and th= eir supposed security was in reality their greatest danger.
As someone else said: "Wake up, you dead sheep!".

Thu, 2010-03-04 23:08 =E2=80=94 Anonymou= s = = =

Computrace can be stopped:=

Computrace can be stopped: Do the following:

1) START>SETTINGS>CONTROL PANEL> ADMINISTRATIVE TOOLS> SE= RVICES> find RPC ( Remote Procedure Call ) NET and/or Service. Right= click and Properties, set to Automatic and stop the serive.

2) C:\WINDOWS\SYSTEM 32\ Find these 4 files RPCNET.dll + RPCNETP.DLL = + RPCNET.EXE + RPCNETP.EXE ( Do the following to each file )

3) Delete each file. DO NOT REBOOT. Open WORD PAD. Type and "Save A= s" ( without quotes ). Name the file as the one it will replace above. = Do this for all 4 files. Once they are all replaced with the "VOID" (b= ogus file ) Right click on each file and change the attribute to READ ON= LY > APPLY > OK.

To check and make sure it has worked, reboot your machine. Go to Ser= vices and check your RPC process and see if it has re started. If it re= started then you did something wrong with the above files, retry and reb= oot and recheck. Remember, if you delete one or all the files without s= topping the service the files WILL come back automatically. Also you wi= ll not be able to delete RPCNET.exe if the service IS started. It must = be done in the order above.

I know this works because i've tested it. Keep in mind, even with th= e above done correctly Computrace WILL still show in BIOS but will prett= y much be a dummy computrace.

Sun, 2010-11-14 21:01 =E2=80=94 Annonymo= us = = =

I did this but I am afraid=

I did this but I am afraid to go on the Internet, how can I con= firm that this really works?

Thu, 2010-06-24 07:59 =E2=80=94 lilone21= 804 = = =

Okay, people have been

Okay, people have been asking this question but nobody has answ= ered. I have a Dell Studio 1737 and it has a pheonix bios. Computrace is= set active in the bios. I recently bought a new hard drive because my o= ld one crashed. The four files you speak of do not show in my system 32 = folder. Is it safe to say that computrace is not active?

Mon, 2010-03-01 17:54 =E2=80=94 Anonymou= s = = =

I had just bought a new Dell

I had just bought a new Dell Studio 17 Laptop for christmas and= I went to the bios screen to choose the disable option. Upon restarting= my laptop I went to check if it had been disabled successfully, and the= F***ing thing had set itself to "Activated"!!!!

This piece of software/firmware is a major security and privacy breac= h, and its so badly made it can't tell the differance between the disabl= e and activate functions!

Thu, 2010-02-18 18:10 =E2=80=94 Anonymou= s = = =

LOOOOOL i've only read a

LOOOOOL i've only read a page so far but why are you all so wor= ried? The way to remove any tracking hard/soft/firm-ware is simple!

1, Find where it is (they tell you its in the bios on the "how it wor= ks" page of their website)
2, remove it (only way to remove something from your bios is edit an new= version yourself or download a new version from the motherboard manufac= turer, Flush your bios, load your bios.. job done)
3, check, if its not gone it means it has a backup installation somewher= e highly unlikey for the moment.
all else fails buy a new motherboard (not a stolen one dipstick)

The only way you can find me with all your stolen laptops is when i t= ry to sell it back to you! If they install a hardware device i'll remove= it by cutting the power track on the board, if they modify the bios I'l= l modify the bios.

Plus the only way you can track me is by;
GPS- impossiable without an active GPS chip connected and installed
Cellular triangulation-impossiable GSM chip connected to a network.
Trapping my IP when I put it online and tracing me- again here you'll ha= ve an issue from my house as i use annoymous proxy servers and spoof my = home IP, good luck finding the right header in 50,000 packets!!
(I have a very high powered cisco router 2900 connected to 2 adsl lines = (balanced) and thats stolen too! and all your laptops pay for my adsl li= nes)

How dumb would I be to go online with a stolen laptop? I'll just take= your details, wipe it, sell it in a pub!

lojack is used to catch dumb criminals and take money from the scared= masses, not to protect you from people like me! If its sole purpose was= to help you why do they charge you for the service? I dont charge when = i help an old lady cross the street!

