Username: Password: lost p/w?
home | help | subscribe | search | register
Dreddsnik asks:
Posted by OtherMike (Shmoo) in on October 5, 2005 at 7:27 PM



Autodidact were chit chatting in another thread about something I'd like to run by you all.

A "Poll" ....

How many folks who read here, run a utility such as "Peer Guardian" for blocking unwanted IP addy access. ?
Of those,
How many Don't use, or have never used a P2P app of any kind ?
Of THOSE ...
How many still get hit with "scans" from MediaSentry, Fujitsu, Sony, etc ..?
What are they scanning FOR ?
Do they have the right to do that, especially on machines where NO P2P app is in use ?

It has been put forward that sharing files with an app like Kazaa, waives a users right to privacy for the shared resource ... This I can agree with.

But what right do these entities have to scan machines that these apps are NOT USED on ?


User Comments

Otherindependentm...
Date: October 5, 2005 @ 9:57 PM
I tried peerguardian a little while after it first came out, but never bothered to really learn to understand it all that well. Never did update it, then finally deleted it as it was something I never used enough to fool with.

I used to occasionally browse around Limewire and some of the other p2p apps like Kazaa just to see what was happening, but never bother to try downloading anything. Not much to be had but RIAA crap on those p2p nets (and most of that crap is spoof/fake files anyway I understand.)

I get music from indie sources like Dmusic and such all the time.

Dreddsnik, your poll/question is an important one, but my own browsing/online habits are irrelevant to it. Sorry not to be much help.
Intermediateautodidact
Date: October 5, 2005 @ 10:36 PM
Sorry I can't help either. No peer to peer running here. Between borrowing music from the library and friends, and mp3 blogs, I hardly miss it. And I never ran Peer Guardian, but I would be interested in the results of others' experience.

Question: Will a good firewall block these intrusions? If you're not running a p2p with an open Shared Files folder, that is?
DMembermixerjaexx
Date: October 6, 2005 @ 12:01 AM
I've never tried it (unless it was ever an add-on of Kazaa Lite). Do I P2P programs? 'Freak yeah. My main bitch is Shareaza, and I use a special little bad IP blocker thing from Bluetack.
Intermediatehawk7771
Date: October 6, 2005 @ 2:14 AM
I use protowall with a blocklist manager from Bluetack. Great program for blocking any IP you want. I do not use any p2p at this time. Did at one time with my brother to transfer files. I wish they would copy my hard drive. Just because i use p2p does not give them the right to copy anything on my harddrive. Without my knowledge or my permission. They need my authorization period. Just send a register letter, let a notary public stamp it. Stating that they can not copy harddrive or enter hawk7771 computer by any agent or nonagent or bot. To do so would be violation of the net act. And put a high price tag on it. That if they did it would cost them a lot of 10000000000.
DMemberAccipiter777
Date: October 6, 2005 @ 7:36 AM
I've used PeerGuardian, Its interesting to see what IP's are accessing your computer.
IntermediateRaidHHI
Date: October 6, 2005 @ 10:12 PM
A firewall will block whatever you tell it too. if you don't want ports your not using visible to the net, thats no problem.

Concerning the legality of it, yea, it's perfectly legal. And they aren't targetting you specifically for a scan, they are going through ip ranges; Your computer happened to be on when the scan request was sent to your IP. Nothing malicious about it. I could scan you for ports all day long if I wanted to waste the packets.
AdvancedTheSherminator
Date: October 6, 2005 @ 10:45 PM
I have used PeerGuardian but stopped because of their advocacy of windows xp.
DMembershanklin
Date: October 7, 2005 @ 8:52 AM
I use Peer Guardian 2, and a firewall. I get hit with MediaSentry, Fujitsu and Sony sometimes while I am looking at torrent sites. By the way, what is Fujitsu? I thought they were just hardware.
DMembershanklin
Date: October 7, 2005 @ 8:55 AM
I also use to get hit by the fbi on normal news sites. That seems to have stopped, or they are using ip's that PG2 does not block!
IntermediateDreddsnik
Date: October 7, 2005 @ 9:07 AM
"Dreddsnik, your poll/question is an important one, but my own browsing/online habits are irrelevant to it. "

Actually, yours are the browsing habits ( users like you ) that I am MOST interested in , one who have nothing to do with P2P.
Are the Non-P2P users being scanned.

"Concerning the legality of it, yea, it's perfectly legal. And they aren't targetting you specifically for a scan, "
That's one of the things I wondered about ....

Those things in mind ....

Mediasentry scans schmoo, who uses no P2P, finds something they don't like and sues him. ( Schmoo would prolly fight ).

I guess THATS my problem with this scanning for open ports by mediasentry and other industry entities.
Could this be part of one of the RIAA "evidence gathering"techniques ?
How many of those who are being sued ( and those who have settled ) had NOTHING TO DO WITH ANY P2P, and were "identified" through something MediaSentry is using to "Sweep" ?

How else could someone who doesn't have any P2P software get sued ?
IntermediateDreddsnik
Date: October 7, 2005 @ 9:48 AM
"I get music from indie sources like Dmusic and such all the time."

