Spyware, viruses, & security forum: rpcnetp.exe .dll?

Locate that file in Windows Explorer, right click>properties and tell us:
1. The folder where you found it.
2. What it tells you on the Version tab of the properties.

Kees

Located at C:\Windows\System32, the details tab has the version information blank, as is everything else, the file size, for both the exe and dll is 17kb. To clarify, the process runs for a few moments at startup that I've noticed, I've kept task manager open for extended periods of time but havent seen it run at other times. Also, when I started this thread, I found the file by going into the 'open file location' option of the task manager, but when I went into the directory to search for the version number, both files had disappeared. So I restarted, and sure enough the process ran again, and both files were there again, this time I actually saw the exe file just disappear from the directory just after I looked for the version number.

According to Absolute Software, the developers of Computrace, aka Lojack for laptops, the application file rpcnetp.exe will only be downloaded from Computrace AFTER the owner has actually activated Lojack for Laptops protection. It is not supposed to be placed on your laptop normally. The dates of online user questions about finding the application ' rpcnetp.exe ' on Toshiba laptops all seem to commence around the middle of 2011. If you purchased a Toshiba laptop after the middle of 2011 it may be that Toshiba is mistakenly installing these applications.
My Toshiba laptop was made in 2009 but it was not until recently that I began using a program called WinUtilities Process Security 3.0. Process Security did not previously alert me to the presence of both Lojack applications rpcnetp.exe and rpcnet.exe, but it did today, February 17, 2012, and it identified both as having "unknown" security risks. this is what prompted me to read up on Lojack's claims that its spyware was only installed on computers where Lojack had been activated for that machine.
Neither RPCNETP.exe nor rpcnet.exe are totally benign programs. if you read some of the 'case histories' which Absolute Software provides about recovered laptops you will notice that Absolute inadvertently discloses that they are able to use rpcnetp.exe and rpcnet.exe to scan anything and everything on your computer.
While Lojack claims that this is only done for computers reported stolen they also say, incorrectly, that these two files will only appear on your computer AFTER the owner purchases Lojack. I also noted in examining "last accessed" and "last write time" that each indicated a date only 5 days ago! So the question is, what is Absolute doing to my computer that would require its two supposedly inactive files to be written to?
This is shady business by somebody. And if most or all laptops are being equpped like this, it is plainly an open door for Homeland Security to go to Absolute Software, either with or without a warrant under the Patriot Act, and be able to look at all the information inside of anyone's computer that they want to.
This is a very serious threat to the privacy of anyone who owns a laptop pre-equipped with a Lojack setup.


The only likely way that these two applications ended up on my Toshiba was by way of an automatic download from Toshiba Station or one of Toshiba's bunch of junk 'extras'.

If the password in the BIOS is changed can the laptop still be monitored? I got my laptop a few months ago & I just found out about this thing called "lojack". I don't think I approve of this possible invasion of privacy either. I'm very responsible when it comes to keeping an eye on it so I don't think I need their services. I did change the password but just not sure if that helps.

It's one of my favorites at link.

http://preyproject.com/

libraj112, no, changing the BIOS password certainly won't help you. Contacting a lawyer instead would.
From a technical point of view, in order to use your laptop you need to get the BIOS source code, review, compile and flash it.

This is the worst virus I've ever seen: OEM-installed(in my case it was Acer on an Aspire One 756 bought in 2012) BIOS-based spyware, backdoor. A file is written by the BIOS to c:\windows\system32\rpcnetp.exe, then it starts downloading and installing the actual spyware. My guess is the spyware was used to remotely access my computer. Note this is my laptop and I didn't buy any lojack subscription.
Where can I get some InsydeH2O BIOS source code in order to build the BIOS myself?