StarForce has been checked. No root-kits found

[SUBMAN1]

Originally Posted by The Old Man

I got this game late so I am a little behind on what's going on but I have already reinstalled it once after reformating my hard drive. If it's my understanding it's gonna harm my system????????????
"Everything's ruining fine" but if it is going to be messing my system up then it's gonna be collecting dust.
Roy

Probably a better way to put it - yes it can harm your system, kill your optical drives, and grant a trojan or virus Level 0 access so that it has the ability to Flash your BIOS and completely destroy your system, including flashing your drives. Sound like a nice program yet? Oh, the developers are from Russia too - outside of our laws.

-S

[bradclark1]

Originally Posted by Skybird

I would have thought if this were true it would make CNET, PCWorld, etc news sites as a headliner.

[SUBMAN1]

Originally Posted by bradclark1

I would have thought if this were true it would make CNET, PCWorld, etc news sites as a headliner.

I don't think anyone has made a big deal about it just yet is all. Like who is StarForce to the Joe Public? No One. Now if it were Sony....

-S

[Wim Libaers]

Originally Posted by bradclark1

I would have thought if this were true it would make CNET, PCWorld, etc news sites as a headliner.

It is perhaps a bit less important than it might seem, because most Windows users work with administrator privileges (because a lot of programs just expect to have that and will not work properly from other accounts), which means any trojan that gets user level also gets an opportunity to install drivers, which means it can get ring 0 acces after a reboot. That is, for most people, the only difference: does the trojan get ring 0 right now, or only after you reboot.

It is more significant if you are working as a nonprivileged user or if you have security software that warns you about unauthorized driver installs.



For the right to make a backup, a lot of countries allow making backups for personal use. However, as fas as I know the manufacturer of the media is not obliged to make it easy or convenient for you to do so. And there even has been legislation introduced in the US and EU to ban technology that allows circumvention of copy protection. So, even if you have the right to make a backup, it's prohibited to have a device capable of doing that.



Also, we shouldn't be too worried about this specific copy protection. After all, this one is known well enough that there will be a lot of noise about it when some game uses it, perhaps until the government not only criminalizes circumvention of copy protection, but also talking about copy protection. So do not pre-order games if there is uncertainty, and do not buy any SF-protected games. Problem solved. Sure, you may have to avoid a game that you'd like to play (in my case, SH3), but that's no real disaster, merely inconvenient.

A bigger problem is copy protection in general, copyright, and intellectual property in general. Copy protection, because it restricts what the customer can do with the property he bought, and demonstrates clearly the disrespect companies have for customers (or consumers, as they prefer to call us). Intellectual property in general is a problem too. From an utilitarian point of view, because what once started to promote new and innovative work is becoming more one-sided, and even becoming a way to outlaw competition for some companies. And one can also object to it because intellectual properties infringe on physical property rights.

For those who'd like to read a bit more about this, have a look at the links here:
http://blog.mises.org/archives/001771.asp
Especially "Against Intellectual Property", which discusses many aspects of the problem.

[Mustang]

Please correct me if I'm wrong.
However, isn't StarForce in itself a RootKit or more familurely a RAT.

It installs several drivers and registry entries that,

1. Control the way in which the HardWare in your system is run which can be harmful to HardWare.

2. Block you out from making any changes to it so that /YOU/ can configure it for use on /YOUR/ machine. Which is bad considering not all machines are the same.

3. Adds Cyber Doors for the collection of information on your machine and for product support by SF Technicians.

4. Assaults or Blocks any copying media even if you are legitimately copying something you yourself have made.

5. Disables CD\RW Drives\Software,etc.

As I stated above not all systems are the same, but having had SF since SH3 I myself have dealt with SF and can say all in my list applies for the copy I had and the effects on my machine.

But still, even if not all I listed is true for the updated versions of today. Starforce is still a RootKit software because against your authority, it controls certain parts of your computer and does not let you configure it.

RATs are the IT term for such a program, they are used by hackers for remote control of an infected PC, often hiding under the guise of a new HardWare device much like SF does.