And how many of those are "Cover" tunes of "Industry" music ?
They have sued by filename alone.
IntermediateRaidHHI
Date: October 7, 2005 @ 10:04 AM
Dreddsnik,

" Mediasentry scans schmoo, who uses no P2P, finds something they don't like and sues him. ( Schmoo would prolly fight ). "

Port scanning doesn't breach your computer man. You can't simply connect to a random port and start pulling a directory list. Hacking can be easy, but it's still not like the movies. :) (Smile)

You don't have anything to worry about, it's entirely normal for your computer to be scanned by thousands of others. Scanning is harmless. It merely tells the scanning computer which ports, if any you are listening on. That does not guarantee they can access any information on your computer, You still need a server on that port to listen for incoming connections.

Really, it's harmless.
RockgdZiemann
Date: October 7, 2005 @ 11:49 AM
No PeerGuardian. No MediaSentry. No p2p apps. No Windows machines. No problems.
IntermediateRaidHHI
Date: October 7, 2005 @ 2:13 PM
GdZiemann,

"No Windows machines. " Windows machines? I didn't know microsoft made windows machines. I was under the silly impression that windows was an operating system, not a computer.

Oh wait.. your a mac user.. nevermind. :) (Smile)

IntermediateRaidHHI
Date: October 7, 2005 @ 2:13 PM
Gdziemann,

I almost forgot, windows has nothing to do with being scanned. It's completely OS neutral as far as scanning goes. heh....

Your precious mac probably gets scanned too. :) (Smile)
Intermediateautodidact
Date: October 7, 2005 @ 2:40 PM
"You don't have anything to worry about, it's entirely normal for your computer to be scanned by thousands of others. Scanning is harmless. It merely tells the scanning computer which ports, if any you are listening on. That does not guarantee they can access any information on your computer, You still need a server on that port to listen for incoming connections.

"Really, it's harmless."

Your statement raises more questions than it answers. Why would thousands of other computers be looking to see which ports are open if they can't do anything with that information?

More specifically, why would the federal bureau of infection or MediaSenntry or anybody else be caring which of Schmoo's or ziemann's ports are open.

Harmless, shmarmless. There's something you're not telling us.
IntermediateDreddsnik
Date: October 7, 2005 @ 2:42 PM
Raid ....

How tough WOULD it be for someone to write a custom client to search computers using fastrack protocol ?
( pardon my terminology ).
This is what my "paranoid mind" thinks they industry snoops are doing to avoid any potential EULA conflicts.
IntermediateDreddsnik
Date: October 7, 2005 @ 2:54 PM
"Harmless, shmarmless. There's something you're not telling us. "

Not necessarily.
But there there MUST be SOME purpose to scanning for open ports, else they wouldn't bother.
Myself as an example .....
I have a large library of MP3 files ( made from my own media ), and a large library of E-books.
In my home, I have four networked computers, mine, my wife's, and 1 for each of my kids.
Both "libraries" are in shared folders, so that any of the four networked machines can use them. They are NOT intended to be shared outside my LAN.
Is it possible ( I THINK it is ) that those open ports could be used to search my INTERNALLY shared resources ?
The scan in and of itself, may be harmless. but when the open ports are discovered ??
Thats kinda what I am getting at here.
They "pop in" , see stuff that is "copyrighted", get my name from the ISP, then sue ....
Even though, none of those shared files are intended to be shared, I get pulled into a prohibitively expensive battle with a mega-cartel.
How many of those who settled were in that exact boat ?
This is why it is so important that the RIAA is FORCED to reveal their "proof".
Forced to reveal the EXACT methods they use to get their "proof".
I don't think Raid is intentionally witholding information in this case.
The RIAA is though.
IntermediateRaidHHI
Date: October 7, 2005 @ 3:21 PM
autodict,

"Your statement raises more questions than it answers. Why would thousands of other computers be looking to see which ports are open if they can't do anything with that information?"

Considering that theres millions of computers online at any given moment, a few thousand scans isn't a bad thing.

Not all of the computers scanning you are looking for copyrighted files. Some are zombie machines which have already been rooted, they are seeking out other vulnerable machines to recruit. At one point, I had control of well over 1200 zombie boxes.. due to a small program I released a few years ago. It would scan subnets for ips, and try to breach the windows os (same trick blaster used). Once succesful, your computer searched out others, and securely emailed me that they were online and awaiting orders.

Really tho, the riaa is one scanner entity. Some systems are scanned for os type, os version, ftp services (if any), and depending on the results you get back, decides what you should do next. Some boxes aren't worth the time required to breach them, and others are so easy, You just couldn't pass it up.

IntermediateRaidHHI
Date: October 7, 2005 @ 3:23 PM
Dreddsnik,

Short of your computer having a security exploitability that isn't known and not protected against, your computer isn't too likely to cough up information to any scanning devices. Since you mentioned your on a LAN, I'm assuming your using a router/firewall deal. In that event, nothing inside the lan is visible to the net. As far as the internet is concerned, your one entity; It doesn't know how many computers you have.
AdvancedTrueAudio
Date: October 7, 2005 @ 3:36 PM
I will step in here.

1st off peerguardian sucks compared to Protowall. FORGET about peerguardian, it uses more resources than protowall and it does not respond as instantaneously as protowall does (Protowall 2.01 build 7 pwns).

Protowall (updated with Blocklist manager) is a driver that goes right into the network stack, it is also rock solid stable. I've used it for over 2 years now.

Protowall is NOT a firewall and no firewall can effectively do what protowall does. Protowall 100% prevents ANY COMMUNICATION FROM GOING TO (which firewll doesnt prevent-info FROM your PC) as well as anything in its IP blacklist range from incoming to your machine.

