How to get rid of SecuRom, NOW

[lordrichter]

The main reason I say SecuROM is malicious is the fact that it shuts off firewalls without our knowledge.  This leaves machines vulnerable to malware. 

In my experience, this is not fact, at least with respect to the way that Sims 2 is using SecuROM.
I have directly investigated this claim with no success in verifying it.  Although, I am an IT professional, so I might be part of the compiracy.

[jmtmom]

Tell that to my Norton Anti-Virus caught in a continual uninstall/reinstall loop.    If I was more awesome, I'd already have the Securom off my computer. When I do, if I have the same problem, I'll stop blaming SecuRom. Yes, I have contacted Norton and tried all their fixes. At first they were helpful, but now they've taken to repeating the same instructions over and over. I guess they're taking a page from EA's customer support manual.

[Zazazu]

The main reason I say SecuROM is malicious is the fact that it shuts off firewalls without our knowledge.  This leaves machines vulnerable to malware. 

In my experience, this is not fact, at least with respect to the way that Sims 2 is using SecuROM.
I have directly investigated this claim with no success in verifying it.  Although, I am an IT professional, so I might be part of the compiracy.

Conspiracy!!!!!

Considering that I personally had issues with McAfee saying my sub was up, and others have had issues with Norton Antivirus doing the same or stalling/erroring during scans, it's not a huge leap that some firewalls might be seen as The Evil by SecuROM. The thing displays no logic whatsoever. I've seen several people here and on the BBS post that their firewall was turned off or had increased events. Too many to be coincidence.

I also had an obscene amount of blocked events (I'm at tight security level), but more suspect a coincidence in my case. I don't see how the two could be linked. And yes, since SecuROM was removed I've had no--count 'em--no events, but I also banned a whole bunch of EPs at the same time. Can't be sure.

[angelyne]

Yes Ritcher I agree.  The list of the evils of SecuRom is getting a little too long to be believable.  I would imagine that maybe just maybe, some antivirus wouldn't deal with the software well when it attempts to scan some protected data.  It's like running two Antivirus programs on the same machine.  It's usually a bad idea, because they conflict with each other.

Turning off firewalls? I seriously doubt it. I just think that because SecuRom is so very close to being malware, that it's considered to be  one and the same and gets blamed for typical malware activities, like turning off your antivirus and firewall and establishing multiple connections to unknown ip addresses.  It is malware, but the difference between Securom and the stuff in the wild is that it's malware used by legitimate companies.  So they have to show some restraint, unless they want to be the target of multiple lawsuits.

I think we are just seeing a reaction where people are blaming everything weird that happens on their computer to Securom.  There is a logic to what this program does. It's main objective is to prevent the running of illegal copies.  So it messes with DVD drivers.  It attempts to detect the running of software that circumvents copy protection.  It does a bad job and produces false positives.  It attempts to hide itself and so triggers programs that are designed to detect behavior like that (Antivirus). It's annoying and undesirable but it makes sense. within the scope of what it is trying to do.   

I had a user the other day call me because she thought she had a virus on her computer because she opened a JPG and mysteriously her background was changed.   It was a perfectly innocent little JPG attached to a perfectly innocent little email.  I can always tell a viruse email just by looking,  but I scanned it to be sure). When she opened the JPG she must have clicked on the option to make it a desktop background.  But since viruses are mysterious evil programs that do mysterious things, and something mysterious occured, ergo, it must be a virus.  (To be fair, I know that some malware do change backgrounds, however, not usually to a bunch of pumpkins).

So I think this is the phenomenon that is at work here.

[jsalemi]

Turning off firewalls? I seriously doubt it. I just think that because SecuRom is so very close to being malware, that it's considered to be  one and the same and gets blamed for typical malware activities, like turning off your antivirus and firewall and establishing multiple connections to unknown ip addresses.  It is malware, but the difference between Securom and the stuff in the wild is that it's malware used by legitimate companies.  So they have to show some restraint, unless they want to be the target of multiple lawsuits.

And you say this in spite of what experienced computer users, many of them professionals in the field, have said here and elsewhere about SecuROM preventing their McAfee and Norton internet suites (which include firewalls) from working? And also seeing multiple attempts to 'call home' while the game is running, and ONLY while the game is running?  On what basis do you make your claims that people are just getting hysterical and blowing this out of proportion?  Do you, perhaps, work for EAxis, or Sony?

