-
-
Save jcary741/19cc74c93a499f8c23ad7dd5a04faf86 to your computer and use it in GitHub Desktop.
| # Version: 0.1 (2025-01-18) | |
| # License: MIT, use at your own risk | |
| # | |
| # This script disables the Lenovo-installed "Tobii experience" software and "nahimic" software. | |
| # Tested on a Lenovo Legion Pro 5 (82WM) with Windows 11 24H2. | |
| # Run it with `powershell.exe -noprofile -executionPolicy Bypass -File badlenovo.ps1` | |
| # Following this script, you should be able to uninstall the "Tobii experience" app from the control panel (appwiz.cpl) | |
| # | |
| # After major updates, you may need to re-run this script. | |
| # Disable services (may be re-enabled on reboot) | |
| Get-Service -Name "Tobii*" | Stop-Service -Force | |
| Get-Service -Name "Tobii*" | Set-Service -StartupType Disabled | |
| Get-Service -Name "Nahimic*" | Stop-Service -Force | |
| Get-Service -Name "Nahimic*" | Set-Service -StartupType Disabled | |
| # Get the service exe paths | |
| $services = Get-WmiObject -Class Win32_Service | Where-Object {$_.Name -like "Tobii*" -or $_.Name -like "Nahimic*"} | Select-Object PathName | |
| $services = $services.PathName -split "`n" | ForEach-Object { $_.Replace('"', '').Trim() } | |
| $services = $services -replace '\.exe.*', '.exe' | |
| ## use icacls to deny access to the service exes, so that they can't be started | |
| $services | ForEach-Object { | |
| $servicePath = $_ | |
| $acl = Get-Acl $servicePath | |
| $denyEveryone = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone", "FullControl", "Deny") | |
| $denySystem = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM", "FullControl", "Deny") | |
| $acl.SetAccessRule($denyEveryone) | |
| $acl.SetAccessRule($denySystem) | |
| Set-Acl $servicePath $acl | |
| } | |
| # Find "devices" that are installed by the Tobii or nahimic software and disable them | |
| $devices = Get-PnpDevice | Where-Object {$_.FriendlyName -like "Tobii*" -or $_.FriendlyName -like "Nahimic*"} | Select-Object FriendlyName,InstanceId | |
| $devices | ForEach-Object { | |
| $device = $_ | |
| $instanceId = $device.InstanceId | |
| $friendlyName = $device.FriendlyName | |
| Disable-PnpDevice -InstanceId $instanceId -Confirm:$false | |
| Write-Host "Disabled device: $friendlyName" | |
| } |
It worked as well
@jcary741
@bryantc24
Thanks for reporting back.
I haven't looked at this lately, as I didn't have any further issues, and had more severe update issues with the bloated Intel Graphic driver.
I just noticed after another windows update, that the Tobii malware was updated and reinstalled! WTF MS!!?
I still need to investigate the new installer files, but it seem that for the moment, our previous host file, driver and registry hacks prevented it from running properly! 🥇
Warning
In addition, another very nasty Intel malware was hogging up my CPU and uploading just about every possible Network setting, including info on every single SW and app installed and a full record of what programs have been running on the CPU. The malware is called QUEENCREEK and is supposed to help you tune your processor... Instead uploading just about everything else about your computer, your network, your connected devices, apart your files themselves! There should be prison sentences for this kind of intrusion.
Upload folders can be found here:
C:\WINDOWS\system32\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\
Program folder here:
C:\Program Files\Intel\SUR\QUEENCREEK\x64\
Registry Keys here:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESRV_SVC_QUEENCREEK\
Service is called ESRV_SVC_QUEENCREEK.
# Stop Service
sc.exe stop ESRV_SVC_QUEENCREEK
# Delete Service
sc.exe delete ESRV_SVC_QUEENCREEK
# Disable scheduled task:
schtasks.exe /change /tn USER_ESRV_SVC_QUEENCREEK /disableUse firewall to block port 49350.
Important
This one is very tricky, hiding in plain sight! 👺
However, if you leave your PC without using anything, you will suddenly find your CPU fans and CPU usage go up massively as all the collection scripts are being run and then uploaded to their spy DB servers. As soon as you touch anything, mouse or key button, it immediately drops back to normal. If you're lucky to find any associated process, you'll only see yet another svchost.exe and nothing else obvious.
@eabase I actually don't have Queencreek intel on my machine, which Lenovo PC are you running?
@bryantc24 I also do not seem to have that one.
I also have once again confirmed that my initial script continues to be effective for Tobii and Nahimic. 9 months of the icacls solution working, nice!
Hi @jcary741 @eabase @ComicallyNormal @bryantc24
I've run in the same issue and I made myself some more tests. After restarting the system I was still experiencing the same issue having Tobii/SPIT services and processes running.
I pushed a version of the same file that is working for me. I'm on Lenovo Legion Pro 7 16ARX8H.
On this model I can't find the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESRV_SVC_QUEENCREEK\ or ESRV_SVC_QUEENCREEK service.
Thanks again for your research and contribution.
@jcary741 Your script is also working on my machine, thank you for writing it :)
2 month update: The initial script to cripple tobii and nahimic in place appears to be working just fine and has survived several minor windows updates.