So where is the soloution and prevention?

Hacking is a powerful tool, why should I not get paid for my work whe= n i'm not doing it for fun?
would you work for free?

Lastly please computrace if your reading, make this harder!! Altho I = am working on hacking N3 (3.37) at the moment so give it a while first! = Thanks

Ways around anything if you look hard enough
(except mobile phones)

Fri, 2010-02-12 15:28 =E2=80=94 Anonymou= s = = =

as if this company will

as if this company will decide one day to track one of you...It= is a forum about "I am only in the world "Or some geeks plans of hackin= g LoJack system?

Tue, 2010-01-26 08:18 =E2=80=94 Anonymou= s = = =

First of all I don't<= /h3>

First of all I don't remember enabling this piece of software a= nd yet it's Actived on my computer. I called Lojack and the lady said th= ey would disable it... Weeks later no disabling... I hate waiting on the= phone for like an hour to speak to a rep... We need to set up a website= to hack these things out of our bioses and warn people about this produ= ct... It's a massive spy tool/security threat and it should be freaking = everyone out! I am no longer buying Dell laptops because of it!

If you are going to make a creepy product like this, make sure legiti= mate owners can easily get rid of it... Otherwise expect a backlash!
=

Mon, 2010-02-22 14:33 =E2=80=94 Anonymou= s = = =

if it was made easy to get=

if it was made easy to get rid of, wouldnt that defeat the purp= ose? Wouldnt you rather get your stolen computer back

Tue, 2010-01-26 01:58 =E2=80=94 Anonymou= s = = =

Just delete it on startup,=

Just delete it on startup, it doesn't come back until you reboo= t anyways. so as soon as you login, it runs and deletes the files.

make this into a batch file by right clicking on your desktop, select= ing new, selecting text document, then copying all the following in it:<= /p>

@echo off

TASKKILL /F /IM "rpcnetp.exe"
TASKKILL /F /IM "rpcnet.exe"
TASKKILL /F /IM "upgrd.exe"
del "C:\Windows\System32\UPGRD.exe"
del "C:\Windows\System32\rpcnetp.exe"
del "C:\Windows\System32\rpcnetp.exe"
del "C:\Windows\System32\rpcnetp.dll"
del "C:\Windows\System32\rpcnet.dll"

click on "save as" in the file menu, then click on the bar that says = text documents (*.txt) and change it to all files, and change the name o= f the file to "anyname.bat" without the quotes, name it anything you wa= nt, but make sure you add the .bat extension. after it's been saved, ad= d it to your startup folder. be sure to turn off your wifi or disconnect= your ethernet cord whenever you restart though, in case it doesn't dele= te the file right away.

Tue, 2010-01-12 05:35 =E2=80=94 Anonymou= s = = =

get the dst iso file from<= /h3>

get the dst iso file from the priatebay just put dell in serch<= /p>

Mon, 2010-01-04 15:35 =E2=80=94 Anonymou= s = = =

Seriously why dont you

Seriously why dont you suckers wake the heck up, do you really = think that this company gives a shit whether or not you loose your lapto= p, this is just an excuse to load this bloatware onto new laptops.

Funny how nearly every single "Free offer" is clearly advertised, why= are they not making it clear that this spyware is on the computer, BECA= USE THEY DONT WANT YOU TO KNOW. Wake the hell up you mentally dead sheep= , even in the film surrgoate's you have some fat geeky dude at a central= system controlling everything. Yeah sure just a film right...

I am disgusted that my laptop's privacy has been vulnerable all this = time, some of those geeky ignorant devils at the company must have some = fun knowing they have the power to do whatever they wish.

Welcome to Big brother, it is here among us now, but it is inevitable= that it will be bought down. God is watching over us.

The truth is that this bloatware can be removed, dont listen to the l= ies and deception of those working within the system, computrace would n= ever admit to such a flaw, like you said yourself its a million dollar b= usiness. The companies intention is not to protect your laptop, it is t= o spy on you this is just their cover.

I just am pissed that I did not know about this rootkit,spyware/virus= whatever the hell you want to call it, If i had purchased this then fin= e but they done this without my authorization or consent.

