08-30-2017 05:39 PM - last edited on 09-01-2017 05:01 AM by Andy_Lenovo
I've just recently bought used Lenovo ThinkPad T420 4180w4b, and faced a problem I can't resolve.
After fresh Windows 7 installation and a couple of re-starts after drivers installation I've started to receive a pop-up once system boots. It's an Internet explorer window that opens full-screen and doesn't let me to perform any actions. Pop-up says: "This machine is not in compliance with Under Armour security standards. Please contact the Global Service Desk at +1 ***-***-**** to enable your machine"
I've managed to trace the file to: c:/program data/wcttempoff.html
Neither Kaspersky rescue disk nor dr.web bootable AV provided me with no help.
Google search isn't helpfull as well.
Fresh OS re-installation from another source using safe-only soft and driver sources not fixing problem as well. Pop-up reeturns in a couple of re-boots.
Any help appreciated.
Moderator note: post moved to Security and Malware for (hopefully) increased visibility to members who may be able to help.
08-30-2017 06:34 PM
Can you wipe the disk before reinstalling? I like active kill disk - free addition. You can create a bootable CD
08-30-2017 06:40 PM
Thank you for your answer!
Isn't disk formatting during the windows installation reliable enough?
P.S. i've been digging around and noticed that Computrace by Absolute technology is enabled. Could it lead to a pop-up block I'm facing?
08-30-2017 07:47 PM
computrace won't cause that. Where did the install disks come from?
08-30-2017 09:35 PM
It sounds like you've purchased a used computer that belonged to Under Armor.
Have you tried calling the number displayed on the screen and asking them to remotely deactivate the security software?
08-31-2017 12:51 AM
Well, I've been installing Windows 7 using original Microsoft Windows installation disk.
And also tried to install Windows 10 using bootable flash drive. It was also created using official Microsoft tools.
I've tried to delete the files c:/program data/wcttempoff.html and c:/program data/wcttemp.html while booted with Kaspersky Rescue Disk, but this led to Red Screen saying "your computer is locked please contact your administrator" on system boot.
08-31-2017 01:03 AM - edited 08-31-2017 01:20 AM
Aryeh, yeah, I am also assuming that that's the cause of active Anti-theft protection. Because the risk of laptop getting infected with some kind of a virus is extremely low, and no results of anti-virus scan with multiple tools. It would aso explain why it appears out of thin air after fresh OS installation. As far as I understood, it is rooted into BIOS with "disable" option blocked, so only service providers can swithch it off.
No, I didn't call them. Unfortunately, it would cost me quite a coin. I'm actually waiting 9 AM EDT when Under Armour Live chat goes live) Wanna confirm that this number is or was connected to their company.
I have written to the support of the Absolute technology as well, in order to disable the protection. They answered that it will be possible if the laptop wasn't stolen. I provided 'em with serial number so they could check its status. Still waiting for response.
Dont know what to expect if it was a corporate laptop of Under Armour that was stolen and then sold to me. Just hoping that in such a case it will be possible to ask them to cancel Absolute technology subscription for this laptop.
09-12-2017 10:06 AM
I am curious if you received replies from Absolute and Under Armour. Were they able to offer any suggestions?
I am not employed by Lenovo or Microsoft. I am a volunteer.
09-14-2017 07:09 AM
Yeah, it took some time to finally deal with this situation. I've been communicating with Absolute technology for some time. In the end they've shared with me a contact from Under Armour, so I could negotiate with them regarding this laptop (as far as it was still UnderArmour property). I was ready to send the laptop back to them if the would be insisting, but they told it wasn't worth returning. I've described the situation to them and after some time (I'm assumign they were investigating) I've got a reply that they will unlock the PC, and shared instructions with me how to do this.
P.S. for those who face the same issue, but can't achieve the same result in negotiations on laptop unlocking, there is a way-around that blocking pop-up. once the fresh OS is installed, make sure not to connect to the internet.
After system is booted, go ahead to the Windows/system32 and/or windows/syswow64.
find files rpcnet.exe, rpcnet.dll, rpcnetp.exe, rpcnetp.dll. delete them. after that, with a notepad, create 4 empty documents, name them as those files that were deleted, apply read only, move them to the folder files were deleted from (I've also changed all the rights to "deny" for all users).
After this, feel free to connect to web, install drivers, and updates. Pop-up won't bother You.