[Gizzmoe]

Originally Posted by Wim Libaers

It is perhaps a bit less important than it might seem, because most Windows users work with administrator privileges (because a lot of programs just expect to have that and will not work properly from other accounts), which means any trojan that gets user level also gets an opportunity to install drivers, which means it can get ring 0 acces after a reboot. That is, for most people, the only difference: does the trojan get ring 0 right now, or only after you reboot.

Absolutely right! I´ve always said that in such an environment a virus doesn´t need SF to harm your system, but it seems that many people here still are paranoid about it.

[Gizzmoe]

Originally Posted by Mustang

3. Adds Cyber Doors for the collection of information on your machine and for product support by SF Technicians.

It doesn´t add "cyber doors"! SF can send out technical informations if you tell it to do so and there´s nothing wrong about this.

RATs are the IT term for such a program, they are used by hackers for remote control of an infected PC, often hiding under the guise of a new HardWare device much like SF does.

Quite a few things only show up in the Non-PNP driver list, like the SafeDisk copy protection, VMWare, Nero´s ElbyCDIO driver and many other drivers. It´s all perfectly normal!

[Mustang]

It doesn´t add "cyber doors"! SF can send out technical informations if you tell it to do so and there´s nothing wrong about this.

It adds remote access to your computer so it can obtain information without allowing you to set the means or manner in which it sends the report. That is like your flatmate busting a hole in the wall into your room and saying, "If you need to tell me anything, talk through this hole." without you having any say in the matter.

Quite a few things only show up in the Non-PNP driver list, like the SafeDisk copy protection, VMWare, Nero´s ElbyCDIO driver and many other drivers. It´s all perfectly normal!

Yes other commercial software does sometimes put itself in that list but there is a large difference between them and SF.
The ones you mentioned, if purchased in material form rather then electronic. have documentation to tell you about those settings, in case the program has any problems so that you can troubleshoot.

StarFoce does not, they add this software and control devices against your will and before it became widely known, without your knowledge as well.

StarForce adds new software and configures existing software without prompting you or allowing you any choice in the matter except to not use the product you purchased that unfortunately came with it. It has caused countless issues with system stability including my own. It added itself to my Win 98 system when I installed SH3 and had a conflict with my Win 98 RAID Drivers forcing me to do a complete overhaul of my win 98 system and purchase XP. True, 98 is obsolete and I would have had to buy XP sometime but I had not expected it to be so soon.

As of yet however, StarForce does not effect my XP system's performance except that it disabled my alcohol 120% and refuses to recognize my LG CD\RW. When before reinstalling SH3 on my new system both worked fine. I had hopes that SF had more compatibility with XP then 98 so I chanced it and now regret it.

[Gizzmoe]

Originally Posted by Mustang

It adds remote access to your computer so it can obtain information without allowing you to set the means or manner in which it sends the report.

You write that SF adds cyber doors and remote access to our computers. Do you have any proof for that? At the moment I think you don´t really know what you are talking about and that you simply confuse terms. Or maybe I just don´t get what you are trying to say...

StarForce adds new software and configures existing software without prompting you or allowing you any choice in the matter except to not use the product you purchased that unfortunately came with it.

It is not the responsibilty of Starforce to inform you about their copy protection, the publisher alone is responsible for that. You absolutely cannot blame Starforce that a game installer or whatever doesn´t inform the customer about what gets installed.

StarForce does not effect my XP system's performance except that it disabled my alcohol 120% and refuses to recognize my LG CD\RW. I had hopes that SF had more compatibility with XP then 98 so I chanced it and now regret it.

Have you tried the SF driver update?

[joea]

This is not only tiresome but becoming a witchhunt against people like myself who have no problems, agree SF might be a problem and disagree with its premise, yet still have SH3 and play it. So all of you guys with banners, have you uninstalled SH3? Even you SH3 modders?

[bradclark1]

I had to think hard about this (That's the burning smell) but I think about the time I put SHIII on my box that I could burn a cd but the files were unreadable. Hadn't paid attention to the SF saga untill sometime later. My son had Easy CD Creator from Roxio for his Dell so I loaded that up and haven't had a problem burning since. So you just need something to override SF.