If you dont mind working on a laptop that is open for the world to se= e, then go ahead and promote this crap. There is only one way to bring = such a company down, and I am sure someone somewhere is planning.

A while back I read an article about microshit planning on introducin= g a system called "zeus" i think, the plan was to have everybodies compu= ter hooked up to a main central system owned by them and everytime you d= o something on your computer it would have to refer back to "zeus" for c= omfirmation. Computrace have set the foundation, all these millions of = people are unknowlingly being traced, after all it is what this software= does.

As for all you ass's that think tracing a laptop is going to help you= recover it, then you are being mislead, if someone stills a laptop and = turns it on to find a load of warning messages do you really think they = are going to hand it in to the local police station, or do you think the= y will throw it off a building.

They could have at least had the decency to setup a clear way to remo= ve the program, or at the very least put a sticker on the laptop to info= rm us that it is being spyed on.

But thats not what they want, the less people know the better, the tr= uth is the only way to bring big brother down hence the reason they have= programmed all of you with TV, posion in the water, EMF's and all this = other unnatural shit in this world.

But I am sure some of you will have something to say about the conspi= racy theory that is being mentioned here.

Wed, 2010-02-24 14:49 =E2=80=94 Anonymou= s = = =

I am a police detective and

I am a police detective and I can tell you firsthand that this = system works. We just recovered three stolen laptops yesterday because o= f Computrace, and it's the second time in the past few months that we've= worked with Computrace to recover stolen property. I'm sure the owners = of those laptops would disagree with all the negative comments.

Tue, 2009-11-17 12:26 =E2=80=94 Anonymou= s = = =

My question is - If you

My question is - If you never register or activate lojack when = you get your computer, does it still phone back to compuserve?

Tue, 2009-11-17 07:36 =E2=80=94 Anonymou= s = = =

How about something simple,

How about something simple, Find all of the registry entries fo= r rpcnet and change the permissions on them and then delete them. Afte= r that reboot the computer and search for all of the files named rpcnet = and then remove them. Create 6 new txt files and name them the same th= ing as the 6 files you just removed and place them where the other file= s were, set them as read only and encrypted.

Reboot the Computer all you want and the root kit can run itself as m= uch as it wants but the files will not get back to their original size a= s they already exists under another name. Now the windows service for= this has also stopped running itself and no longer shows up, Seems to e= asy to work but it does.

Fri, 2009-10-30 12:44 =E2=80=94 Anonymou= s = = =

i know it sounds dumb but i

i know it sounds dumb but i got a dell inspiron e5400 from the = flea market and now after reading this i am scared mind may be hot, is t= here someone here that can show me a step by step guide to use CBROM to = take that bios off and put a new one on, i ran DTS iso and set computrac= e to DISABLED and i reloaded the WINXPPRO and i don't see the rpcnet fil= es in the system32 folder BUT want to make sure that the X-Files men don= 't kick in my door.

Fri, 2009-10-30 12:42 =E2=80=94 Anonymou= s = = =

i know it sounds dumb but i

Sun, 2009-10-25 19:40 =E2=80=94 Anonymou= s = = =

How to remove Computrace

How to remove Computrace LoJack on Windows 7:

If you use the GPT partition scheme on your hard drive it will end th= e BIOS's ability to load files into Windows. Use GParted or something to= do this. Then install Windows 7 which supports GPT.

No software is futureproof.

lapski

Tue, 2009-12-08 00:27 =E2=80=94 Anonymou= s = = =

Is there the svctag..exe

Is there the svctag..exe equivalent for a dell desktop?

Mon, 2009-11-16 03:14 =E2=80=94 AliBaba<= /span> = = =

I am surprised no one yet<= /h3>

I am surprised no one yet has figured out how to defeat this ro= otkit!

look for a filename that start with upd... in your c:\windows\system= 32\ folder. the property of the file tells you it belongs to absolute so= ftware. Also, one of the property tabs should give you a clear indicatio= n on how the (rpcnet, rpcnetp....) filed are recreated each time you res= tart the notebook. Also, you need to look for the hidden oem partition o= n your hd.
Removing the "installation software" and "hidden partition" is a bit tri= cky but with the right tools it can be accomplished easy!