(And that's not even considering the installation of a service that bypasses the user's security on the system and installs itself with administrator rights if you install the game under a user account that doesn't have admin rights.  That's one of the definitions of malware.)

[jolrei]

It is malware, but the difference between Securom and the stuff in the wild is that it's malware used by legitimate companies.  So they have to show some restraint, unless they want to be the target of multiple lawsuits.

My understanding is that Sony has already been the target of at least one lawsuit related to SecuROM, precisely because of the malware characteristics of this sort of copy protection.  Your argument PHAILS!

[Quinctia]

I have one of the audio CD's with the copy protection they got sued over.  It's not restrained.  I really only lucked out in the fact that I was running a 98SE system at the time, and the installation was limited to a .dll.  I still could only delete it from the command line, however.  The rootkit was installed on XP machines.

It's really a shame, because I love the band whose album I bought, and they really deserved a lot of support, but I held off on suggesting people buy their music until it was available in digital formats, like on iTunes, because of the horrid junk on the CD.

You say it's unbelievable that SecuRom could mess with a firewall.  You would think it'd be unbelievable that an audio CD would contain a rootkit that disabled functions on a computer, just because someone wanted to, say, listen to the CD on their computer or rip copies of it to use in their portable music players.  But Sony already did that--it's not really a stretch.  Also, keep in mind that messing with a firewall doesn't necessarily mean that SecuRom intentionally messes with firewalls; sometimes corporate incompetance has the same results as corporate maliciousness.

[angelyne]

It is malware, but the difference between Securom and the stuff in the wild is that it's malware used by legitimate companies.  So they have to show some restraint, unless they want to be the target of multiple lawsuits.

My understanding is that Sony has already been the target of at least one lawsuit related to SecuROM, precisely because of the malware characteristics of this sort of copy protection.  Your argument PHAILS!

tut tut.  My argument did not PHAILS.  Since I said that if they don't show restraint they will be the target of lawsuits and they were.  And that Sony fiasco was far from showing restraint.  That was a train wreck of gigantic proportions. They deserve all the lawsuits they are getting.

However, unless there is another incident that I am not aware of, at that point they were installing a rootkit on people's computer.  That all of itself was pretty damn rotten to begin with.  But to make matter worse, their rootkit worked by hiding any process, file or registry key that started with $sys$, IIRC.  Holy security vulnerability Batman.  I would think, hope, expect, that after being sued, lambasted, publicly humiliated, drawn and quartered (maybe not that yet), they have learned SOME lesson.  Maybe not quite enough, but anyway.  They didn't get sued for Securom but for something called XCP.  Unless they got sued again and I don't know about it.

And no, I don't work for Sony, Ea, Securom or anyone remotely related to them.  It's just that, when everyone is forwarding to "all the people they know" dire warnings about aid infected needles in cinema seats, I'm the person who is on the net, checking the story out.

I don't panic easily.  I don't like hearsay.  As JM calls it "lies and propaganda". I want explanations and information that make sense, before I am convinced of anything.   And so far, I am not convinced.  I've googled it.  I've seen many people complain that their antivirus, especially AVG, and and securom don't like each other (which isn't really surprising).  I've seen lots of people wonder if it's a rootkit.  I've seen many other say no, it's not.  ( I don't think so either....that XCP WAS a rootkit, no doubts about it).  No mention of firewalls. 

I think there is no doubt that it's a really crappy piece of software and a really bad idea on EA's part to implement it.  They should have kept on using whatever the heck they used before.  I hope's someone ass on the line for this stupid decision.

[angelyne]

Quinctia,  I remember that incident clearly.  I was following it at the time.  That was unbelievable.  And that stuff was naaaaasty.  Almost impossible to remove without making your system unstable.  It was a nasty piece of business.  Then after the uproar, they finally, reluctantly agreed to provide a means to remove it.   But you had to send them a request and they would email you back some kind of key that was only good for that one computer.  And to make use of the key you had to install an activex component that introduced another security vulnerability.  What a shambles that was.