[Mustang]

Originally Posted by Gizzmoe

You write that SF adds cyber doors and remote access to our computers. Do you have any proof for that? At the moment I think you don´t really know what you are talking about and that you simply confuse terms. Or maybe I just don´t get what you are trying to say...

I found that quite offensive. And at the moment I believe your assumptions may cause harm to yourself and with your unfounded assurances that SF is of no Danger, it may harm others as well.

Now I abhor conflict however, I will let you know how and why I come to these conclusions. See if you can keep up, as some of this is quite technical.

This is for the Windows XP OS's only.

1. Run SH3.
2. Alt+Tab or use whatever functions your OS allows you to minimize the game with.
3. Go to Star>Run, type into the Command Prompt. "tasklist /svc" without the quotes, you should see several services running under the CVS index including the illegal entry of Starforce Environment Driver, StarForce Protection Helper Driver and StarForce Synchronization Driver. If you do not see them. Well as I said, "Not all machines are the same."

4. type into the command prompt, "netstat -a" active connection will include a connection to 'SF Protection' it should be listed as "Listening."

5. type into command prompt, "netstat -b" to see all connections if SF was not listed as Active then it should be listed in here.

Still not convinced?

Right click, "My Computer." click "Properties." go to "Hardware" then "Device Manager". Now click "View" then "Show Hidden Devices" now go to "Non-Plug and Play Drivers" and you should see the same ones I listed in step 3. Right click anyone of them and click "Properties." then click "Driver" and you should see each SF Driver is listed as a "Windows Service" which means it is an Active connection and has permission to do whatever it wants under the SVCHost operation it also work on Boot. As is true that some Windows Services are directly connected with Microsoft. it is the same with the SF Drivers, that I mentioned. Now there may be legitimate reason for adding them in this manner but the point is, they did it without the user's permission and without allowing them to edit it.

If you saw none of what I mentioned then please, REMEMBER. "Not All Computer Systems Are The Same." and if you tell me, "Then it may just be your system that reacts like that." then I can say the same thing to you. Because not all computers are a like. So there is no way you can know how a software will effect someone else's PC.
So saying something is good for someone else may not be an actual fact. With the various system configurations in them, Computers have become equivalent to the Human body and can have serious reactions to a piece of software much in the way a Person has allergic reaction.

So don't just come out and say SF is good or that it is bad for someone else's PC. You don't know for sure and my original debate was that it was a DRM-RAT-RootKit which I feel I have just proven and when I said "Cyber Door and Remote Access" I was well awaer they both meant the same thing it is just not everyone is familiar with the term "Cyber Door".

I do not mean to be shroud, but your assumption could in effect Damage someone else's PC, the danger with SF is real and SF's reactions are sincerely lacking.

[Gizzmoe]

Originally Posted by Mustang

with your unfounded assurances that SF is of no Danger, it may harm others as well.

Never said that it´s totally harmless.

4. type into the command prompt, "netstat -a" active connection will include a connection to 'SF Protection' it should be listed as "Listening."

5. type into command prompt, "netstat -b" to see all connections if SF was not listed as Active then it should be listed in here.

I don´t see it on my system.

Do you have a game installed that uses an online SF activation? As you probably know there are different flavours of SF.

What´s the remote address or listening port?

Have you ever noticed that it from time to time opens an unasked connection to a server on the Internet?

If you have noticed it, is it possible to block the traffic? Does a software firewall inform you that something tries to access the Internet or does it use "stealth methods"?

Have you noticed that something unusual is going on while SF is connected to the server, like lots of disk access or a certain amount of CPU usage?

Have you used something like the Sysinternal tools to find out which registry keys and files will be accessed while it is connected to the server?

Have you noticed anything else that can be seen as a hard fact that SF really adds a "cyber door" to your system and that it is potentially harmful or that it can be exploited by something else?

[Mustang]

Originally Posted by Gizzmoe

Never said that it´s totally harmless.

I don´t see it on my system.

Do you have a game installed that uses an online SF activation? As you probably know there are different flavours of SF.

What´s the remote address or listening port?

