StarForce Again!

[rhondabrwn]

Somebody KICK ME... hard!

Got suckered in by a 30% off download offer, forgot about watching for StarForce protection, installed the game, played around with it for a couple of hours, went back to my regular computer activities.

Hmm... suddenly noted a severe drop in performance, DVD's were taking twice as long to compile and burn, couldn't run multiple applications simultaneously, and my DVD burner suddenly refused to accept -R format disks.

Thanks to advice on these forums, I quickly checked in Device Manager, found the (*&%^** telltale tracks of StarForce protection, downloaded the latest StarForce removal tool and got back to normal.

Dang... lesson learned... trust no one but Matrix! [:D]

[DuckofTindalos]

Might be good to post some more details, Rhonda, like the GAME'S NAME!!!

[sabre100]

Rhonda I agree Matrix is the best, they take care of their customers. Their registration is simple and very user friendly, they dont make it hard for the honest guy who buys their games. That is why I continue to buy their games because of the excellent service.

I just bought TOAW3, COTA, and Panzer Command in the last few days not to mention many more games in the past from them because of their customer service.

[Hertston]

Just to mention as an aside that Starfarce have apparently tried to slip in the latest version under the radar by calling it 'Frontline Pro' instead. They are one and the same.

[benpark]

They are also using the name "Deep Silver". It sounds like a malt liquor or a condom. A real bunch of deviants. I just found it on an impulse buy from Paradox, "Rush for Berlin". I'm not buying any games intentionally that contain this virus, so I was really pissed when I found it.

[Sarge]

 Paradox [8|]
 
You should know better Ben  [:-] 

[oi_you_nutter]

put us out of our misery, what title is it ?

Paradox have had a good policy up to now, from what i had read on the paradox forums only "rush to berlin" has starforce and that is a 3rd party title that paradox publish.

[Zap]

Paradox is a bad name for many here. I don't have any experience with them because I never bought a game from them.

[ravinhood]

GalCiv 2 proved "If you make a quality game with a quality ai and challenge" you don't need any copy protection. I figure if you've got to have copy protection like Starforce or its other many names then your games aren't very quality to begin with and well Paradox is well known for milking the donkey with that engine of theirs. It was main reason I didn't want to see Mad Minute go with them as a publisher. I feel this will hurt them more than help them in the long term. Strategy First would have been a better choice or Matrixgames or Shrapnel hell even TONKA TOYS haha. Now, the first think I look for and ask about when a new game comes out I am interested in is what type of copy protection does it use. Of course Matrixgames we don't have to worry about or Stardocks or HPS or Shrapnel's. Amazes me with the downsizing of the pc gaming industry sales figures you'd think they'd not do things to piss even more customers off.

[Sarge]

milking the donkey

 
LMAO

[JudgeDredd]

Paradox (and in particular HoI2 and Doomsday) rocks for me.
 
Still, I did noticed thew exact same thing Rhonda found (very slowwwwwwww to write DVDs/CDs) after installing Silent Hunter 3.
 
Unfortunately, I am stuck with it...because I will not get rid of my beloved GTR and GT Legends!

[DuckofTindalos]

Hmmmm, isn't this virus supposed to actually cause physical HARM to your drives?

[rhondabrwn]

ORIGINAL: Terminus

Might be good to post some more details, Rhonda, like the GAME'S NAME!!!

Well, I didn't want to slander any particular game until I had verified the source of my infection. I had thought it was Combat Mission Afrika Korps, but after researching the net I couldn't find any mention of that series as StarForce protected... so, after clearing the computer I reinstalled that game to check... and no StarForce.

So... next I checked Auran's TRAINZ 2006 which I had to delete and reinstall last night in order to apply their SP1 (a nearly 700 meg monster). Auran seems linked to JoWood and they used StarForce, but again... TRAINZ seems clean.

Next I checked on my Mapsend Topo 3D USA package (for my GPS unit), but that was clean.

I'm at a loss, but I definitely picked up StarForce from somewhere so I'll continue to backtrack.

It just shows that you really need to check for the precence of the StarForce Drivers constantly and I'm really grateful for the info provided on the Matrix forums on detection and removal!

New Question: if they are applying StarForce under a different name, does it still show up the same way in Device Manager when you display hidden devices... or will the driver names be camoflaged in some manner?

[JudgeDredd]

ORIGINAL: Terminus

Hmmmm, isn't this virus supposed to actually cause physical HARM to your drives?

That is what I've heard...although I haven't suffered such a fate yet.

[DuckofTindalos]

ORIGINAL: JudgeDredd

ORIGINAL: Terminus

Hmmmm, isn't this virus supposed to actually cause physical HARM to your drives?

That is what I've heard...although I haven't suffered such a fate yet.

The operative word here being "yet"... Still, you pays yer money and you takes yer chances...

