I had to think hard about this (That's the burning smell) but I think about the time I put SHIII on my box that I could burn a cd but the files were unreadable. Hadn't paid attention to the SF saga untill sometime later. My son had Easy CD Creator from Roxio for his Dell so I loaded that up and haven't had a problem burning since. So you just need something to override SF.

I found that quite offensive. And at the moment I believe your assumptions may cause harm to yourself and with your unfounded assurances that SF is of no Danger, it may harm others as well.

Now I abhor conflict however, I will let you know how and why I come to these conclusions. See if you can keep up, as some of this is quite technical.

This is for the Windows XP OS's only.

1. Run SH3.
2. Alt+Tab or use whatever functions your OS allows you to minimize the game with.
3. Go to Star>Run, type into the Command Prompt. "tasklist /svc" without the quotes, you should see several services running under the CVS index including the illegal entry of Starforce Environment Driver, StarForce Protection Helper Driver and StarForce Synchronization Driver. If you do not see them. Well as I said, "Not all machines are the same."

4. type into the command prompt, "netstat -a" active connection will include a connection to 'SF Protection' it should be listed as "Listening."

5. type into command prompt, "netstat -b" to see all connections if SF was not listed as Active then it should be listed in here.

Still not convinced?

Right click, "My Computer." click "Properties." go to "Hardware" then "Device Manager". Now click "View" then "Show Hidden Devices" now go to "Non-Plug and Play Drivers" and you should see the same ones I listed in step 3. Right click anyone of them and click "Properties." then click "Driver" and you should see each SF Driver is listed as a "Windows Service" which means it is an Active connection and has permission to do whatever it wants under the SVCHost operation it also work on Boot. As is true that some Windows Services are directly connected with Microsoft. it is the same with the SF Drivers, that I mentioned. Now there may be legitimate reason for adding them in this manner but the point is, they did it without the user's permission and without allowing them to edit it.

If you saw none of what I mentioned then please, REMEMBER. "Not All Computer Systems Are The Same." and if you tell me, "Then it may just be your system that reacts like that." then I can say the same thing to you. Because not all computers are a like. So there is no way you can know how a software will effect someone else's PC.
So saying something is good for someone else may not be an actual fact. With the various system configurations in them, Computers have become equivalent to the Human body and can have serious reactions to a piece of software much in the way a Person has allergic reaction.

So don't just come out and say SF is good or that it is bad for someone else's PC. You don't know for sure and my original debate was that it was a DRM-RAT-RootKit which I feel I have just proven and when I said "Cyber Door and Remote Access" I was well awaer they both meant the same thing it is just not everyone is familiar with the term "Cyber Door".

I do not mean to be shroud, but your assumption could in effect Damage someone else's PC, the danger with SF is real and SF's reactions are sincerely lacking.

Never said that it´s totally harmless.

I don´t see it on my system.

Do you have a game installed that uses an online SF activation? As you probably know there are different flavours of SF.

What´s the remote address or listening port?

Have you ever noticed that it from time to time opens an unasked connection to a server on the Internet?

If you have noticed it, is it possible to block the traffic? Does a software firewall inform you that something tries to access the Internet or does it use "stealth methods"?

Have you noticed that something unusual is going on while SF is connected to the server, like lots of disk access or a certain amount of CPU usage?

Have you used something like the Sysinternal tools to find out which registry keys and files will be accessed while it is connected to the server?

Have you noticed anything else that can be seen as a hard fact that SF really adds a "cyber door" to your system and that it is potentially harmful or that it can be exploited by something else?

Okay,
the continuance of this thread can only serve to stir up conflict and debate. So I'll just go ahead and give my last reply.

I have never noticed the anomalies you described, personally on my computer. I will admit I have seen others that had those issues. Normally if a single program was sucking up a lot of CPU power it is either running some sort of scan on your computer or it is graphic intensive and at times though few in occasion these day as opposed to when it came out. It could be a variant of the lsasser.

Yes, it is possible to hide programs inside the SVCHost, windows XP is very different from the old 95 & 98 versions instead of a sort of management program that oversees all computer function and dictates it. Windows XP makes a computer into a virtual server, an always active virtual server unless your PC is turned off.

