This is our old Q&A Site. Please post any new questions and answers at

I have been looking at packets on my network a lot lately and I found out some crazy things. One is that most of the laptops sold today come with a windows/osx BIOS loading trojan called computrace, lojack. It has the purported intention of tracking stolen laptops but is easily exploited into very persistent trojan that can load into windows/osx and now linux too. Suffice it to say I trust nothing but the wire and a USB booted laptop to further analyze what all this stuff is on my network.

Ok, so, one of these laptops runs windows 7 and def has the rpcnet.exe lojack software as I have seen it contacting Absolute Software here and there. The laptop is not stolen so I wonder why on earth it does that. Anyway, it also exhibits the following behavior upon waking from hibernation. Please see the screenshot,

Any idea why it would look up random NB names?

Any and all expertise is appreciated. Considering going out to Stanford for the Sharkfest.

asked 03 Jun '12, 13:07

pluribus's gravatar image

accept rate: 0%

I may have answered my own question from the LLMNR RFC

Seems random lookups are part of the spec. Any experts welcome to chime in.

(03 Jun '12, 13:45) pluribus

Maybe somebody else can shark the wire with windows 7 and let me know?



(03 Jun '12, 13:50) pluribus

"Any and all expertise is appreciated. Considering going out to Stanford for the Sharkfest."

I wouldn't go to Standford if I were you...

... we're having Sharkfest in Berkeley this year ;-)

(03 Jun '12, 14:09) SYN-bit ♦♦

As displayed here: SharkFest '12

(03 Jun '12, 14:18) grahamb ♦

Whoops, my mistake. Brain switch.

(03 Jun '12, 14:38) pluribus

Kindly disable Netbios over TCP/IP on your Lan connections.You wont see any NBNS broadcast

permanent link

answered 07 Jun '12, 22:29

bluebird77's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 03 Jun '12, 13:07

question was seen: 5,854 times

last updated: 07 Jun '12, 22:29

p​o​w​e​r​e​d by O​S​Q​A