Filter.exe

[Mike McCall]

Managed client has an older Dell E7440. The purchased it from a friend of theirs who does IT for a local school. Apparently due to financial constraints placed by my client he purchased a refurb from Amazon. For some time now the HDD has been running at 78-100% consistently. The culprit is filter.exe, which is part of Absolute Software's Computrace. I looked in the BIOS and sure enough Computrace has been activated, which I know cannot be undone. So far, I've been unable to find anything out about filter.exe as part of Absolute Software, much less about how to make it stop. Anyone seen this before?

Edit: Spelling.
Edit #2: I really do know how to spell BIOS.

 

[coffee]

Managed client has an older Dell E7440. The purchased it from a friend of theirs who does IT for a local school. Apparently due to financial constraints placed by my client he purchased a refurb from Amazon. For some time now the HDD has been running at 78-100% consistently. The culprit is filter.exe, which is part of Absolute Software's Computrace. I looked in the BIOS and sure enough Computrace has been activated, which I know cannot be undone. So far, I've been unable to find anything out about filter.exe as part of Absolute Software, much less about how to make it stop. Anyone seen this before?

Edit: Spelling.
Edit #2: I really do know how to spell BIOS.

I have seen a lot of laptops for sale on ebay with the Computrace activated. I was thinking that replacing the bios chip would do it. However, If it was possible I would think there would not be so many for sale with this problem. I know you can order bios chips for the laptops on ebay but I think they all come from China.

I have not done this but I think this is how it might go:
1. Replace bios chip
2. Take out bios battery and short pins on board to clear everything.
3. Reboot (and possibly go into bios and check if Computrace is still activated - Might do a reset to defaults also.

Im curious if anyone has tried this yet. I was tempted to buy one off ebay just to try this out.

Grammer Natzi's go home

 

[Mike McCall]

I have seen a lot of laptops for sale on ebay with the Computrace activated. I was thinking that replacing the bios chip would do it. However, If it was possible I would think there would not be so many for sale with this problem. I know you can order bios chips for the laptops on ebay but I think they all come from China.

I have not done this but I think this is how it might go:
1. Replace bios chip
2. Take out bios battery and short pins on board to clear everything.
3. Reboot (and possibly go into bios and check if Computrace is still activated - Might do a reset to defaults also.

Im curious if anyone has tried this yet. I was tempted to buy one off ebay just to try this out.

Grammer Natzi's go home

Might be interesting to try on a test case, but I imagine they would have thought of that. Also, I thought I heard somewhere (lost in the fog now) that there were other measures used besides just the BIOS.

 

[Porthos]

Where did you get the info on the file? Google did not point in that direction.

 

[Mike McCall]

Where did you get the info on the file? Google did not point in that direction.

In its properties. Signed by Absolute Software.

 

[GTP]

Found this. It may help to get started on the removal process.
Another site with suggestions.. here

This is an old article from 2009 but may be helpful.
...and this in the comments section...
Computrace can be stopped: Do the following:

1) START>SETTINGS>CONTROL PANEL> ADMINISTRATIVE TOOLS> SERVICES> find RPC ( Remote Procedure Call ) NET and/or Service. Right click and Properties, set to Automatic and stop the serive.

2) C:\WINDOWS\SYSTEM 32\ Find these 4 files RPCNET.dll + RPCNETP.DLL + RPCNET.EXE + RPCNETP.EXE ( Do the following to each file )

3) Delete each file. DO NOT REBOOT. Open WORD PAD. Type and "Save As" ( without quotes ). Name the file as the one it will replace above. Do this for all 4 files. Once they are all replaced with the "VOID" (bogus file ) Right click on each file and change the attribute to READ ONLY > APPLY > OK.

To check and make sure it has worked, reboot your machine. Go to Services and check your RPC process and see if it has re started. If it restarted then you did something wrong with the above files, retry and reboot and recheck. Remember, if you delete one or all the files without stopping the service the files WILL come back automatically. Also you will not be able to delete RPCNET.exe if the service IS started. It must be done in the order above.

 

[Mike McCall]

Found this. It may help to get started on the removal process.

Another site with suggestions.. here

Dunno what the deal is, but I couldn't get there.

This is an old article from 2009 but may be helpful.
...and this in the comments section...
Computrace can be stopped: Do the following:

1) START>SETTINGS>CONTROL PANEL> ADMINISTRATIVE TOOLS> SERVICES> find RPC ( Remote Procedure Call ) NET and/or Service. Right click and Properties, set to Automatic and stop the serive.

2) C:\WINDOWS\SYSTEM 32\ Find these 4 files RPCNET.dll + RPCNETP.DLL + RPCNET.EXE + RPCNETP.EXE ( Do the following to each file )

3) Delete each file. DO NOT REBOOT. Open WORD PAD. Type and "Save As" ( without quotes ). Name the file as the one it will replace above. Do this for all 4 files. Once they are all replaced with the "VOID" (bogus file ) Right click on each file and change the attribute to READ ONLY > APPLY > OK.

To check and make sure it has worked, reboot your machine. Go to Services and check your RPC process and see if it has re started. If it restarted then you did something wrong with the above files, retry and reboot and recheck. Remember, if you delete one or all the files without stopping the service the files WILL come back automatically. Also you will not be able to delete RPCNET.exe if the service IS started. It must be done in the order above.

This, and other comments on this page look interesting. Wish I had a donor to try it on first. I'll look at this intently. Thanks!

 

[GTP]

Sorry, forgot a forward slash! Try this.

 

[Mike McCall]

It's after midnight here. I'll have some reading to do tomorrow. Thanks!