[Les_the_Sarge_9_1]

ORIGINAL: Terminus

Hmmmm, isn't this virus supposed to actually cause physical HARM to your drives?

Not sure if "harm" is the most correct term. But, if it mangles the settings, makes portions of your computer fail to function correctly, then I think it has earned a visit to the junk bin.

Biggest infraction I have heard of, is how it can invade a section of your hard drive, totally unwarranted by a mere game. No game maker is being invited onto the most secure portions of my hard drive. That's grounds for automatic withdrawal of all support.

I'm fortunate though, I only seem interested in playing grognardish designs, from companies that have no interest in these Starforce losers.

[rhondabrwn]

ORIGINAL: Les_the_Sarge_9_1

ORIGINAL: Terminus

Hmmmm, isn't this virus supposed to actually cause physical HARM to your drives?

Not sure if "harm" is the most correct term. But, if it mangles the settings, makes portions of your computer fail to function correctly, then I think it has earned a visit to the junk bin.

Biggest infraction I have heard of, is how it can invade a section of your hard drive, totally unwarranted by a mere game. No game maker is being invited onto the most secure portions of my hard drive. That's grounds for automatic withdrawal of all support.

I'm fortunate though, I only seem interested in playing grognardish designs, from companies that have no interest in these Starforce losers.

The worst thing it does is disable DMA (Direct Memory Access) which slows your data transfer to a crawl. It does this by creating lots of data transfer errors which WinXP reacts to by stepping down the transfer rate, not realizing that the data loss is being caused by StarForce's constant meddling in your system. The slow down comes in increments so you just gradually lose performance.

The physical damage is only on certain drives and has something to do with forcing them to write beyond the physical size of the DVD, thus banging the mechanism repeatedly against the edge of the guide rail until the gears are stripped and the drive fails.

I'm going from memory, but that is the gist of what I've read.

[rhondabrwn]

I'm not sure where I got this information, I copied it into a Word file that I keep in my emergency maintenance folder. Therefore, I can't give proper credit to the author.

*********************************************

Starforce Critique

Starforce is a
TrojanKit:
Definition:
1. Security Applications installed without end user consent.
2.Software that grants Ring 0 access to Ring 3 (user level) applications.
3. Interferes with other software such as virtual drives, SCSI/SATA etc.
4. Puts its own virtual protection drivers on the system.
5. Interferes with other applications Windows registry settings.
6. Can be exploited with replacement malicious versions to grant Full Ring 0 access

Starforce once installed is constantly checking your system and sending info to drives interferring with streams back and forth.

SF is so over zealous about its sector checking that if it loses these it will refuse to function. On top of this, XP reads this as a disk I/O error. Which in turn causes it to step down the IDE speed to compensate. Eventually it will step down to the older 16 bit mode which disables DMA access altogether. No DMA means.

1. No Digital access to play audio CD’s
2. Unable to play DVD videos from DVD
3. Most current CD/DVD Games/Application will not run [or slow down to a crawl!)
4. CD/DVD writing becomes almost impossible (Up to 2 hours for a full DVD on 16x DVD writer) and it will make many coasters even on burn proof drives.

The issues concerning DMA can be cured by uninstalling SF and then uninstalling the CD/DVD drivers as well as the Primary and Secondary IDE controllers. Forcing XP to reload those drivers.

Hardware failure:
A lot of new CD/DVD hardware is not PIO mode compatible. Thus any period of time being used in this old 16bit mode can be interpreted by some drives as attempts to Overburn/Read an excessively over burned disk. I.E in over burning you force the laser to go right to the edge of the disk. This results in the laser in many cases hitting the side casing of its guide and in turn stripping the threads off the worm gear. Basically it trashes the hardware.

Some drives also interpret the search for specific sectors indicated by SF as an over burn read/write command.

Security:
SF opens up Ring 0 (super user level) access to Ring 3 (User level applications).

**********************

This kinda explains things doesn't it?

There is a 10th Circle of H*LL waiting for the StarForce people

[benpark]

Okay, how do I TOTALLY clean this crud off my comp? I have the little starforce removal .exe (that starforce themselves have on their website-tells ya something, no?). I somehow think there are other steps.

Customers putting up with this abuse is a bad, bad trend.

[rhondabrwn]

ORIGINAL: benpark

Okay, how do I TOTALLY clean this crud off my comp? I have the little starforce removal .exe (that starforce themselves have on their website-tells ya something, no?). I somehow think there are other steps.

Customers putting up with this abuse is a bad, bad trend.

You have the StarForce removal tool, so that is the biggest step.

Then:

"The issues concerning DMA can be cured by uninstalling SF and then uninstalling the CD/DVD drivers as well as the Primary and Secondary IDE controllers. Forcing XP to reload those drivers".

Do this from the Windows Control Panel > System > Device Manager. If you "remove" the listed devices and reboot, Windows will reinstall them automatically with the correct settings.

I'm not aware of anything else that you would need to do.