Several files must be running and if you use a portscanner you'll see a lot of programs connect to "0.0.0.0" which means they are running off of the computer. "127.0.0.1" is also an in-system server. now there are good points to this system and there are bad, foremost the Bad. With the OS operating as a server it requires several files to continuously run and connect outside of the computer. Instead of the old 98 Programs like runDLL and Kernal32 which HAD to be running in order for 98 to Run XP has about 20 services that need to be on ALL THE TIME. Anyone of those Drivers or Virtual Servers can be a serious security risk. Especially with the "REMOTE ACCESS Service." which is a BackDoor developed by Microsoft so they can have an IT access your machine for Technical Support but at least it is allowed to be Disabled unlike some other Services..

" Services.msc " will list the running services.

I Do not have any other games that have SF

Yes, it is possible for a driver or program to run Secretly. If it Registers itself as a service it can run under the SVCHost which is a program that Loads and Manages all DLLs that the computer calls to run.

RegEdit will allow you to see the registry changes.


My closing statement,
I'm not saying, SF /Will/ Harm someones Computer and I'm not saying it /Will NoT/ I am saying it /DID/ damage my old Win98 OS and it /Does/ run as a Device to avoid certain Anti-Malware Scanners and does Install Hidden Drivers so that it can run Independently from the USER and both access and configure certain media operation without giving you the power to choose what and where.

I don't believe in the SF Virus even though I'm rather certain SF Damaged my old machine but I Do Believe it is Malware and a Rk to be specific. I respect your position in this debate
Gizzmoe in theat you're trying to ease the Paranoia that spreads about using SF, however in this instance I must point out that there is a risk when using SF, there is a risk when installing and using any kind of software.

So people, just acknowledge StarForce has a risk and was intended to prevent the copying of the product it was licensed to protect, that its overall goal, it is to /PREVENT/ you from doing something with the software you purchased and it accomplishes this through questionable means. That is not to say it /WILL/ harm your computer, but that it /CAN/ .

Just don't PANIC! I'm tired of these threads all over the NET About. "The StarForce Virus!" or "StarForce has been proven Safe!" both are wrong, because no one can predict how a piece of software can effect one machine from another.

Good Defense, Gizzmoe.
I think we should save our debates for more productive discussions though.

Excellent posts and info Mustang. :up: I'd like your permission to quote you in another forum if you don't mind.

And to add. to ... No one can say and prove it's totally benign either.

Some say prove it's hurt your computer... I say you prove to me that it doesn't and won't. You can't just like I can't prove it to you without you physically looking at our computers. So it looks to be a stalemate. There has to be trust in what's been found that SF does. No one is yanking anyones crank on that fact. And if they are, they're only hurting themselves.

If it's not hurting your computer now, fine and we're happy for anyone that it's not. But remember, it can in the future when you least expect it. That's what has happened to mine and others.

*coughs* Gizzmoe said that *cough*

I appreciate your commentary GT and I think our point has been made and we can lay this thread to rest.

No, please, let us have another round of this. One of my African Violets had to be thown out last week. I think Starforce was responsible.

LOL sorry about that Mustang... It's corrected.

No, this will never be laid to rest until something comes of it. Whether there's an amicable solution or not. There is genuine concern over the StarForce issues and can't be passed over lightly as some would like.

Takeda Shingen, glad you think it's funny. Wait until you have problems and then we can laugh at you. ;)

Please, GT182, it is over-the-top statements like that which hurt your little crusade. I had simpathy for you until one of your fellow crusaders labeled DVD drive failure a 'personal tragedy'. A family member dying is a personal tragedy. Losing your job is a personal tragedy. Being stricken with cancer is a personal tragedy. Computer failure is an inconvience.

The opponents of Starforce hold such an attitude of self-righteousness that, truthfully, it is hard to keep a straight face while reading this thread. Don't worry, though: As soon as I have problems, you'll be the first person I notify.

It could very well be StarForce! :P
Did you hear they also order people's computers to murder the owners first born sons in sacrifice to the Computer god (Master Computer) from TRON.

The problem is real, but as you said. there is no way to predict who it will happen to, how or even why. Computer Systems are too diverse, its like guessing who will catch a cold next. To simply warn people should be sufficient. whether they listen or not is not your responsibility. I can understand if it happened to you, how you want to ensure it happens to noone else. But put simply, you can't. And discussions like these that linger on and on look more like hoaxes.