Protowall is a must have for anyone who uses a PC, because it provides invaluable protection against Spyware, CWS Hijack websites, Malware, known websites that can infect your computer just by going to the site (there is no better protection vs. those types of threats than preventing them from even **accessing** your machine. It massively mitigates the need to worry about anti spyware, trojan programs running on an XP maschine, and as importantly it protects your privacy to a large degree because you can visit sites and other parasitic companies IP addresses will NEVER KNOW you were there because communication to them was blocked before any IP, TCP/IP packets have a chance to respond (they DON'T respond).

IMHO I would bet that almost EVERYONE of the 15,000 people sued by the RIAA would have instead been maybe 5-10 people sued (from other means of detection) if they all had protowall installed, updated and running, they would never have even KNOWN that anyone was sharing their shit.

to quote TheSherminator "I have used PeerGuardian but stopped because of their advocacy of windows xp."

Well I'm not sure about PG, but I would guess that the "advocacy" for XP (as for Protowall). Is because that it won't WORK on windows 98, ME etc, because the older O/S's do not support that type of filtering protocol in the TCP/IP stack.

I don't see why people are so against XP (I do but if you know alot about computers, XP is fine). Its real simple TheSherminator. There's utilities and or reghacks you can do to completely kill ALL of the listening ports on windows XP, there is a tutorial to completely REMOVE windows media player 9 so you don't have to live with the DRM from that.

I have used Linux Fedora Core 3, Vector Linux, and Linux is great yes, but, Linux doesn't have much in the way for options to rip DVD content (I dont like being limited to one or 2 fucking programs). Doesn't have that great of support for DVD playback in general. You can't run Exact Audio Copy or Plextools on Linux (which are the 2 best audio ripping programs in existence) you cant run ANyDvD on Linux.

Linux Windows Emulators like WINE suck ass and are slow as hell. So bottom line is for what **I** use and for what I want to use my computer for, until Linux has FULL capability to use any Windows based app that I want, Linux will be relegated to a back seat, opnly to be used for specialized purposes (i.e. IPCOP, or IPCHAINS based firewall etc.)

My WIndows XP is locked the fuck down, I dont ever use windows update and it is disabled as well as about 500 other things disabled/removed that are security risks or useless piece of shit aspects of the operating system. There are highly stripped down versions of XP available if you look around, one that's even less than 300MB that fully functional and will boot and let you install shit and setup anything you normally would, without all the crap.

ALso Linux doesn't support protowall, Protowall is so important as far as I am concerned that until someone develops a version of it for Linux, I won't use it for anything Internet based outside of a firewall itself. Like I said, even a Linux firewall will not prevent unsolicited communication FROM your PC, AND it won't stop you from receiving IP packets (and thus your IP being reported back) if you are at a website with malicious components or traps, (i.e. monitored by the FBI etc). Protowall by default blocks Bogons or unnassigned , fake IP addresses incase the authorities are trying to hide their identity from you, it blocks them anyways because it assumes these IP's are dangerous. It also blocks FAKE fileservers. It kicks them in the balls, hard. Don't forget using a hosts file with XP also

http://www.bluetack.co.uk/index.php





AdvancedTrueAudio
Date: October 7, 2005 @ 4:03 PM
To RaidHHI: I quote part of your above statement:

..."Port scanning doesn't breach your computer man. You can't simply connect to a random port and start pulling a directory list. Hacking can be easy, but it's still not like the movies. :) (Smile)

You don't have anything to worry about, it's entirely normal for your computer to be scanned by thousands of others. Scanning is harmless. It merely tells the scanning computer which ports, if any you are listening on. That does not guarantee they can access any information on your computer, You still need a server on that port to listen for incoming connections.

Really, it's harmless."

Let's see RaidHHI, go a google search for "Blaster worm, or virus" remember that ? It only hit several hundred million computers throughout the world and caused what was claimed to be around $4,000,000,000 in damages.

How did this get in peoples PC's? Just by being TURNED ON, without anyone even having to be THERE. If they didnt have an adequate firewall, the Blaster Worm propagated from the Internet itself right into the open port that it was looking for, right to the Hard drive, and BAM "NT SYSTEM AUTHORITY, YOUR COMPUTER WILL BE SHUTTING DOWN IN 30 SECONDS".

Do you have any idea of the impact this had? I was working for Dell COmputer Corporation when this hit, and we have thousands of phonecalls from computer inept people screaming at the top of their fucking lungs wonder why the fuck their entire e-business got kicked the fuck off the net. BANKS were shut the fuck down, in several states, entire divisions of the Department of Motor Vehicles, were shut the fuck down, all because of a probing "scan"/worm that said "heh!! look an open port! woot, lets zip on in and fuck up this computer!!"

If your belief was true, RaidHHI, this problem would have never been solved. Having visible, open ports is potentially dangerous, and that illustrates it in spades. Maybe you have some helpful insight in the realm of wireless networking next?

There is no such thing as perfect security, you can have "good" security, or "better" security, but no security is 100% completely invulnerable, at least, not indefinitely for sure.

IntermediateRaidHHI
Date: October 7, 2005 @ 6:41 PM
"Let's see RaidHHI, go a google search for "Blaster worm, or virus" remember that ? It only hit several hundred million computers throughout the world and caused what was claimed to be around $4,000,000,000 in damages."