Have you ever noticed that it from time to time opens an unasked connection to a server on the Internet?

If you have noticed it, is it possible to block the traffic? Does a software firewall inform you that something tries to access the Internet or does it use "stealth methods"?

Have you noticed that something unusual is going on while SF is connected to the server, like lots of disk access or a certain amount of CPU usage?

Have you used something like the Sysinternal tools to find out which registry keys and files will be accessed while it is connected to the server?

Have you noticed anything else that can be seen as a hard fact that SF really adds a "cyber door" to your system and that it is potentially harmful or that it can be exploited by something else?

Okay,
the continuance of this thread can only serve to stir up conflict and debate. So I'll just go ahead and give my last reply.

I have never noticed the anomalies you described, personally on my computer. I will admit I have seen others that had those issues. Normally if a single program was sucking up a lot of CPU power it is either running some sort of scan on your computer or it is graphic intensive and at times though few in occasion these day as opposed to when it came out. It could be a variant of the lsasser.

Yes, it is possible to hide programs inside the SVCHost, windows XP is very different from the old 95 & 98 versions instead of a sort of management program that oversees all computer function and dictates it. Windows XP makes a computer into a virtual server, an always active virtual server unless your PC is turned off.

Several files must be running and if you use a portscanner you'll see a lot of programs connect to "0.0.0.0" which means they are running off of the computer. "127.0.0.1" is also an in-system server. now there are good points to this system and there are bad, foremost the Bad. With the OS operating as a server it requires several files to continuously run and connect outside of the computer. Instead of the old 98 Programs like runDLL and Kernal32 which HAD to be running in order for 98 to Run XP has about 20 services that need to be on ALL THE TIME. Anyone of those Drivers or Virtual Servers can be a serious security risk. Especially with the "REMOTE ACCESS Service." which is a BackDoor developed by Microsoft so they can have an IT access your machine for Technical Support but at least it is allowed to be Disabled unlike some other Services..

" Services.msc " will list the running services.

I Do not have any other games that have SF

Yes, it is possible for a driver or program to run Secretly. If it Registers itself as a service it can run under the SVCHost which is a program that Loads and Manages all DLLs that the computer calls to run.

RegEdit will allow you to see the registry changes.


My closing statement,
I'm not saying, SF /Will/ Harm someones Computer and I'm not saying it /Will NoT/ I am saying it /DID/ damage my old Win98 OS and it /Does/ run as a Device to avoid certain Anti-Malware Scanners and does Install Hidden Drivers so that it can run Independently from the USER and both access and configure certain media operation without giving you the power to choose what and where.

I don't believe in the SF Virus even though I'm rather certain SF Damaged my old machine but I Do Believe it is Malware and a Rk to be specific. I respect your position in this debate
Gizzmoe in theat you're trying to ease the Paranoia that spreads about using SF, however in this instance I must point out that there is a risk when using SF, there is a risk when installing and using any kind of software.

So people, just acknowledge StarForce has a risk and was intended to prevent the copying of the product it was licensed to protect, that its overall goal, it is to /PREVENT/ you from doing something with the software you purchased and it accomplishes this through questionable means. That is not to say it /WILL/ harm your computer, but that it /CAN/ .

Just don't PANIC! I'm tired of these threads all over the NET About. "The StarForce Virus!" or "StarForce has been proven Safe!" both are wrong, because no one can predict how a piece of software can effect one machine from another.

Good Defense, Gizzmoe.
I think we should save our debates for more productive discussions though.

[GT182]

Excellent posts and info Mustang. I'd like your permission to quote you in another forum if you don't mind.

And to add. to ...

by Gizzmoe - Never said that it´s totally harmless.

No one can say and prove it's totally benign either.

Some say prove it's hurt your computer... I say you prove to me that it doesn't and won't. You can't just like I can't prove it to you without you physically looking at our computers. So it looks to be a stalemate. There has to be trust in what's been found that SF does. No one is yanking anyones crank on that fact. And if they are, they're only hurting themselves.

If it's not hurting your computer now, fine and we're happy for anyone that it's not. But remember, it can in the future when you least expect it. That's what has happened to mine and others.