Read about XCP here.  It's enough to make your hair stand on your head, to know that this was somehow done by a big corporation.  Although they probably had no idea just what it was they bought.  http://en.wikipedia.org/wiki/XCP

[dano]

...
FYI, ever since I started using this fix, my graphics problems have apparently gone away.  I have a fairly recent Nvidia video card (7600GS) & ever since I installed BV I've been having crashes.  The whole screen would freeze & then get corrupted (like random pixels were shifted right or left).   My computer would either reboot by itself, or I'd have to do a hard reboot myself.  I kept updating my drivers to the most recent beta drivers from Nvidia, but it never helped.

After I did these steps, I haven't had this happen.  I even tried to cause it, by setting all my graphics options to high and going to the CAS screen.    Not sure why this fix would have that effect, but I'm glad it did.

Whoopsie, spoke too soon.    This is still happening occasionally, although with much less regularity than before.   Never mind...

dano

[lordrichter]

Conspiracy!!!!!

Considering that I personally had issues with McAfee saying my sub was up, and others have had issues with Norton Antivirus doing the same or stalling/erroring during scans

My mistake.  The OP said "firewall" not "anti-virus".  Anti-virus software is not firewall software, even if they are bundled together.  It is not unusual for there to be conflicts with AV software, unfortunately.

SecuROM, as installed by Sims 2 patch 1 on my sandbox PC, does not interfere with my firewall and does not bypass the firewall to access the network.  It also does not phone home, as measured by the log on my separate LAN monitoring platform.

I don't use Norton Internet Security because I don't trust the Norton firewall software.

I don't work for EA or Sony or any company related to SecuROM or Sims 2, either.

[Jelenedra]

I don't use Norton because it's a resource hog. I don't like to share my playing area with pigs.

I use PCillian.

[lemonfresh]

The main reason I say SecuROM is malicious is the fact that it shuts off firewalls without our knowledge.  This leaves machines vulnerable to malware. 

In my experience, this is not fact, at least with respect to the way that Sims 2 is using SecuROM.
I have directly investigated this claim with no success in verifying it.  Although, I am an IT professional, so I might be part of the compiracy.

Conspiracy!!!!!

Considering that I personally had issues with McAfee saying my sub was up, and others have had issues with Norton Antivirus doing the same or stalling/erroring during scans, it's not a huge leap that some firewalls might be seen as The Evil by SecuROM. The thing displays no logic whatsoever. I've seen several people here and on the BBS post that their firewall was turned off or had increased events. Too many to be coincidence.

I also had an obscene amount of blocked events (I'm at tight security level), but more suspect a coincidence in my case. I don't see how the two could be linked. And yes, since SecuROM was removed I've had no--count 'em--no events, but I also banned a whole bunch of EPs at the same time. Can't be sure.

Add me to the list of people who've had their AV software and firewall screwed up because of SecuRom. I just spent the last couple of hours attempting to repair the damage and eventually just doing a complete remove/re-install. I know for a fact that it was SecuRom that did it because I've not installed anything since BV. And both were working perfectly prior to BV. Thankfully I haven't installed anything since BV, as I've had my AV and firewall turned off in an attempt to get BV to actually run! Of course, I removed the garbage as soon as I found out it'd infected my PC, but apparently I was too late to avoid the hassles. I'm so pissed about this SecuRom thing I could spit nails. It'll be a long time before I consider buying any sort of PC game ever again and only after checking that it's not connected with Sony and it's Malware. 

[jmtmom]

A question from yet another non-awesome person. This is what I get when I run the RegDelNull commands



No options to delete anything, no results in the scan (if I'm reading it right)

Yet in my registry, I see the accursed files:






Any words of advice? I did perhaps screw it up by deleting whatever I could before running the scan, several folders of crap in the SecuRom folder. 

[muridae]

A question from yet another non-awesome person. This is what I get when I run the RegDelNull commands (...)
Any words of advice? I did perhaps screw it up by deleting whatever I could before running the scan, several folders of crap in the SecuRom folder. 

Try running the scans again, but put a space between "hkcu" and the "-s". The "-s" is the instruction that tells regdelnull to do the scan, and "hkcu" (or "hku") is the part of the registry that it's actually scanning. Without the space, it's looking for something that doesn't exist.

[jmtmom]

Got rid of the "DO NOT DELETE" with your advice muridae.     I'll keep trying on the other one.

[Zazazu]

It is malware, but the difference between Securom and the stuff in the wild is that it's malware used by legitimate companies.  So they have to show some restraint, unless they want to be the target of multiple lawsuits.