Yes, I remember it. I already said I wrote something that used the same exploit...

"How did this get in peoples PC's? Just by being TURNED ON, without anyone even having to be THERE. If they didnt have an adequate firewall, the Blaster Worm propagated from the Internet itself right into the open port that it was looking for, right to the Hard drive, and BAM "NT SYSTEM AUTHORITY, YOUR COMPUTER WILL BE SHUTTING DOWN IN 30 SECONDS"."

Actually, it got in because people were on broadband connections with no firewall of any kind, running a vulnerable copy of windows xp. The blaster worm isn't difficult to remove, and it's certainly not rocket science to secure a box from it.

"Do you have any idea of the impact this had? I was working for Dell COmputer Corporation when this hit, and we have thousands of phonecalls from computer inept people screaming at the top of their fucking lungs wonder why the fuck their entire e-business got kicked the fuck off the net."

I'm a former virus writer myself, I'm well aware of the impact blaster had. It's author intended for that surprise. If they are running an e-business that is not firewalled, sorry buddy, but they are incompetent.

"If your belief was true, RaidHHI, this problem would have never been solved. Having visible, open ports is potentially dangerous, and that illustrates it in spades. Maybe you have some helpful insight in the realm of wireless networking next?"

Open ports depending on which ones are open, and the services in question, can be dangerous. Blaster didn't simply attack a port, It took advantage of a buffer exploit in an NT service that monitored the port. This isn't magic man.

Now then...As for my helpful insight as it were, I strongly suggest you look up "raidslam" before you try belitting me again, kiddo. I'm one of "those" people your scared of.

"There is no such thing as perfect security, you can have "good" security, or "better" security, but no security is 100% completely invulnerable, at least, not indefinitely for sure."

And that's not entirely true, either. It depends on the os, the firewall, the services your running... etc, many factors.
IntermediateRaidHHI
Date: October 7, 2005 @ 6:42 PM
"Protowall is NOT a firewall and no firewall can effectively do what protowall does. Protowall 100% prevents ANY COMMUNICATION FROM GOING TO (which firewll doesnt prevent-info FROM your PC) as well as anything in its IP blacklist range from incoming to your machine."

Protowall is nothing more then an IP filter. A firewall can easily be configured to let your box talk only to some ips, if you wanted. Why do you seem to think this is advanced technology? It hijacks the lspstack, if it sees a known IP, it doesn't allow access... Woopie fucking do, rocket science my ass.
IntermediateRaidHHI
Date: October 7, 2005 @ 7:21 PM
Actually, from a programming standpoint, the essential algorithms is likely not very complex at all. You simply load the database, or perhaps index file system structure.. whatever the author is doing, and compare incoming/outgoing connections to the memory resident database. You may have some customized search routines to speed up comparison times, but the underlying principle isn't much more complicated then my BugHunter program. Come to think of it, it's probably of equal or lesser complexity. It simply has to compare an ip to one it might know. hehe.. No hashing routines, no file io routines... aside from tcp/ip communication. Easier to code... yes...If windows net based applications are your thing.

But, really, it's a glorified, "if ip=bad then block else scanformorematches"
AdvancedTrueAudio
Date: October 7, 2005 @ 7:24 PM
"Yes, I remember it. I already said I wrote something that used the same exploit..."

You said? where? I could give a damn what you might have said in some other post, I've only cited this one post, why should I bother to peruse your (or anyone elses) other posts just so that I know your background? I could give one shit, much less 2, and why would someone waste their time finding out about something you said before? Who cares? I don't.

"Actually, it got in because people were on broadband connections with no firewall of any kind, running a vulnerable copy of windows xp. The blaster worm isn't difficult to remove, and it's certainly not rocket science to secure a box from it."

--"Actually" no shit Jack, it was fucking assumed that they were connected to the Internet when I said they didn't have to be there, fucking nitpicky huh?, the point was made, I can be somewhat succinct, common sense of readers can fill in the blanks, if they have common sense.

"Open ports depending on which ones are open, and the services in question, can be dangerous. Blaster didn't simply attack a port, It took advantage of a buffer exploit in an NT service that monitored the port. This isn't magic man."

Yes, no shit once again, I'm not writing an essay in a college class here, your not correcting anything I've said, your just adding to the details because it must make you feel like your accomplishing something.

By the way, don't put words in my mouth, show me where I said it was "magic"? I didn't say it was.

"Now then...As for my helpful insight as it were, I strongly suggest you look up "raidslam" before you try belitting me again, kiddo. I'm one of "those" people your scared of."

Raidslam? why should I look that up? Are you implying to me that you wrote it? Guess what? --don't care

There is no such thing as perfect security, you can have "good" security, or "better" security, but no security is 100% completely invulnerable, at least, not indefinitely for sure.

"And that's not entirely true, either. It depends on the os, the firewall, the services your running... etc, many factors."

Grandstanding is a rush, isn't it? You might be thinking to yourself: Let's see how powerful I can feel by trying to appear more astute than everyone else, I might even make online friends.

"Protowall is nothing more then an IP filter. A firewall can easily be configured to let your box talk only to some ips, if you wanted. Why do you seem to think this is advanced technology? It hijacks the lspstack, if it sees a known IP, it doesn't allow access... Woopie fucking do, rocket science my ass."