If you want to help people educate them. You can tell them about what happened to you, but don't press the issue, don't try to make them fear that it /MIGHT/ happen to them.

so essentialy starforce says starforce is ok, noone else excpet for drebble and gizmoe believe them.


no version of starforce will ever make its way onto my new PC, regardless of how good the makers say it is.

I wrote Mark after reading this article asking him what company asked him to check out Starforce. For as far as I know I was the first to contact Mark. But my contact had nothing to do with checking for rootkits etc. I wanted him to check on what the driver is actually doing.

And Mark never did answer my specific questions.
He only referred me to the thread on his blog.

After several emails Mark Responded. "I haven't looked into it any further" So I left him alone.

Here are the original emails the first one is edited to protect names and certain people who did not want their indentity revealed.


--------------------------------------------------------------------------------
From: Larry
Sent: Friday, November 18, 2005 12:19 PM
To: Mark Russinovich
Subject: Starforce....
Importance: High


Hello Mark,
I was wondering if you would possibly be able to help in this matter. When I saw the deal with Sony...Many of us fellow gamers related this ordeal with the same problem we are seeing with Starforce copy protection. I have been posting links to your web site as well as stories from cnet etc about Sony on the Ubi forums as well as Subsim.com forums. Everyone has thanked me for these posts and ask that I personally thank you! So Thank you!

First off I want to tell you that I'm no hacker and I have no Alcohol 120 or daemon tools on my computer nor have I ever used these programs.
I tell you this as many of us gamers are being accused by Starforce of having these tools on our PC. They make up any excuse they can and when they can't seem to find out what's wrong they leave you hanging.

The details I have are lengthy and I don't want to bore you to death. But I would like to share what has been happening with all of this briefly. And I was actually seeking your help too.

I am (edited) that loves computer gaming...and have been working with Ubisoft (edited) My Plextor writer stopped working after installing Silent Hunter III. It contains Starforce. Also, I discovered Starforce installs drivers in the hidden area of device manager. Many of us have read the EULA and can't find a mention of Starforce being installed anywhere. I think this is wrong. Yet Starforce people have posted that the EULA covers them.

I have collected many incidents from Ubisoft game owners. I have admissions from Ubisoft that Starforce has problems. (from their tech support) (edited)

Starforce wrote an article in response to Aaron McKenna's article http://www.tgdaily.com/2005/10/01/th..._game_pirates/ that basically called all of us with problems "beginner level Hackers" I take offense to that as do many others. Here's Starforce's response: http://www.star-force.com/protection...l?c=256&id=658 Very unprofessional!
I did post Aaron's email to Dennis of Starforce on the UBI forum with Aaron's permission. Aaron has been affected with Starforce problems too as well as his associates. I spoke for 2 hours with Aaron on the phone from Ireland. I actually live in Iowa here in the states.

Starforce is based out of Russia...they lock posts on their web site for no reason and delete them shortly there after. They have helped some but most remain with no help whatsoever. The copy protection in some cases like mine made the cdrw drive have a complete drive failure. Plextor after getting my drive said they couldn't figure out why it died. Only had 16 burns on it and was never used to load or play games with.

It seemed a mystery to me what was going on at first and never thought of a game doing this. I don't install programs as freely as some.. So this game was the first install I did for about 5 months. So I knew where to look, although I didn't use my plextor drive until about a month after the game was installed, to burn our 25th wedding anniversary pics. That's when the trouble started. Although I did have events happening in event viewer in XP stating timeout errors on that drive after the install of the game I never thought of the game as the factor in this. As well as strange high spins for long periods of time upon boot up coming from the cdrw drive ! This seems to be a common description from others too. As well as games playing choppy after Starforce is installed. Not just the game with it on it ,but all others. I had that experience with Battlefield 1942 after installing Silent Hunter III. All these things led me to calling Ubisoft and going to the forums, only to discover I wasn't alone.


So if there is any more info you need or anything you can do to assist. I would appreciate it. Ubi techs don't have a clue on the protection they admitted that...that's why its vital I have someone techy that can assist.

Aaron has asked his associates at Toms Hardware lab also..But so far Aarron says...no word from them.

