NOD32 + Latest Starforce "Driver"

Unfortunately it takes more than circumstantial evidence, which is what you've shown is. I've had drives die just like you stated without ever having StarForce protected games installed. A family member's computer recently died in the same way, even ended up taking out all the drives in the chain, from a brand new drive that had only been used about once before.. but that system was never once used for any games. To the contrary, my system has had several StarForce games installed, and I've not had a single related problem.

If there's a problem, then yes it needs to be fixed. If someone can actually replicate any problems then I'd be happy to try to replicate it myself and even work with them to get it fixed, but so far there's nothing that could be reproduced. I'm sure software has bugs, as does all software, but that's not the same thing.. and doesn't make it a rootkit that NOD32 should remove, which is what this thread is about.

 

A few comments:

@ midfingr - Do you expect a commercial package to treat other commercial applications/drivers as malware? These are valid components which act as a protective measure implemented by the vendor of a commercial game. For this reason, I would say no, I would not expect a commercial AV to flag it as malware.

Please note, this is very distinct from the question of whether you feel these measures should implemented commercially, it's clear you don't.

The fact of the matter is that these components are installed by a game and a simple consideration of commercial liability issues should give any commercial vendor pause before actively removing them since that would cause the primary program - the game - to fail to function. That action is very different from StarForce providing a tool which any user can employ to remove the SF driver, with the full knowledge that the game it is associated with will no longer work.

The fact that other packages flag them could be effectively a false positive in the sense of flagging on specific types of system actions. Is this the case? I have no idea whether it is through that mode or via an explicit signature.

@13thHouR - While my general belief is that there are a number of serious questions regarding the stability of the SF protection measures in a heterogeneous hardware base, my personal assessment is that you severely overreach in implicating some behaviors as caused by the SF drivers.

@ Soulcommander - The comments you make are worthwhile.

I don't necessarily expect a detailed technical assessment - simple observations of "this is what I did and what I saw" are fine, and that is what you have now provided. Does it unambiguously prove your main point - not necessarily, but I certainly would not dismiss it. If I were on the other side of the discussion, the StarForce side, I would want as many technical details as possible to try to replicate the situation in a controlled setting. You've provided enough details here - specific game, specific system behaviors, CD vendor - to give anyone a reasonable start. As already noted above by Notok, this type of evidence is circumstantial. However, I would clearly agree with your likely rejoinder that a large body of circumstantial evidence would suggest that there is fire along with the smoke. This is all I requested, and you have provided these comments without the emotional baggage that I've seen in most of this discussion.

@ All - For the record, my early years working with PC's were during the time when many large companies used primitive disc copy protection schemes. They fell into disuse for a number of reasons, not the least of which was consumer pressure. Like most users of that time, I thought that removal of those measures was a good thing.

Fast forward to today. Analogous approaches are used in some gaming packages. I simply view this as a replay of past times, and I assume that it will play out to a similar result.

I am not a fan of these measures. By the same token, am I not a fan of unproductive and emotionally laden rants against them.

Blue

 

Hey Blue, you is an immoderately excellent moderator!!! Illegitimi non carborundum.

 

OK i have had an issue with starforce that was bundled on a game called "brothers in arms earned in blood" read about it here>>> http://forums.ubi.com/groupee/forums/a/tpc/f/7961032962/m/1121067124 it took 2 weeks to get a response from ubi-soft about this issue but the response i got basically mocked me as they accepted no responsibility for any support as they state in the email on that forum they also directed my to that competition which by this time had been closed for two months. they then banned my for being disruptive by posting comments that they made! surly people should be aware of how they will be treated when they encounter any starforce issues?

this is the error i get when i try to access the ubi-soft forums:

-- Account Suspended: Your account has been suspended for the following reason:

Disruptive posting. You've been asked to take your starforce concerns up with starforce. Spamming the forums with the complete history of your exchange between Ubi and yourself is not helping any. Tully

======================================================================================

the errors i get are code 7 errors and severe slow down of my dvd drive which escalated to my dvd not being able to read dvds causing power dvd to become none responsive with the latest version of starforce but the code 7 errors still remain. Without starforce on my system i have no issues what so ever!
link to error jpeg>> http://i7.photobucket.com/albums/y278/pigfister/ERROR.jpg

i posted on the starforce forums and first they directed my to a microsoft support page for device manager errors which as you can clearly see from the print screen was not the error i got as it was an "event manager" error, all they then told me to do was to uninstall my ide drives and reboot my pc, this did not fix the issues so i was adding allsorts of useful information in the starforce forums to help them fix this issue so i can play the games i own without having conflicts with the rest of my system. i posted hex data dxdiag, msinfo32 print screens so everyone could see how little was on my pc, virtually a bare system short of some microsoft/macromedia tools for work and a few games but my forums were quickly deleted and my ip was banned. i managed to access my starforce forums account from a different location and a pm i got from them basically said
"not our fault" >>> http://i7.photobucket.com/albums/y278/pigfister/pm_sf_administrators.jpg