Congratz on more words being put in my mouth again, "rocket science my ass"? who said that?--scroll up

By the way, have fun taking the time to put in 3,011,538,922 IP addresses in a firewall to block. Or instead, whitelist the other remaining30% or so, that sounds like alot of fun having to whitelist IP addesses I don't even know I might want to visit, then having to take the time to find their IP range for every website that I want to allow, and go back into my router and enter it in, yup ok. Sorry I don't have years of real time to waste on something a driver can be set up to do in 10 minutes.

What Protowall does is simple, yes, but it is very effective. For example, someone may be trying to monitor the IP addresses connected to a particular torrent tracker, they may well be doing this from a computer that is on Protowalls IP blacklist, thus preventing those prying eyes from seeing YOUR IP address show up in their Bittorrent app, because it is disallowing any packets from travelling to OR from that monitoring computer. No rocket science, just a good decision as part of internet security. Take any further incendiary comments and throw them at the website that created the program and see how much more time you can waste.

If you feel like your being belittled, cry me a river.

As far as any further response you might have to this, all I have to say is this: You can't scare a hooker with a dick.
IntermediateDreddsnik
Date: October 7, 2005 @ 9:00 PM
"Grandstanding is a rush, isn't it? You might be thinking to yourself: Let's see how powerful I can feel by trying to appear more astute than everyone else, I might even make online friends."

Ok,
Raid hasn't "exactly" made a lot of freinds here, per se, but attacking him realy wasn't necessary. I asked, because I don't know, he gave an answer by his point of view, a good one, that I can examine, research and learn from. You posted a huge ad for Protowall.
That's ok, it's another potential answer that I can look up and research.
Diverse answers to a complex question.

Thank you both.
AdvancedTrueAudio
Date: October 7, 2005 @ 10:30 PM
AdvancedLachatte
Date: October 7, 2005 @ 10:41 PM
Great link, TrueAudio. Thanks. :) (Smile)
DMembergfmlcka
Date: October 8, 2005 @ 4:23 AM
You can see which ports on your computer are open by going to the ShieldsUp section of this website:

http://www.grc.com/default.htm

DMembergfmlcka
Date: October 8, 2005 @ 5:24 AM
To answer the poll, I'm behind a properly configured router, use Zone Alarm Pro with high security settings and have a huge hosts file. I have XPSP2 locked down and grc reports all my ports as stealthed. P2P apps I use are Kazaa Lite K++, eMule,Azureus and BitComet. The only intrusions ZA reports (5 in the past year) are when I'm running a P2P app and I have my router open for TCP/UDP traffic on the default ports. Some wiseguys doing netstat -a while I'm peering with them is all.
DMembergfmlcka
Date: October 8, 2005 @ 5:38 AM
There's nothing wrong with being scanned unless you have a service or malware listening on a port. Get a NAT router, keep an up to date ipfilter.dat file with your favorite firewall,
don't use IE or OE, keep your OS patched and you'll be pretty safe from all but the most determined intruders whether you use P2P or not.
Otherindependentm...
Date: October 8, 2005 @ 9:17 AM
"there is a tutorial to completely REMOVE windows media player 9 so you don't have to live with the DRM from that."

Link me to it! I want rid of WMP 9 asap. (I foolishly downgraded to it last year.)
Intermediatesurfside6
Date: October 8, 2005 @ 10:01 AM
Oh common guys!!!
You get hits on peergaurdian from just linking to their symbol. There is no scan just you are trying to link to their computer, just so happens that the symbol or picture resides on a blocked computer.

It happened on this website about a year or two ago when a article was posted and linked the riaa symbol to their site. Everyone was complaining.

DMembergrumpygeezer
Date: October 8, 2005 @ 1:09 PM

"There are highly stripped-down versions of XP available."

TrueAudio, can you provide a clue as to where they're available?

AdvancedTheSherminator
Date: October 8, 2005 @ 1:52 PM
surfside - That's why peerguardian sucks.
AdvancedTrueAudio
Date: October 8, 2005 @ 2:12 PM
To Independentmusician:
REMOVING WMP9 FROM XP, FOR REAL
Here is the info you requested, mind you, it does NOT work if you have Service Pack 2 for XP installed (nice way for Micro$sucks to cockblock the techies out there, bastards).

http://erpman1.tripod.com/current/wmp9del.htm


"Uninstalling Windows Media Player 9.0 Completely under Win98se, 2000, ME & XP pre-SP2:
Updated: Monday September 26, 2005

WARNING: Do NOT attempt to uninstall Windows Media Player 9 if you have Service Pack 2 installed
under Windows XP. This tip will only work for users who are using the original, SP1 or SP1a version
of WinXP. If you want to remove WMP9 under WinXP SP2, just uninstall SP2. Note that the tips mentioned
here can cause loss of personal settings & playlist files for WMP9, so backup your WMP license files,
personal user settings & playlist files before performing the WMP9 removal process if you want to save them.
AND these tips are not for the 64-bit editions of Windows XP and all editions of Windows Server 2003.
Follow the directions very carefully. Also, do NOT FOLLOW THESE TIPS IF YOU HAVE WINDOWS
MEDIA PLAYER 10 INSTALLED! The tips are for WMP9 ONLY, NOT for WMP 10!


For those using Win98se or WinME run the following command in Run dialog box:
RunDll32 advpack.dll,LaunchINFSection C:\Windows\INF\wmp.inf,Uninstall
Then click Yes to continue & restart the computer.