Another forum post one of many you may find interesting although it's long and can't expect you to read it. Aaron's personal email is on the first page half way down.
I'm Soulcommander in the forum.
http://forums.ubi.com/groupee/forums...2091013073/p/1

Thank you!!!


Larry



----- Original Message -----
From: Mark Russinovich
To: Larry
Sent: Saturday, November 19, 2005 8:10 AM
Subject: RE: Starforce....



Hi Larry,

Thanks for bringing this to my attention. I'll buy a copy of SilentHunder III and take a look. I'll let you know what I find.

Thanks for the feedback also.

-Mark




--------------------------------------------------------------------------------
From: Larry
Sent: Friday, December 09, 2005 7:54 PM
To: Mark Russinovich
Subject: Re: Starforce....


Hi Again Mark,
One of the gentleman that is in our Starforce Investigation group with Ubisoft pointed out this article Starforce put out:

http://www.star-force.com/protection.phtml?c=261&id=707

Want to go to Russia? And win $1,000 Of course you have to prove it to them. I think this is a joke myself....But wanted you to see it. I'm going to show Aaron McKenna from Toms Hardware as well.

Any news for me yet?

Thank you kindly,
Larry





----- Original Message -----
From: Mark Russinovich
To: 'Larry
Sent: Thursday, December 22, 2005 9:59 AM
Subject: RE: Starforce


Yes, here's my answer:

-------------------------------


Hi Larry,

I did take a look and commented here: http://www.sysinternals.com/Forum/fo...3&KW=starforce

-Mark










--------------------------------------------------------------------------------
From: Larry
Sent: Thursday, December 22, 2005 10:26 AM
To: Mark Russinovich
Subject: Re: Starforce


Hello Mark, thanks for the reply.
So the questions I asked:
Just curious as I have been getting lots of questions directed my way as if you actually disassembled the Starforce drivers, what you thought about the EULA with the game and if you tested with many combinations of hardware involving cdrw or combo drives with burning software installed and tried?
I want to know if you can share with us all what testing you conducted.

So from your response I will assume you have no further comment on what you actually did to come to your conclusion.Please don't feel I am bullying you. People that have been affected, including myself have been posting and emailing exactly how complete your tests were. I have directed them to your blog entry and I guess they were hoping for a little more detail.
If I don't hear from you again, I will deliver your message you sent to me twice now (Your Blog entry).

Thank you for your time,

Larry




From: "Mark Russinovich"
To: "'Larry
Subject: RE: Starforce
Date: Thu, 22 Dec 2005 10:52:45 -0600


I haven't looked at it any further.




There u have it folks....So again I wrote Mark to ask what game magazine asked him to do more testings. I would like to find out once again if he tested only for rootkit involvement and nothing more.

This article posted proves nothing except that there is no rootkit involvement... It still does not answer our questions on other matters.

I for one remain Starforce free!

Well here's what happened. I couldn't copy a DVD I had made from my camcorder. Nothing copyrighted or needing to be copy protected mind you. My burner would start the process but would not finish the burn at all. I ruined 10 dvds trying. Nothing wrong with the DVD ROM or DVD burner and all the firmware is up to date. As soon as I got rid of StarForce all is well and I can copy that dvd all I want. Now this was just this past November, after running SHIII since it came this past year. I built this computer one year ago this month with all new hardware and software. It ran perfectly after changing a bad ATA HDD over an SATA HDD. So it's run with no problems for 11 months but all of a sudden acts up in the one place StarForce will cause problems. Seems strange and a bit fishy.... did to me for a bit until all the StarForce controvercy really got going.

At least I could play SHIII where others couldn't right from the start. What others were telling me I thought was a joke for awhile, it couldn't possible happen. A friend really got looking into it and found a few things that made me think twice on how I took his and their complaints. He doesn't lie about his troubles with SHIII, just as he wouldn't if you took your computer to him for repairs. He's gotten nothing but a run around from the places he's asked for help and has been laugh at by them too. Just as some here laugh. He lost a perfectly good dvd drive in the process. I was lucky and didn't, as my problem was solved by removing StarForce.

Now you know why I won't let this die. If one person listens and gets one other to listen and they in turn keep passing it on and on, then I've done what I've set out to do.


