Computrace Rootkit: What to do if you are locked
Ok, so there this client of mine who brought me a laptop to fix it. According to him, he was a call center agent and his company issued a laptop to him, and he got fired, he refused to give the laptop back to the company, thinking it is his to keep because he was fired and he maybe thinking it is unfair to him.
So the IT of their company locked the Laptop, and whatever they do, the lock keeps bugging him. He reformatted the drive and installed a new operating system but to no avail.
Computrace
What is computrace?
Computrace is a security software, an Anti-theft software developed by absolute software as part of the MCLA's Laptop Initiative. It is a software built into laptop's BIOS that were purchased and in the event of lost, the organization's IT can track the stolen laptop, lock it up, delete sensitive information, or, it can be ordered to brick itself (totally unusable). It is a very persistent rootkit that reformatting the drive, flashing the BIOS won't get the lock go away and everytime the device is connected to the internet, it will send a query to the server, and do whatever command the server instruct it to do so (according to the device administrator's will).
What to do when locked out?
If you own the laptop, and you are locked out, you can call the Computrace technical support to help you unlock it, and disable the Computrace software from their server. Just make sure to have obtain a support ticket from the technical representative you talked to, otherwise, you might need to call them back again. That will stop your laptop from calling your home phone or your office phone (whatever) every time you open your laptop.
What if, you purchased a secondhand laptop from the surplus store with the Computrace enabled? Well, that's where the big problem starts.
Computrace works when you open your device, it will send a query to the computrace server, and wait for the server's reply. When the server replied OK, then it will not lock you up, other wise, you maybe locked out, all your data will be deleted, or worse, your laptop will be totally won't work forever depending on the command set sent from the server.
The only way to stop Computrace from locking you out (that is if it is enabled and you do not have access to technical support, like you don't originally own the laptop) is to prevent the device send and receive data from the any of the Computrace Server.
Luckily, there is one solution. Follow the steps below:
- Reformat your computer and reinstall your operating system offline. Do not connect to the internet.
- Open the registry editor and locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager. Backup the BootExecute key value (autocheck autochk * by default) before deleting it to stop Computrace from being launched upon system startup.
- If the rpcnet.exe, rpcnetp.exe, rpcnet.dll, and rpcnetp.dll files exist in the System32 directory in the Windows system, terminate the related processes and delete these files. Remember not to restart the system at this time.
- Create the above four files with empty contents in the System32 directory. Perform the following steps for each file: Right-click the file and select Properties to open the Properties page. Then click the Security tab and set Permissions for each user or group (including SYSTEM) to Deny Full control.
- If you want to retain factory BIOS settings and related Windows files and configurations, you need to edit the “hosts” file in the C:\Windows\System32\drivers\etc directory to deny access from certain domain names by adding the following information and saving it:
- 0.0.1 search.namequery.com
- 0.0.1 search.namequery.com
- 0.0.1 search2.namequery.com
- 0.0.1 search64.namequery.com
- 0.0.1 search.us.namequery.com
- 0.0.1 bh.namequery.com
- 0.0.1 namequery.nettrace.co.za
- 0.0.1 m229.absolute.com
At the same time, configure the firewall to block access from rpcnet.exe and rpcnetp.exe
Comments
Post a Comment