DOES ANYONY KNOW IF STARFORCE DRIVERS ARE WINDOWS CERTIFIED AS STARFORCE REFUES TO ANSWER THIS?

so now i am left in limbo as starforce refuse to reply to me ubi-soft refuse to reply to me, i can reproduce errors with starforce on my system but my posts are deleted as are plenty of others over at the starforce help forums >>> http://www.star-force.com/forum/index.php?showforum=13

btw the starforce removal tool leaves plenty of entries left behind in the registry. >>
http://i7.photobucket.com/albums/y278/pigfister/reg2.jpg

http://i7.photobucket.com/albums/y278/pigfister/reg1.jpg

 

pigfister,

While I don't doubt you have had the problems you describe, you must understand that the frenzied hysteria of the majority of posts over at the StarForce forums will have consequences for all. When StarForce are bombarded with the nonsense they have been, it is human nature to put up the shutters, and even those who have genuine issues and present them in a respectful manner will suffer as a result. Your banning from the two forums you mention is a matter between you and the forums' moderators.

One technical note, however ... you report that some registry entries are left behind by StarForce's removal utility. Those you show are completely harmless, and are examples of standard 'legacy' entries that Windows itself creates in the system registry whenever a driver is uninstalled and its active registry entries are deleted. To cite these as a criticism of StarForce, therefore, is wholly invalid.

It is crucial to ensure that technical details are correct and relevant if those who would like to see the StarForce software improved (or eliminated, as most detractors are trying to achieve) expect to be taken seriously. Sadly, there are many who fail to appreciate this - including some who have posted here - and all they will achieve is to discredit themselves.

 

unfortunately i am just an average computer user and know little diagnostic procedures so i am blind as to what goes on inside my pc but i know the issues i have experienced so if there are anomalies in my technical knowledge that is because i have none! my posts on the starforce forum were one of the most civil there, with only 2 posts from other users who stopped posting on my request so the reason for delete would have been either the mods or my posts. i started by contacting customer support from both companies then used the forums when i got ignored. i have been basicly told to shove off and stop complaining what sort of support is that?

 

I sympathise but, although I realise it will be of no comfort to you, it is the fault of the self-serving fools and technically challenged zealots that have created this atmosphere of hysteria, mistrust and misinformation that makes it impossible for anyone to operate reasonably and cooperatively over this issue.

 

It is certainly true to say that StarForce's CD-protection drivers are undesireable for almost all users - while most software provides a function, these aim to disable other software (e.g. CD-emulators) and will in some cases, disable access to hardware also (e.g. the blocking of all SCSI CD-ROMs if an IDE CD-ROM is detected as being present). The conduct of the company and their support can also be criticised (not that they are unique in this department). StarForce's PR has also been spectacularly inept and their Marketing Manager would have been shown the door by now in almost any other company.

However, as Spm has posted, it is vital to focus criticism on proven (beyond reasonable doubt) issues. Criticising StarForce simply for loading as a driver (which most security software does also) is pointless, criticising them over a "stealth install" (when every other CD protection mechanism does so also) is questionable and labelling the software as a rootkit or trojan is unjustified.

The proper channel for dealing with StarForce and its ilk is to boycott games using it, and to inform the publishers that you are doing so. CD-checks pose enough problems for legitimate users without need for additional scaremongering.

 

Out of courtesy to the site moderators I will reply to this.

Personally I have never overreached such implications, in fact I have been very conservative in some respects to give various peeps in various fields a chance to resolve specific issues before going public. (There are so many issues that I cannot realistically resolve all of them in the time scale).

I will admit what was posted here is rather vague, but not so vague that it would not get alarm bells ringing. I am not saying to accept what I say as gospel. Fell free to challenge it, but don't just dismiss it because of terminology (which is old school) or because taking a careful responsible attitude to the content on public board makes it sound vague.

Test it out for yourselves, some issues you will be able to replicate straight off, others only occurr after periods of use.

 

Agreed, list of games to boycott =

http://www.glop.org/starforce/list.php

Also, Ubisoft just bought FarCry and the their famous game engine.