Ali Baba

Mon, 2009-10-12 04:29 =E2=80=94 Anonymou= s = = =

YOU ARE DUMB...i did

YOU ARE DUMB...i did indeed...there is heavy mention of the fil= e in this forum alone.

Tue, 2009-09-22 18:34 =E2=80=94 Anonymou= s = = =

my way of getting it

my way of getting it done:

end the process called rpcnetp.exe or rpcnet.exe
find your way into " \windows directory\system32\ "
1) delete rpcnetp.exe rpcnet.exe rpcnetp.dll rpcnet.dll ..
2) create new text files and rename it to be exactly as the file deleted= which are rpcnetp.exe rpcnet.exe rpcnetp.dll and rpcnet.dll << al= l four files
3) make sure to make these files to be read only
4) you're done

so whenever your computer runs, it will try to open the dummy files.<= /p>

Tue, 2009-10-13 14:28 =E2=80=94 Anonymou= s = = =

verified+works for me

Thu, 2010-04-08 03:09 =E2=80=94 pauls = = =

Well after messing with my=

Well after messing with my partitions in windows mainly a big n= o no i needed to call a data recovery company but got that all sorted ou= t and really thinking about just moving everything to ubuntu and getting= rid of xp.

Mon, 2009-10-12 18:45 =E2=80=94 Anonymou= s = = =

ok so all this talk and

ok so all this talk and stuff and nobody has come up with a ful= lproof way to remove the computrace. please help me!!! btw that link doe= snt work. :(

Thu, 2009-10-08 11:38 =E2=80=94 Anonymou= s = = =

I honestly don't think this<= /span>

I honestly don't think this would get it done. Since working wi= th laptops with this feature, I've looked up a little on what exactly co= mputrace does.

I know that it's in the BIOS, I'm not sure if maybe older versions of= this software are in the OS itself, but in these new laptops purchased = in '08, it's all in the bios.

I understand that ability to protect assets to a company is very impo= rtant, but wouldn't it be VERY simple just to flash the BIOS? Would that= not remove the CompuTrace code in the BIOS?

Unless they use hardware like LoJack in cars, with a radio transmitte= r and maybe something hidden built into the LAN/WLAN cards, which I hear= d mentioned in a few articles.

Wed, 2009-09-16 12:47 =E2=80=94 Anonymou= s = = =

I have had three laptops

I have had three laptops stolen in the last month and I am piss= ed that I did not have lojack activated on them because I know I will ne= ver see them again. IF lojack is so bad then please someone develop a be= tter way to protect people like me who are not geeky from loosing our ma= chines, photos, documents and privacy. thanks! And finally, may those wh= o stole from me be cursed with boils, confusion and impotence until they= return my equipment and pay for my lost peace of mind and the price of = moving.

Fri, 2010-01-22 01:57 =E2=80=94 Anonymou= s = = =

The point is with LoJack

The point is with LoJack installed you have NO privacy. The be= st protection against laptop theft is caution, regular backups and purch= asing insurance. LoJack is not the answer if you value your privacy in = the least.

Fri, 2010-01-29 22:19 =E2=80=94 Anonymou= s = = =

Please tell us HOW they

Please tell us HOW they remove your privacy? In knowing where y= ou are located???? Have you ever looked at the header of ALL of your em= ails? What about website server logs, they list every visitor and can be= easily traced back. Often these logs even show your computer and/or use= r name.

Any facts to back up your comment?

Tue, 2009-09-08 06:21 =E2=80=94 Anonymou= s = = =

I bought the lojack software

I bought the lojack software and enable the computrace. Then so= mething strange happened. I could no longer run scandisk/chkdsk. After s= everal frustrating weeks trying to find the problem, I narrowed it down = to the lojack software. After contacting them, they confirmed that it wo= uld interfere with scandisk/chkdsk. So I told them the likelyhood of my = computers hard drive getting corrupted was many times that of the laptop= getting stolen and that I needed scandisk/chkdsk more than I did lojack= , they agreed to a refund. So I uninstalled everything, and was able to = run chkdsk one time. Great, I was happy. But now I can't run it again. I= t seems "something" it still running and thats from the command prompt i= n safe mode. I tried going into the bios and disable the computrace, but= as others have said, once it's enabled, there is no way to disable it.<= /p>

So while I liked the lojack feature, not being able to maintain the H= D is a greater threat. Unfortunately, now I can't do either.

