View Full Version : Indy label DVDs - Root kits?


setarip_old
20th July 2007, 17:21
It appears that a small producer of "indy" DVDs, "New Yorker Films"/"New Yorker Video", includes a combination of files, which appear to comprise a root kit, on their DVD releases.

The filenames noted on the "Vodka Lemon" release are:

AUTORUN.INF
RGASDEV.SYS
PFHNV7YZ.EXE

A Googlesearch (very limited results) indicates that the file "RGASDEV.SYS" is a creation by Macrovision - and by its title is likely a random seed generator... [/Color]

HyperHacker
20th July 2007, 20:48
Interesting. I've seen a lot of DVDs claim that they need to have the included "Interactual player" installed to be used on a PC. Don't suppose this is another case of malware on the discs?
(I play them in VLC with no problem, BTW. :p)

setarip_old
20th July 2007, 23:18
This has nothing to do with "Interactual player" (which is perfectly legitimate) - and, of course, a root kit is malware - which is the reason I posted this information...

blutach
20th July 2007, 23:46
I'm just waiting for the time that some rootkit arrives to disable/remove the AnyDVD filter driver. I can see with the outrage SONY caused before why they may not try it again but I wonder why no-one else has had a go at it?

Regards

setarip_old
21st July 2007, 00:56
I wonder why no-one else has had a go at it?Perhaps because such a rootkit can be bypassed by simply disallowing/disabling "Autoplay"...

ron spencer
21st July 2007, 01:53
if you have autoplay on you are crazy....simple as that.

if anydvd is running rootkit cannot install anyway.

blutach
21st July 2007, 04:47
if you have autoplay on you are crazy....simple as thatTrue.

Regards

Shinigami-Sama
22nd July 2007, 02:25
if you have autoplay on you are crazy....simple as that.

if anydvd is running rootkit cannot install anyway.

or (terminally) ignorant

foxyshadis
9th August 2007, 02:10
It's not exactly rootkit, but it is Macrovision's "Active Software Protection", a driver designed to (apparently) prevent unauthorized software from accessing the drive. Oddly, it's normally for CDs, not DVD, this must be a newer variation. Not much information about either online. I don't know enough kernel asm to really know what it's doing - although I did find one intentional BugCheck, which is really scary, I hope it doesn't bluescreen when you try to rip it.

As much as it saddens me, after finding this on the latest Rozen Maiden DVD I don't think I'll be buying anything more from Geneon. Then again, including no extra packaging or extras even in the 'special edition' had me considering that already. Man. What a gyp all around.

Mug Funky
14th August 2007, 14:32
yeh, geneon suck. they were the first of the anime people to put ripguard on their discs.

they do make limited unprotected pressings of their discs though :) just not for retail sale.