Takeda, I'm serious, don't laugh or make lite at what I and others have to say, and I won't laugh back when a problem arises from StarForce. If you never have a problem with StarForce, great..... you're a lucky one out of the many that aren't. Just hope you never do have a problem either.... it's no joke. No not life threatening by any means, but still not something anyone wants to happen. Especially with the amount of money a computer can cost, even ones we build ourselves and are proud of. I sure don't want to lose the 2 grand I've put into mine.

Are you now even suggesting that SF is capable of destroying your entire PC? :hmm:

Well don't take it too harshly when I tell you I don't feel for your loss. A friend of yours lost a DVD Drive and you lost your burn capabilities, temporarily I might add...

Well my friend that's tough.

But before you go on a cruade such as this I would ask that you consider, I have had to do a complete reinstall of my OS, and throw out a perfectly good Redundant Array of Independent (or Inexpensive) Disk because StarForce ceased the Idle Spin and ruined several sectors including the part with the MBR(Master boot Record) I attribute this to StarForce's software based on looking at the RAID Drive's Log and found Cease\Term Sig:StarForce Enviroment Protection Driver. I have since replaced the effected parts(not cheap) and moved on with my life.

Ocassionally letting others know of the problem I had with it.


So I say to you /AGAIN/ before you continue this Crusade of yours. consider, your problem was minor compared to my own and note that you don't see me telling everyone to BEWARE! I know tons of people who never had a problem and several who have had similar to the problems you describe. A Total problem such as what I expierianced, well... I have yet to meet someone who shares it.
Which means its a slim chance and perhaps more related to my system config then with just StarForce.

The issue about StarForce containing rootkits is moot, because in my opinion StarForce in itself is a DRM>*edit: It's late.

Re: StarForce has been checked. No root-kits found
 

It really dies depend on what your classification of Malware is?


The laughable thing is that we have already stepped away from the rootkit association because it does not hide itself, it is their if you know where to look.

However we have quite clearly stated.

1. DMA step down. & occassionally Hardware failure.
2. Incompatibilities with SCSI and SATA
3. Ring 0 access given to Ring 3 level programs.
4. Code 41 errors (This creates the illusion of hardware failure). An illusion that is so good that Ubisoft/Starforce and even drive manufacturers did not know how to cure it. (Guess who cured it? :lol: :up: )

As usual they are ignoring the actual facts. Just to update Russinovich did just do a preliminary check on SF (As in rootkit, nothing else), he has not touched it since. As you can read in a previous post in this thread, Soulcommander has been chatting with him and ask him check it out properly.

Me thinks that is a bit of constructive reporting in that article. :down:

time to End this!
 

Okay here's how to make this thread
Kaput!

This thread has not been replied to by the following,
The Avon Lady(The Voice of Reason)
Bill Nichols(SubSim's Intelligence Officer)

So its either,
A) A waste of time.
B) Pointless(Edit* Pointless as in a debate with no possible ending. Except lock)
or
C) More Potentially Dangerous then actually Dangerous.

I say,
D) All of the above.

E) none of the above :lol:

There is NO E!
There is no Spoon!

SF itself cannot destroy your entire PC, it does however open Ring 0 (System wide access) to Ring 3 (user level programs).

To be more accurate and I have openly set a challenged to Starforce Technologies to come to NGH headquarters in the UK and prove otherwise.

SF is a Trojan Gateway. (Was this intentional? well we have no evidence of that, however it is very irresponsible of them not to close this massive security hole).

Can 3rd party malware, Viri etc use the hole left open by SF to destroy your computer?

Well let me give you an example what Ring 0 access gives you control of.

The Entire OS. HDD firmware, System Bios, GFX card Firmware, Router/ADSL/DSL modems and firmware, CD/DVD firmware.

Then I will ask do you think damage can be done to your hardware?

Without intentionally scaremongering there are over 5000 types of malware setup to exploit Ring 0 access of which over 1000 will physically destroy hardware, that is why Microsoft spent some much money and time closing it in the first place.

btw that affects Win 2000 through to XP.

responsible coders know not to use undocumented IDE register calls in a Virtual IDE driver. Purely because of incompatibility problems and because of the Security Issues that Ring 0 access creates.


In case you are wondering I have called Starforce a "Trojan Gateway" Directly to Starforce Technologies.

Am I being sued for such a slanderous comment on the net?

Well quite simply no! as that is exactly what Starforces IDE protection driver is. So they actually have not case for litigation.