My understanding is that Sony has already been the target of at least one lawsuit related to SecuROM, precisely because of the malware characteristics of this sort of copy protection.  Your argument PHAILS!

tut tut.  My argument did not PHAILS.  Since I said that if they don't show restraint they will be the target of lawsuits and they were.  And that Sony fiasco was far from showing restraint.  That was a train wreck of gigantic proportions. They deserve all the lawsuits they are getting.

Your statement was correct Angelyne. However, they, as the company that got in bed with SecuROM, phail if they try to use this as a justification.

However, unless there is another incident that I am not aware of, at that point they were installing a rootkit on people's computer.  That all of itself was pretty damn rotten to begin with.  But to make matter worse, their rootkit worked by hiding any process, file or registry key that started with $sys$, IIRC.  Holy security vulnerability Batman.  I would think, hope, expect, that after being sued, lambasted, publicly humiliated, drawn and quartered (maybe not that yet), they have learned SOME lesson.  <...truncated...> I've seen lots of people wonder if it's a rootkit.  I've seen many other say no, it's not.  ( I don't think so either....that XCP WAS a rootkit, no doubts about it). 

SecuROM does hide its files. Not only by making them garden-variety hidden, but by making the file names malformed so that they cannot be removed without additional utilities.  Now as for the rest of the rootkit definitition bits, I'm not sure. At best, it's a gray area.

[lordrichter]

Yes, it can provide a backdoor for others to have access to my computer systems. Herein lies the meat of my question.  If I can manage to totally lock down all incoming and outgoing communications for the game executable, the launcher and the uaservice files, does this effectively muzzle securom?

What I am hoping to do is to just stop it from communicating.

My investigation shows that during normal operation, SecuROM is not making a habit of communicating outside of the PC after installed by Sim 2 BV gold or patch 1.  I do not know about the stuff pack because I don't own it, nor am I testing other SecuROM installations that may have come from other games.  I have recorded no instances of communications by SecuROM after installation.  I have not checked DURING installation yet.

The Sims 2 program at BV level does not need to communicate with the outside world.  Mine does not from the start of the game to the neighborhood menu.  I do not use the launcher, I start the Sims directly.

I do not have McAfee, but my experiments with Symantec Anti Virus 9 shows that it SecuROM is not messing with it and it is working and updating fine.

SecuROM does not disable my firewall sofware, either.

I should note that SecuROM is not causing any problems on my sandbox system, as of yet.  The DVD and CD writers both are working normally.  The only symptom I have is that Process Explorer is detected by SecuROM, but that is easily countered.

[morriganrant]

My logs were showing many attempts by Sims2ep6.exe to access the net at start up and during play. I firewalled it and my vanilla, BV game, lag stopped. Eh, I have no idea why it's connecting for some but not for others but it was defiantly showing activity on my machine. I had Norton firewall at the time, I've since ditched it and I am now using windows firewall. Norton seemed to have no problem with letting it through and my free subscription expired a while back so I was in the market for a new one anyway.

[jmtmom]

I do not have McAfee, but my experiments with Symantec Anti Virus 9 shows that it SecuROM is not messing with it and it is working and updating fine.

SecuROM does not disable my firewall sofware, either.

Well my Paid Norton is not working at all. I believe it's SecuRom but I haven't been able to completely get it off my system, that's the only thing that will tell me for sure. I've uninstalled and reinstalled Norton multiple times and followed the instructions they gave me to no avail.

I'm tearing my hair out trying to follow the SecuRom removal instructions posted here. I may give up and reformat, it would be easier and I don't have much to lose on this computer.

[lordrichter]

My logs were showing many attempts by Sims2ep6.exe to access the net at start up and during play.

I think that is Sims 2 behavior, not SecuROM.  Sims 2 does have the ability to check for patches and connect to the Exchange.  I turn that off.

I am continuing to watch this machine as I just use Sims 2 BV normally.  Sims 2 and SecuROM have free run of the computer to do as they please.  Nothing says they have to phone home every day, if they are so inclined to phone home at all.

[morriganrant]

My game has never been set to auto login, I'm aware of the game options. I don't need them to inform me of a patch, I can check that myself. Besides, it's unlikely that I would bother installing an EAxis patch at the moment they announce it, anyway. It would have been one thing if it was just the one attempt, but it was several, over and over.

