Riavvio inpiegabile [Era: Ragazzi, questa cosa...]

[Arks]

E' solo un ipotesi estrema,ma...visto che tutte le ipotesi precedenti non hanno avuto successo...se fosse un congegno ANTI DUPLICAZIONE,tipo C_Dilla o altro simile,della Macromedia o simile,che si va ad annidare nella 'zona di nessuno' del disco fisso,che per qualche ragione e' impazzito?
A volte e' capitato in passato negli USA con C_Dilla che marchiava l'HD in stealth mode,a insaputa dei clienti della compagnia Turbo Tax.
Il guaio,se fosse un congegno deragliato di questo tipo,sarebbe che l'unica soluzione e' un HD nuovo,dato che nemmeno la bassa frequenza potrebbe cancellarlo facilmente.

[nickcrazy]

Originariamente inviato da Arks
E' solo un ipotesi estrema,ma...visto che tutte le ipotesi precedenti non hanno avuto successo...se fosse un congegno ANTI DUPLICAZIONE,tipo C_Dilla o altro simile,della Macromedia o simile,che si va ad annidare nella 'zona di nessuno' del disco fisso,che per qualche ragione e' impazzito?
A volte e' capitato in passato negli USA con C_Dilla che marchiava l'HD in stealth mode,a insaputa dei clienti della compagnia Turbo Tax.
Il guaio,se fosse un congegno deragliato di questo tipo,sarebbe che l'unica soluzione e' un HD nuovo,dato che nemmeno la bassa frequenza potrebbe cancellarlo facilmente.

Cosa intendi per bassa frequenza?

[Arks]

scusa,volevo dire basso livello.

[nickcrazy]

Originariamente inviato da Arks
scusa,volevo dire basso livello.

A dire la verità non riesco a capire nenche quale sia la "zona di nessuno" dell' hard disk che per qualche ragione sia impazzita :quipy: , che sappia io l' unica differenza tra formattazione normale e quella a basso livello è che quest' ultima ripristina anche i settori difettosi e cluster danneggiati

[vortice65]

scusa la domanda ma ho un problema simile,come fai a sapere che l'hard disk non è danneggiato?

[vortice65]

scusa la domanda ma ho un problema simile,come fai a sapere che l'hard disk non è danneggiato?

[Arks]

X Nickcrazy-

'zona di nessuno' perche' non fa parte ne' del BIOS ne' del SO.
Mi risulterebbe che nessun SO occupa esattamente il 100% dell'HD.
Mi spiace che non posso copiare qui le relazioni tecniche su C_Dilla e simili perche' ce l'ho in un altro pc,se ci tieni posso vedere domani. In linea di massima comunque le direttive di 'moduli' simili anti duplicazione o anti altro non si inseriscono nel sistema oper.,ma in questa zona libera. Da dove nessuna formattazione normale puo' cancellarle.

[nickcrazy]

Originariamente inviato da Arks
X Nickcrazy-

'zona di nessuno' perche' non fa parte ne' del BIOS ne' del SO.
Mi risulterebbe che nessun SO occupa esattamente il 100% dell'HD.
Mi spiace che non posso copiare qui le relazioni tecniche su C_Dilla e simili perche' ce l'ho in un altro pc,se ci tieni posso vedere domani. In linea di massima comunque le direttive di 'moduli' simili anti duplicazione o anti altro non si inseriscono nel sistema oper.,ma in questa zona libera. Da dove nessuna formattazione normale puo' cancellarle.

Mi spiace ma tutto quello che dici per me continua a rimanere un arcano , ti pregherei quando hai tempo di postare le relazioni tecniche in tuo possesso, se è possibile imparare qualcosa ne sarei felice. Grazie

[Arks]

XNickcrazy

purtroppo,causa formattazione passata,non ho piu' una relazione superdettagliata e sono costretto a inviarti solo alcuni links e note sparse che mi erano rimaste nel mio notebook dopo una battaglia contro C_Dilla di due anni fa.Il tutto e' in inglese perche' agli italiani interessava poco che qualcuno scrivesse sull'HD a propria insaputa e infatti la materia,ormai obsoleta,e' quasi ignota qui.