"Ubisoft puts Starforce on most of their games. Couldn't have gone to a worse company.."

 

Instead, dismiss it because the technical aspects are clearly fictitious, and anyone can follow the previously provided link and/or Google to verify this for themselves. What I say about kernel mode vs user mode can also be verified by reading Windows Interals by Mark Russinovich.

One more time, because it seems like some may have been distracted by the idea that I'm disputing the term BSoD (which I use myself quite a bit), the error/stop code "System Halted due to; Possible non plug and play driver error" does not exist. In additon, the concept of a silent installer not being able to isolate the system drive is not possible, they would have to install a driver first before being able to get information on the physical disk. Installers just install to %systemroot% (with the rest of the path), which you can type into the address bar of any explorer window (such as My Computer) to see for yourself. The assertion that StarForce's implementation is highly unstable or malicious is something that even Mark Russinovich denied (post #9).

What can be verified about the argument presented, is that nearly every dishonest trick of argument has been used here. (That's something I recommend everyone read anyway, it's valuable information that everyone can use in life, especially on the internet.)


I have done the tests, I've been playing StarForce protected games for as long as they've been around. To those asking me to do the tests (which I have done), I ask that you check the facts, that's the first step for solving any problem. For those having problems, there are ways to get them addressed.. you just have to open lines of communication with the company in question - and that's done with calm reason and maturity. Yelling, swearing, and throwing accusations at them will only make it less likely that you will get any help, just as anyone here would be reluctant to go out of their way for someone addressing them that way.

I've made the offer and it's sincere. Give me something I can reproduce and I'll take it to StarForce myself to see it resolved.

And for a comparison here you can view any of the security disclosures by security professionals at places like http://www.secunia.com/ or http://www.security.org.sg/ where technicalities can be discussed without disclosing dangerous information, as is standard.

 

To be honest I only looked back here out of interest.

Can I ask you something, do you work for Security (Protection) Technologies or do you work for a publishing house that has vested interest in the use of Starforce?

I am only asking so that I am sure where you are actually coming from.

If you would care to elaborate upon what exactly is fictitious?

Starforce have already admitted to SATA/SCSI incompatibilities, they tried to retract this when this issue about software panic arose.

The DMA step down issue has been replicated on numerous occasions (even by the editor of CGW Magazine, Ziff Davies Publications USA.

The Ring 0 issue, well if you understand that then it needs no further explanation on a public board, if you don't then it is unlikely that have a valid reason to have that information in the first place.

SC spoke Mark and he only gave SF a fleeting glance (The exact quote was 20 minutes). CDFreaks misquoted him and Starforce went onto use that misquote.

CDFreaks are also the ones who misquoted the posts on Futuremark forums recently, as being Future Mark investigating SF. In fact a poster there had just copied my findings. I went onto Future mark forums and CDFreaks and set the record straight on that.

"Dishonest trick of argument" OMG! that is the oldest trick in the book by trolls,

Disclosures: Yes disclosures are not done in the open by stupid people, as for the rest of us such disclosures are never made int he open unless

1. The security issue is so severe that it require immediate shut down/removal of a specific application.

2. There is a workaround or patch available.

Any other detailed disclosure is highly irresponsible, and no matter how much you incite to flame I will not post such information on an open forum.

To be exact, I have already openly challenged Starforce to come to NGH offices in the UK and try and disprove the challenges. They declined and instead refered to us as being Crime lords

Dennis Zhidkov really needs to stop smoking that funny tobacco (Only kidding, but he does have the most interesting PR comments I have heard in long time, If you cannot prove somebody wrong, call them a criminal.)

Yes that is exactly how I normally deal with companies. However Security (Protection) Technologies, rather sadly for them do not conform to even the most basic practices of common courtesy.

After months of using my workarounds, let me remind you of how they respond to issues which they do not like.

http://www.star-force.com/forum/index.php?showtopic=796

I told them that they had a basic software panic issue, they just went loopy.

I tried to be reasonable, as in remove that thread and apologise and that would be the end of the issue. Instead they made it more prominent.

At this stage I am within my right to prosecute for Copyright violation as they did not remove the posts when requested. (There is considerable amount precedent to support such litigation), however given that they are facing a very major law suit concerning the class action that has just been filed against Ubisoft/Starforce in California, the forum post is a minor issue.

The class action:

http://eplaw.us/sf/UbisoftComplaint032406.pdf


Just to clarify yet again in case you missed it. Ubisoft have already 'admitted' liability concerning the damage done to Soul Commander's Plextor drive by the Version of the Starforce Virtual IDE protection driver provided in Silent Hunter III. Initially he was paid in kind (4* Latest Title PS2 games).