Computer is a dell laptop. bought new from dell.

Wed, 2009-08-26 22:02 =E2=80=94 Anonymou= s = = =

A silly question. I dislike

A silly question.

I dislike the whole 'big brother' slant our society is leaning toward= s, but that is another topic.

I have a daughter who is heading off to college in the morning, with = her brand new lap top.....living in a dorm. I really don't want to repl= ace a stolen laptop and was considering the price of lojack to protect h= er investment. My thoughts are that the chance of her laptop walking of= f in the next year are statistically higher and worth the money and inva= sion of privacy that comes with the software.

Her computer will be for school work, music and Facebook, etc.......s= o there relly isn't any personal information to harvest.

Is it would the investment in your computer saavy eyes?

Thanks.......

Tue, 2009-08-18 19:35 =E2=80=94 Anonymou= s = = =

Try removing main CPUs.

Try removing main CPUs. Leave it in static-free environment. Re= move CMOS battery (size btwn dime and a quarter). After 30 minutes assme= ble back everything again. You may have to reset BIOS. I have gone from = a crippled WXP to lightening fast computer with only 256MB with Athlon 5= 00 (PII) CPU.

I knew I had very fast CPU but somehow blamed on MSFT updates. Try th= is trcik I gained almost 300% increased speed, and that toooooo on a 256= MB shared RAM. Go figure. I think of MSFT blocking CPU cycles (or poison= ing the CPU cycles) with such BIOS-based poisoning tools.

I do not know whether it was a BIOS rootkit or what, but I am glad I = did a stupid cleaning of my 11 years old computer. Can anybody verify th= is observation? THanks.

Fri, 2009-10-23 14:34 =E2=80=94 Anonymou= s = = =

this will not help!

this will not help! Computrace is a part firmware code.

Tue, 2009-08-11 23:21 =E2=80=94 Anonymou= s = = =

Does Computrace provide an<= /h3>

Does Computrace provide an uninstaller for legal owners of the = laptop? That would be nice.

Sat, 2011-02-26 13:11 =E2=80=94 anoymous= = = =

yeah that would be good idea

yeah that would be good idea for the company to provide the own= er with a unistaller that could only work once. or else i think that it = should be the person buying the laptop to go into the bios and confirm w= hether or not it has the computrace software as part of the bios.

Mon, 2009-12-14 12:09 =E2=80=94 Anonymou= s = = =

GET INTO SYSTEM (HOLD F2<= /h3>

GET INTO SYSTEM (HOLD F2 DOWN WHEN RESTARTING) I FOUND MINE UN= DER SECURITY AND HAD TO DISABLE IT. IT TRACKS YOUR HARD DRIVE AND YOU. = MSNBC HAD A STORY ON IT AND CALLED IT A MAJIOR SECURITY HOLE. THIS PROGR= AM LETS HACKERS IN AND THEY MODIFY COMPUTER SETTINGS AND TAKE CONTROL OF= YOUR MACHINE. THEY ALSO HAVE IT IN SOME PHONES AND IN THE WRONG HANDS = THEY HAVE EVERY MOVE YOU MAKE. LOOK UP MSNBC.COM JULY 30,09 WE ARE ALL = PAYING FOR THIS AND IT TRACKS OUR EVERY MOVE. PEOPLE SHOULD BE AWARE IT= S INSTALLED. BOSTON BASED CORE SECCURITY SAID HACKERS LOVE IT. I WANT T= O TO MAKE PEOPLE AWARE OF THIS. I AM ONE PERSON WHO HS BEEN TRACKED FOR= FOUR YEARS AND JUST FOUND OUT WHY.

Mon, 2009-08-03 14:20 =E2=80=94 Anonymou= s = = =

I changed the service tag on

I changed the service tag on my dell. will computrace still wor= k? like call corporate? also i just want to remove it completely im on a= dell m1710

Sun, 2009-09-06 11:11 =E2=80=94 Anonymou= s = = =

Contact Absolute Software to

Contact Absolute Software to have it turned off on your machine= .

Projects

Navigation

User login