siti per saperne di piu': (molti possono essere dead links ora nel 2004,questi sono del 2002)
http://www.privacyandspying.com/c_di...ll_report.html
http://www.cleverhack.com/blog/turbotax.html)-
http://www.computing.net/security/w...forum/3928.html
http://www.gail-davis.com/GD%20Web%...Blog_030208.htm
http://www.xenky.com/news/20030213/...ax20030213.html
http://www.smithysanvil.com/topic_spyware.html
http://www.extremetech.com/article2/[/URL]

http://www.macrovision.com/solutions/software/drm
http://www.c-dilla.com/
http://contracts.corporate.findlaw.c...998.02.19.html
http://www.privacyandspying.com/privacy-c_dilla.html
http://www.privacyandspying.com/c_di...ll_report.html
http://www.cexx.org/adware.htm
http://www.annoyances.org/exec/forum/winxp/n1027089691
http://www.pcmag.com/article2/0,,378309,00.asp
http://www.lavasoftusa.com/



TurboTax 2002 Spyware/Malware Question
http://www.dslreports.com/forum/rema...ty,1~mode=flat
question on cdilla - quicken spyware
http://www.dslreports.com/forum/rema...ty,1~mode=flat

Not Just From Turbo Tax (d-dilla CDAC11BA.exe)
http://www.dslreports.com/forum/rema...ty,1~mode=flat

What is this?
http://www.dslreports.com/forum/rema...ty,1~mode=flat

TurboTax 2002 Spyware/Malware Help
http://www.dslreports.com/forum/rema...ty,1~mode=flat

SafeCast ?
http://www.dslreports.com/forum/rema...ty,1~mode=flat

CDilla and TurboTax Question
http://www.dslreports.com/forum/rema...ty,1~mode=flat

http://www.dslreports.com/forum/rema...=flat;start=20
»vcast.v4c23.net/web/servlet/PlayMovie?..[?] safecast uninstaller
It should remove everything except the sector 32 data. It is more thorough than removing "SafeCast shared components" from Windows.


Queste applicazioni usavano C_Dilla.



AutoDesk (SafeCast)
Sold Out Software (SafeDisc)
SCi Software (SafeDisc)
WebSense. A special case. The WebSense/Macrovision software uses SafeScan to scan the hard drive of a corporate PC for "hacked" versions of software. Click here for more details.
Virgin MegaStores (not known, but probably SafeCast. Used for protecting downloaded content.)
FishTank Software (SafeDisc)
Bol.com, the online arm of music distributor BMG/Bertelsmann. (SafeCast)
Hyperion Games (SafeDisc)
UbiSoft (SafeDisc)
TransGaming Technologies, a Linux games porting company (SafeDisc)
Ascaron Software, a German games developer. (SafeDisc)
CodeMasters, the Russian games developer which designed Operation Flashpoint (SafeDisc).
Diggibag.com, a games portal, both in the U.S. and Scandinavia (SafeCast)
Grey Matter, a U.K. software tools developer (SafeCast)
Borland (SafeDisc)
Phocis Ltd., a U.K.-based digital security company (SafeCast).


Alcune note tratte da siti e forum.

SPEAKEASY.net
NOTE: this is in response to the post by jmorlan
The Intuit/Safecast literatures cites as an advantage that "even if you reformat your hard disk or install another operating system you will probably not need to register again", which seems to indicate that they put something on the hard disk outside the normal reach of the file system (Windows will actually let an installer do that when you reboot the system, while anything goes before loading windows, of course.)
So that would mean something is written in a control area of the drive. Of all the nerve!
» | | 2003-02-06 00:17:15 |

Roguetech

John's Mediocre Pages
»www.roguetech.org/[?]
Autodesk software also use C-dilla. When you format your HDD and install the whole crap again, C-dilla notifies that the software was already installed. Probably this software writes in de MBR of your disk.


Monnie
AFter uninstalling safecast.. I wonder if installing a boot loader like lilo would overwrite that sector 32 data...
--------------------------------------------------------------------------------

It might. There are a number of boot loaders that write to the first track and that's one of the big problems with SafeCast. It has been reported that SafeCast may overwrite sectors that your boot loader needs. The reverse may be true as well, but it would depend on the specifics.

If you really MUST get rid of the Sector 32 data, you can remove it with any hex editor that can write to absolute sectors. The one I use is called Hex Workshop. Norton has one that comes with Norton Utilities called DiskEdit. Just overwrite the data with zeroes.

However, I don't see any compelling need to remove the data. It's not doing any harm there and mucking around in absolute sectors on the boot track with a hex editor is not for novices.