For those using Win2000 or WinXP run the following command in Run dialog box:
RunDll32 advpack.dll,LaunchINFSection C:\Windows\INF\wmp.inf,Uninstall.NT
Then click Yes to continue & restart the computer. Win2000 users should note that the default Windows
folder is the WinNT folder instead of Windows; look for the wmp.inf file in the 'C:\WinNT\INF' folder.

Note that running the command to 'uninstall' WMP9 does NOT remove all the files that came with the
WMP9 setup package. The uninstaller only removes the essential files required to run WMP9 and it does
not remove some of its registry entries.
After rebooting delete the following files from the following folders---

from the 'c:\windows\system\catroot\{--GUID--}' folder if using Win98se/WinME
from the 'c:\winnt\system32\catroot\{--GUID--}' folder if using Win2000
from the 'c:\windows\system32\catroot\{--GUID--}' folder if using WinXP
where {--GUID--} is the random GUID number of your machine; delete the following:
------------
drm.cat setup_wm.cat WMFSDK.cat wmdm.cat wmp.cat
------------
(on certain versions of Windows some of the above files may already be deleted
so just delete the remaining files)

from the 'C:\Windows\Inf' or 'C:\WinNT\Inf' folder delete the following:
------------
drm.inf skins.inf unregmp2.exe wmdm.inf WMFSDK.inf wmp.inf
------------
(in WinXP, you may be prompted to insert your XP CD so that it can restore
its version of the unregmp2.exe file; in Win98se, 2000 & ME some of the
above files may already be deleted so remove the remaining files)

from the 'c:\program files\windows media player' folder delete the following:
------------
npdrmv2.dll npdrmv2.zip npwmsdrm.dll pidgen.dll setup_wm.exe wmpband.dll wmplayer.exe
------------
(in WinXP, you may be prompted to insert your XP CD so that it can restore the npdrmv2.dll, npwmsdrm.dll,
setup_wm.exe & wmplayer.exe files; if you have Mozilla, Netscape, Opera or Firefox web browser
installed delete the npdrmv2.dll, npdrmv2.zip, npdsplay.dll & npwmsdrm.dll files from the browser's
Plugins folder)

and finally delete the following files from your Windows System folder:
c:\windows\system\ if using Win98se/WinME
c:\winnt\system32\ if using Win2000
c:\windows\system32\ if using WinXP
------------
asferror.dll blackbox.dll cewmdm.dll drmclien.dll drmstor.dll drmv2clt.dll laprxy.dll
logagent.exe mp43dmod.dll mpg4dmod.dll mp4sdmod.dll msnetobj.dll mspmsnsv.dll mspmsp.dll
msscp.dll mswmdm.dll qasf.dll wmadmod.dll wmadmoe.dll wmasf.dll wmdmlog.dll wmdmps.dll
wmerror.dll wmidx.dll wmnetmgr.dll wmp.ocx wmpasf.dll wmpcd.dll wmpcore.dll wmploc.dll
wmpshell.dll wmpui.dll wmsdmod.dll wmsdmoe2.dll wmspdmod.dll wmspdmoe.dll wmvcore.dll
wmvdmod.dll wmvdmoe2.dll
------------
(if using WinXP, insert your XP CD to restore many of the WMP files that were stored
in the system folder)

Now open registry editor (regedit.exe) and delete the following registry keys:
HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer
HKEY_CURRENT_USER\Software\Microsoft\Windows Media
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer

Open Windows Explorer and delete the following folders if using Win98se or WinME and you don't want
to keep the user settings stored in the following folders:
'C:\WINDOWS\All Users\Application Data\Microsoft\Media Index'
'C:\WINDOWS\All Users\Application Data\Microsoft\Media Player'
'C:\WINDOWS\Application Data\Microsoft\Media Player'
If using Win2000, look in the WINNT folder instead of the WINDOWS folder and follow the above directions.
If using WinXP, look in the 'Documents and Settings' folder instead of the Windows folder
(ex. 'C:\Documents and Settings\All Users\Application Data\Microsoft\Media Player'). Now delete
the Media Index & Media Player folders.
If user profiles are installed, delete the following folder (where 'username' is the name of the currently
logged on user:
'C:\WINDOWS\Profiles\username\Application Data\Microsoft\Media Player' (for Win98se/WinME)
'C:\WINNT\Profiles\username\Application Data\Microsoft\Media Player' (for Win2000)
'C:\Documents and Settings\username\Application Data\Microsoft\Media Player' (for WinXP)

Also delete the wmsetup.log, WMSysPr9.prx & WMSysPrx.prx files from the Windows or WinNT folder.
Then delete the DRM folder from the Windows or WinNT folder. Then reboot and you're all done.

Now you can install an older version of WMP like WMP 7.1 under Win98se, 2000 or ME. Just simply
download & run the WMP 7.1 installer with the /Q switch to quietly install all the Media Player components.
You may need to install or re-install WMP 7.1 twice [once with the /Q switch and then run it normally but
choose the option to Reinstall All Components; this will re-install all WMP files and reset registry settings].
You may also want to download & install ALL of the Windows Media Codecs packages so that you can
open new Windows Media Audio & Video files in WMP 7.1 or WMP 6.4. Get the WM codecs packages
listed at my IE/WMP Updates page. To fully restore WMP 8 for WinXP run the System File Checker tool
with the /scannow switch from the Command Prompt or Run dialog box [ex. sfc /scannow], insert your
WinXP CD and when the SFC tool is done restoring all the WMP8 files from the XP cd, restart the computer.
Then extract the wmp.inf file from the wmp.in_ file from your XP cd-rom and place the wmp.inf file into the
'c:\windows\inf' folder (overwrite if necessary). Extract the wmplayer.chm file from the wmplayer.ch_ file
from the XP CD and place the wmplayer.chm file into the 'c:\windows\help' folder (overwrite if necessary).