Just to remind you a major publishing how does not make a non clause payment (even in kind) unless a major issue exists in the first place.

SC went on to be part of the Ubisoft Starforce investigation team for over a year.

Anyway the information that was required here has been posted, so as I said I won't waste my time or anybody elses repying to flame bait.

Oh btw in case you didn't realise a number of the lawyers listed in that class action against Ubisoft are the same ones that filed against Sony in the Rootkits case and yes they are genuinely aware of Marks real standpoint on SF.

 

Well at least Notok has used the product before, so he is qualified to speak. As is almost everyone on this thread.

What I don't get is, why someone from his own admission isn't a gamer, hasn't used any starforce protected game and admits he doesn't care less
keeps popping up in threads solely about SF protection scheme to bash people who have ills with SF copy protection.

I did the search , and a certain name keeps popping up, who has no experience with the subject at hand but keeps defending SF simply out of blind loyalty.

Yes, I understand that a couple of Support people were nice to him with prompt email replies when he inquired about Safe'n'Sec Security Software, but because of that and that alone does that mean that they are all good guys and there is no way SF protection can be unstable?

I've heard of blind loyalty, but this is crazy!

It's like someone with no experience staunchly defending Sony in the XCP scandal and refusing to admit that it was a bad idea, simply because a long time ago, a couple of Sony employees were helpful with another entirely different product.

Perhaps, bur SF drivers are sufficiently evil that Mark himself admits spending time with " Process Explorer to examine the drivers loaded on a home system to see if I’d picked up any Sony or Starforce-like digital rights management (DRM) device drivers. " .

 

Agreed on point 1, Peter2150. I don't see how Marks comments fit the discussion. But that seems the norm in the StarForce driver-discussion. No hard facts, just hearsay, fairy tales and FUD.

 

All he states there is that he was looking to see if there were any DRM drivers on his system that he didn't know about, there was no implication of "evil". In fact, he checked the StarForce software and cleared them of any wrongdoing, and continued to say that there was nothing unstable about their implementation. - http://www.sysinternals.com/Forum/forum_posts.asp?TID=4522&PN=1

Look, I'm not asking anyone to take my word on anything. On the contrary, I'm trying to get people involved in this thread to NOT just take ANYONE'S word: do some objective reasearch and cut out the fact from the fiction. Sound like work? Well it is.. do you think that the easy way is the right way? What some people here are trying to do is throw every possible reason to dislike StarForce into a big mash, throw in a heafty dash of pure fiction, and use this great glob of crap to defend any possible thing that anyone has to say that isn't purely negative about StarForce.

This is 100% counter-productive, it will never get anything positive accomplished.

This is also the reason that I have offered to help StarForce with testing, to identify and resolve problems, and my offer was accepted. Which course of action sounds more productive to you?

Does StarForce have bugs? Sure, there's no software that doesn't. But what do software bugs have to do with their PR manager, and how do some mis-handled PR moves prove that the StarForce drivers equal a rootkit, or destroy hardware, or anything else? Everyone wanted the experts to examine the problem, but the experts' reports went ignored when it didn't turn out the way they wanted. The fact is that when they look at the data, they don't find any greater number of people affected by problems than with any other software.

Have any of you bothered to read the links provided? Ask yourself: do you really want the problem resolved, or do you just want to bash?

I'm offering equal time to both sides, and I'm giving my personal time to actually get to the bottom of the matter. I've offered to take anyone's experience that can be duplicated and take it to StarForce myself, I've even already volunteered my time to work with StarForce to work these things out.. who's on what side here?

For the record: No, I do not work for, or have any vested interest in, StarForce or Security/Protection Technologies.

Read the link, re-read the arguments presented, and decide for yourself. The troll's purpose is to get people riled up, to ignore reason and raise emotions. Who's doing what?

IMO, the motivations here are very dubious...

 

Exactly.. and I think a lot of this could be avoided if they would just uninstall the drivers when the game is uninstalled. That's not something SF can control.

 

That's fine, you've provided an answer. That's all I wanted to start with, however.....

You still insist on insulting me. Do you enjoy treating NOD32 customers this way? I came to this thread posting a link regarding some research on this matter. When I disaprove of your moderation, you became hostile. How would you feel? - when you are always proud to recommend NOD32 to anyone only to be belittled on a support forum?