Cosi' macrovision ha cercato di 'coprire' le malefatte:
http://www.macrovision.com/solutions/software/drm/

The newly altered page page now says this:

Using SafeCast, you can:

Securely deliver software by electronic download, on CD-ROM or DVD-ROM, or as value-added content on a Video DVD.
Accept payments and unlock products via the web and/or by phone, fax or e-mail.
Offer products as time-limited trials (with or without "click here to buy"), or on a subscription or rental basis.
Require users to activate or register their software before using it.
However, Google's caching service still shows the page as it existed prior to last week's issue of this newsletter. Hurry up and click this link before Google caches this page again and you'll see the difference between this week and last week.

http://www.spywareinfo.com/rd/mvisioncache/

Using SafeCast, you can:

Securely deliver software by electronic download, on CD-ROM or DVD-ROM, or as value-added content on a Video DVD.
Accept payments and unlock products via the web and/or by phone, fax or e-mail.
Offer products as time-limited trials (with or without "click here to buy"), or on a subscription or rental basis.
Require users to activate or register their software, and gather valuable data on your customer base.
Man, it sure is embarrassing when you want to hide something and people find it anyway.

Let this be a lesson to other developers. SafeCast is off-limits. Learn from Intuit's mistake here. They bundled this software which is so offensive to so many people, and they did it without disclosing it. Worse, they offered no way to remove the offensive software, and their own program's uninstaller wouldn't remove it. Combine that with truly draconian licensing terms and you have a recipe for a mass abandonment of a once popular product.


According to Macrovision, the SafeCast technology scatters files around a user's hard drive, both to prevent users from disabling the content-protection features as well as to allow a fragmented or corrupted hard drive to retain a record of the software's activation


We Uncover Low-Level Monkey Business

Finally, before we put a wrap on our review, we decided to investigate readers' allegations that SafeCast was performing risky, low-level operations on users' hard disks. (Such operations wouldn't have been picked up by InCtrl5's before-and-after inventories of the drive.) While most of the reports we received turned out to be bogus, we were able to verify that SafeCast manipulates at least one area of the disk that's "outside" the file system.

To understand what we found, you need to know a little bit about how data is laid out on the hard disks of IBM-compatible systems. By convention, the first "track" of the hard disk -- that is, the outermost ring of data on the first side -- is reserved for a data structure called the partition table. The partition table allows the disk to be divided into as many as four parts, each of which might hold a separate operating system or a separate storage area for data.

The partition table only takes up the first 512-byte sector of the track, so -- depending upon the number of sectors per track -- there may be quite a few sectors left over.

Nowadays, the vast majority of large hard drives use a technique called sector translation that makes them look to the computer as if they have 64 sectors per track regardless of the actual number. So, most drives have 63 unused sectors in this space.

These leftover sectors are often untouched by utilities that manipulate the drive, so data that's hidden there may survive reformatting and repartitioning.

Mysterious Sector 33 Manipulation: We used the "DiskEdit" program from The Norton Utilities to watch that space. What we discovered on our Windows 98SE testbed was that each time TurboTax ran, sector number 33 of the hard drive -- which lies right smack in the middle of that area -- was being changed.

It never changed when we ran any other program on the system.

So to verify what was going on, we made a copy of that sector, scribbled it with random ones and zeroes, and restarted the system. It booted just fine. But when we attempted to invoke TurboTax, SafeCast decided that things were definitely not kosher. TurboTax decided that we had an unauthorized installation of the product, and demanded that we either present a credit card for payment or run the program only in "trial" mode.

We then copied the old data back to the "magic sector" and re-invoked TurboTax. Lo and behold, the program consulted its server again, determined that our copy was legitimate, and allowed us full access once more.

Clearly, the data in Sector 33 is a special "signature" that SafeCast uses to decide whether a program installation is legitimate. If you copy TurboTax to another hard drive , or restore to a new drive from a backup, this signature will not be included. And without that signature, SafeCast may deny you access to the software even if you've legally purchased and registered it.

Reserved Sectors Can Be Unsafe: Unfortunately, these "reserved" sectors of the hard drive aren't necessarily a safe place for data. And they're an especially dicey place to keep licensing information. According to Frank Van Gilluwe -- whose company, V Communications, publishes System Commander and Partition Commander -- viruses have been known to hide in this portion of the disk.

Data compression utilities, "multiboot" utilities, password protection and encryption software, and sector translation software (which allows older computer systems to accept today's huge hard drives) may also reside in this area. Sometimes these applications can interfere with each other, in effect fighting for use of the space.

One of our readers reported that his license management software -- not C-Dilla, but another product -- ceased to work after he installed TurboTax and SafeCast wrote to this area. We wouldn't be surprised if other problems cropped up as well.

In short, we found that -- in its attempts to prevent illicit copying -- SafeCast pulls some tricks that may cause trouble. Will it interfere with the normal operation of your system? We don't have statistics to tell us how likely this is, but we're concerned that SafeCast adjusts hidden parts of your hard drive without warning you.

[TheDaemon]

insomma, che devo fare??????????? l'hardware è da ESCLUDERE al 100%!

Grazie.