My guess why, would be that I had installed using a torrented copy. I do have a legal copy but use isos for convenience. I share this computer, it's just easier to have images and no-cd cracks then trusting my significant other to place the cd back in it's box or at least in a place where it will not get damaged.

[angelyne]

 

SecuROM does hide its files. Not only by making them garden-variety hidden, but by making the file names malformed so that they cannot be removed without additional utilities.  Now as for the rest of the rootkit definitition bits, I'm not sure. At best, it's a gray area.

I don't think that's considered to be a rootkit.  If you use rootkit revealer (from Microsoft) and do a scan, you might find a couple of instances of keys with imbedded nulls, and they are actually legitimate.  One of them hides passwords information, IIRC.  A real rootkit hides better that that.  A rootkit is invisible from normal detection means. You need a special tool like the rootkit revealer.  From reading the Tom's Hardware article Securom makes itself difficult to remove and plays a couple of rather unkosher tricks, but it's not truly hidden, or especially difficult to remove. 

But the thing with the process explorer that is just rude!  Process explorer is a legitimate application (from Microsoft no less) and no two bit "security" software with delusions of grandeur should interfere with that!.

Again, not that I am defending that stupid piece of crap software, and the even more stupid decision to implement it.  Just that I am hearing a lot of terms being bandied about that seems to come from a big muddle combining the Securom mess, the Sony XCP fiasco and malware in general.  The XCP WAS a backdoor (the size of a freaking barn), and it WAS a rootkit and it WAS spyware (it phoned home). And you know what else?  On top of civil lawsuits, there was even discussion of criminal charges, and homeland security looked into the case.  a FUBAR of truly gigantic proportions.   Sony was in deep deep doodoo.  Would they be so incredibly stupid as to do the exact same thing again?? I know human stupidity knows no bounds but that's a bit much, even for Sony execs.. Unless the lass bunch have all committed hara-kiri.  Anyway. The thing is so far, I haven't heard any concrete evidence that Securom is a rootkit, even if it exhibits some rootkit like behavior, I've seen nothing to indicate it's a backdoor, and I've seen nothing to indicate it's spyware.  Although it fully fits the definition of malware.

Why does this bug me, and why does it look like I'm defending Securom?  I'm not.  I don't give a rat's ass about it.  It's crap and the sooner it's off your system the better.  But there is a lot of misinformation out there on the subject and it's making people panic.  And panicked people do panicky things like reformat their drives.  And then they come here and complain about loosing everything in the big securom crash of '07.  Blah.  I don't want to hear that.    But seriously.  It's probably because I work in tech support, it goes against the grain to see people freak out about their computers and my professional reflexes kick in.

[angelyne]

I do not have McAfee, but my experiments with Symantec Anti Virus 9 shows that it SecuROM is not messing with it and it is working and updating fine.

SecuROM does not disable my firewall sofware, either.

Well my Paid Norton is not working at all. I believe it's SecuRom but I haven't been able to completely get it off my system, that's the only thing that will tell me for sure. I've uninstalled and reinstalled Norton multiple times and followed the instructions they gave me to no avail.

I'm tearing my hair out trying to follow the SecuRom removal instructions posted here. I may give up and reformat, it would be easier and I don't have much to lose on this computer.

What part of the removal process are you having problems with?  And what is Norton doing ?

[jmtmom]

What part of the removal process are you having problems with?

I was able to take out the "CAUTION!! NEVER DELETE" key using the DOS command "regdelnull hkcu -s" after quite a bit of stumbling. It hasn't yet worked for the "regdelnull hku -s" command. It says it's scanning, but doesn't show anything. I still have the miles long key/folder in my HKEY_USERS and cannot delete it. I have not been able to get the "uaservice7/remove" command to work either. It's rather ballsy or stupid of me to attempt it as I knew nothing about DOS commands when I began.

And what is Norton doing ?

My Norton suddenly shut off completely and instructed me to uninstall/reinstall. It gets as far as configuring, then prompts to uninstall/reinstall  over and over. I got some instructions from Norton Support, but I found myself unable to access all the files even with an Administrator account. I've used their removal tool, downloaded a fresh copy several times. I think one reason I'm even trying to remove the SecuRom rather than reformatting is to prove to myself that it is the cause of my problems. I am pretty close to giving up though and doing just that.

If it matters, I have a VISTA Ultimate 64 bit system on a 4 month old laptop.