Yes, but these vendors did not disclose their copy protection scheme. It was only after users began having problems, that Starforce was revealed. How else would one know about downloading a removal tool? Besides that, the tool doesn't necessarily work on Winx64. It that the user's fault too?

 

Thank you for replying.
The problem is that the game publishers refer people to Starforce when these questions arise; they will not address any issues regarding Starforce. In doing so, users are now forced to deal directly with Protection Technologies. The most notable ones are UbiSoft and Codemasters, in which they've either locked or deleted entire threads that have anything to do with Starforce. There's even in fighting going on amongst the forum moderators. How crazy is that?

It's come down to people voicing their anger with their wallets, as it seems apparent that this is beyond discussion.

 

Precisely how does this comment insult you? I don't see it as either insulting or dismissive. You clearly have strong opinions on the issue of StarForce protection scheme, and from your comments elsewhere, you clearly feel that they shouldn't be implemented in the software you use. I don't see a problem with that. I was simply drawing the distinction between that belief, and the feeling that, given that belief, programs such as commercial AV programs should flag the presence of these items, which implicitly brands them as malware. This comment was not directly focused on you, but to the thread in general as part of my response to you. If you go back to the start of this thread, that was the premise posited by the original poster, and I quote

In other words does NOD32 flag/clean this item? I view the two points as very different.

Further, precisely where have I belittled you or anyone else in this forum? In my opinion, the link you provided is precisely as I described. I then moved the thread to this venue. The fact of the matter, if this thread had continued on as a discussion of StarForce in the NOD32 support forum, it would have been closed since it is not a NOD32 issue. I moved it here to allow the discussion to proceed in an open fashion.

The diagnostic question basically falls to the game vendor and, in this case, their supplier (StarForce in this case). That is how issues would be diagnosed, and if they weren't diagnosed to the users satisfaction, they should simply move on to game vendors aligned to their desires.

I've not blamed users in any of my postings here or elsewhere. However, I don't believe that commercial AV vendors should be brought to task for not removing protection schemes implemented by other commercial software vendors.

Blue

 

I think the problem that you and other gamers face is that reason has flown out the window and been replaced by just anger. Honestly it seems like what you need is someone that can provide reason in a calm tone. Frustration is understandable, but there's a point when things have to be brought down a notch and both sides have to listen to eachother. From what I saw, Ubi did actually take an objective look at the data, but in return it seems that none of the critics were willing to take any of it in. You've got to work with the hand you're dealt, and if you let emotion override reason, you won't get anywhere. If this thread is any indication, the gamers have a lot of work to do.

As an example: how you can possibly derive an insult out of the statement that you clearly feel that such software (StarForce) should not be included with commercial software (ie, games) is very much beyond me.. that's the reason for this thread, isn't it? How does this help? Take a step back before you go trying to make enemies with those that are trying to help you.

 

IMO, if this issue is ever going to be resolve in a way that can make everyone happy, someone is going to have to find a way to ensure that the game makers get paid without this kind of technology. Shut down SF and it's just going to be replaced by something worse.

If you can't come up with anything, then your best course of action is to work with the companies (in a civil manner) to get things fixed to a degree that you can live with.

Heck, I'm doing that for you, which is a fact that seems to have gone ignored here for the more entertaining (ie, emotional) matters. I have no problem with SF, so ultimately *I* have nothing to gain through doing so.

 

Sorry, but how else should I take these?
1) "In your haste to heighten the impact and make the case, you end up sacrificing whatever valid ground was there under your feet."
Oh, yeah, real friendly. I provided a link with a quote from PCGamer and that's the response I get.

2)@Midfingr
"Please note, this is very distinct from the question of whether you feel these measures should implemented commercially, it's clear you don't." Key words: it's clear that you don't - then try to say that's for everyone?

3) "No less than your own comments."

What comments are you refering to?

"Hi all.
I've been following the Starforce debate for some time now.
Today, I found some rather interesting news about Starforce and it's software.
The owner of r-force.org has posted an article describing how a SF root admin asked for help on fixing their software. If you're interested, please see this link to view the story." - what?, the link?

These are not objective comments.

 

It's a statement of fact. If you take facts and load them with anger, whatever valid points you had get lost. Loose objectivity, and you loose the case.

He was addressing you personally, and observing that it's clear that you don't want SF in with your games. There's no insinuation of anything.

BZ gave nothing more or less than objective observations. If you feel insulted, then perhaps you should take a step back and reconsider your stance. That's not meant as an insult either. The simple truth of the matter is that if you can't be objective, and you can't consider objective viewpoints, you're just going to keep hitting brick walls.