Then run the following commands in the Run dialog box:
rundll32.exe setupapi,InstallHinfSection InstallWMP64 132 c:\windows\inf\mplayer2.inf
(direct the installer to the I386 folder of your XP cd-rom)

rundll32.exe setupapi,InstallHinfSection InstallWMP7 132 c:\windows\inf\wmp.inf
(direct the installer to the I386 folder of your XP cd-rom)

Now restart the computer and test out Windows Media Player 8. If WMP8 loads, great. If not and you get
an error message trying to run WMP8, check to see if all the Media Player 8 files have been restored by
WinXP [some files may still be missing]. Look in the following folders for the essential files:

'c:\program files\windows media player'
------------
npdrmv2.dll npwmsdrm.dll setup_wm.exe wmplayer.exe wmpvis.dll
------------

'c:\windows\system32'
------------
asferror.dll asfsipc.dll blackbox.dll cewmdm.dll drmclien.dll drmstor.dll drmv2clt.dll laprxy.dll
logagent.exe mpg4dmod.dll msnetobj.dll mspmsp.dll mspmspsv.dll msscp.dll mswmdm.dll
qasf.dll wmadmod.dll wmadmoe.dll wmasf.dll wmdmlog.dll wmdmps.dll wmerror.dll wmidx.ocx
wmnetmgr.dll wmp.ocx wmpcd.dll wmpcore.dll wmploc.dll wmpshell.dll wmpstub.exe wmpui.dll
wmsdmod.dll wmsdmoe.dll wmstream.dll wmvcore.dll wmv8dmod.dll wmvdmod.dll wmvdmoe.dll
------------

If some of the files mentioned above are missing or in the wrong version, gather them from your Windows XP
cd-rom, overwrite the files if necessary, run the mplayer2.inf & wmp.inf Install commands again from the
Run dialog box and restart the computer & run WMP8 again. It should work for sure. Then you can install
updated WM Codecs packs so you can play Media Player files in newer formats in WMP8.

Note: You can also use the tips above to remove WMP9 build 3250 after installing updated WMP9
files from XP SP2 over the original WMP9 package; to install the WMP9 files from XP SP2 onto
Win98se/WinME, see Axcel216's Win98 Tips & Secrets part 5 page. You must have at least 2 computers
[one using XP, the other using Win98se or WinME] to perform the tip."

AdvancedTrueAudio
Date: October 8, 2005 @ 2:24 PM
To: grumpygeezer
http://thepiratebay.org
search for
Stripped to the Bone Edition

Also another link and more info on removing DRM.

http://www.mdgx.com/98mp10/READ1ST.TXT


HOW TO REMOVE DRM
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
DRM [Digital Rights Management] built-in WMP "feature" can be completely
uninstalled by deleting these files from:
- %windir%\SYSTEM [usually C:\WINDOWS\SYSTEM]:
BLACKBOX.DLL
DRMCLIEN.DLL
DRMSTOR.DLL
DRMV2CLT.DLL
MSNETOBJ.DLL
- C:\Program Files\Firefox\Plugins [example = installed only if
Netscape/Mozilla/Firefox web browsers detected]:
NPWMSDRM.DLL
NPDRMV2.DLL
NPDRMV2.ZIP
Cut + paste lines below into Notepad or better plain text editor/viewer, name
it DELDRM.REG [example] and run it to delete these Registry keys to avoid
errors after deleting files above:

-----Begin cut & paste here-----
REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Multimedia\Components\DRM]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\Software\Microsoft\Multimedia\Components\Informational\DRM_DRM]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\DRM]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{760C4B83-E211-11D2-BF3E-00805FBE84A6}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{A9FC132B-096D-460B-B7D5-1DB0FAE0C062}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib\{8AA720BF-7468-4DA1-97DA-66D2E41B3DDA}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{9EA69F99-F8FF-415E-8B90-35D6DFAF160E}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\Software\Microsoft\Multimedia\Components\Installed\DRM_DRM]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib\{760C4B74-E211-11D2-BF3E-00805FBE84A6}]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\DRM.GetLicense.1]
[-HKEY_LOCAL_MACHINE\Software\CLASSES\DRM.GetLicense]

------End cut & paste here------

Eat that Steve Ballmer, you fucking Nazi son of a bitch
DMembergrumpygeezer
Date: October 8, 2005 @ 3:00 PM

Awesome!!!
(Hey, thanks, man!!)
DMembergrumpygeezer
Date: October 8, 2005 @ 3:03 PM

How were you (or any else along with you) able to figure all that out??
(I'm wowed!!)
AdvancedTrueAudio
Date: October 8, 2005 @ 3:38 PM
I didn't figure anything out. I simply used the power of the Internet to search as hard as hell for info I knew had to exist somewhere. It took me along time because those links will not come up with standard searches that you think they would be found under.

In times like these, it is more important than ever to debunk the bullshit spewed from mainstream sources that don't know their head from their ass, or especially from the source itself, i.e. Microsoft. The more people that see the truth behind all this bullshit, the more people will get pissed off enough to do something about it and actually give people a real reason to boycott a company.

Words are nothing, providing proof that can be done yourself showing how hellbent Microsoft has been becoming the **AA's Buttbuddy and incorporating layers of shit programming to try to control what the fuck the customers want to do with their own stuff (as you can see by the very LENGHTY pain in the ass process of removing WMP9 from XP).

This is why open Source decimates proprietary shit, and its also why you can bet your ass that within this year or the next year, watch MSFT, RIAA, and MPAA etc cry to our dishonarable piece of shit US Senators to try and cockblock Open Source software development, if that EVER happens, all the trouble were having as a country atm with regards to Copyright will pale in comparison.

I hope this info convicnces 50,000 people to never use WMP 9 or 10, and keeps them away from Vista, if people don't know the facts--if they can't even have the opportunity of getting the info, then as a society we will parallel the old Soviet Union where you could be executed for reading a fucking book that they didn't "approve".

Seek information, and you shall find, the more that do, the faster the lies can be made known to the public and challenged by the public, and we might even get people to care that never did before.
AdvancedTrueAudio
Date: October 8, 2005 @ 3:53 PM
"-----Begin cut & paste here-----
REGEDIT4"

IMO Regedit4 must have been a typo from the original website, because there's no such command, just delete the "4" off the end.

DMembergrumpygeezer
Date: October 8, 2005 @ 5:11 PM

You have provided a valuable service, and it's much appreciated. Not only for the practical solutions dealing with WMP 9 & 10, DRM, and Vista, but for emphasizing how sinister the manipulative storm clouds are gathering. As you say, more people need to become aware of what's going on -- then there could be a chance for change.
That gives hope.
And forums like this one can be part of the process.
IntermediateDreddsnik
Date: October 8, 2005 @ 7:07 PM
"Oh common guys!!!
You get hits on peergaurdian from just linking to their symbol. There is no scan just you are trying to link to their computer, just so happens that the symbol or picture resides on a blocked computer. "

Sure, I know that.
Problem is, I still get "scanned" when NOTHING IS RUNNING. No browser running. Nothing is the taskbar. Nothing running that shouldn't be.
I am aware that I get PG "hits" when surfing, from Icons, random ads and such.
But when this machine is sitting Idle, anything else is active scanning for open ports.
IntermediateDreddsnik
Date: October 8, 2005 @ 7:08 PM
""There are highly stripped-down versions of XP available."

TrueAudio, can you provide a clue as to where they're available?"

Got mine through Demonoid :) (Smile)
AdvancedTrueAudio
Date: October 8, 2005 @ 7:45 PM
"TrueAudio, can you provide a clue as to where they're available?"

If you look closer, scroll up.

" I am aware that I get PG "hits" when surfing, from Icons, random ads and such.
But when this machine is sitting Idle, anything else is active scanning for open ports"

Understand the significance of an IP blocker, when you visit a website, there might be a dozen or more companies who are soliciting information from anyone who visits a website, and you would never know it unless you have something that blocks malicious IP's

For example: Lets say someone wants to check out run of the mill legal adult porn. By just going to such a site, your IP address may get forwarded to an anti-child p0rn organization, and or the FBI. Even if what your looking at or for is completely legal, they have absolutely no fucking business knowing you were ever there, just like they have no business what goes on in your own home.

You might want to look up a way to defeat the next DRM scheme implemented into something, and when you search for it, the website might have prying eyes by the MPAA/RIAA who want to know WHO is trying to find out how to break a protection, and someday in the future, people might fucking get sued just for TRYING TO FIND SOMETHING OUT. You might get sued just for talking about something.

The people who hunt these sub-human scumbag gestapo members down, dig really deep, and hunt around and find out wtf computers, backbones, ISP's these bastards use, and they update it all the time, keeping their fucking eyes and ears out of your personal business.

The other thing that's common sense is to get a good router, don't JUST get a NAT router, get an SPI firewall -stateful packet inspection. These are alot better.
DMembergrumpygeezer
Date: October 9, 2005 @ 3:22 AM

Good information!
DMembergrumpygeezer
Date: October 10, 2005 @ 4:00 AM

P.S.
TrueAudio, do you know why this search doesn't produce results today? It did the other day.

http://thepiratebay.org
search for Stripped to the Bone Edition

IntermediateRaidHHI
Date: October 10, 2005 @ 5:30 AM
Piratebay is a fast moving site Grumpy, leech while the leeching is good.
If you saved the torrent, just resume.

If not... you could be in trouble. :) (Smile)
IntermediateRaidHHI
Date: October 12, 2005 @ 12:59 PM
TrueAudio,

"IMO Regedit4 must have been a typo from the original website, because there's no such command, just delete the "4" off the end."

Actually; Your right and wrong. Their is no such command, but REGEDIT4 is the standard first line header for .reg files for older win9x machines. Windows Xp doesn't really care, but those will. If the users here are running older OSes and do what you suggested, regedit will not import the .reg file.
IntermediateRaidHHI
Date: October 13, 2005 @ 12:30 PM
Hmm...

"Words are nothing, providing proof that can be done yourself showing how hellbent Microsoft has been becoming the **AA's Buttbuddy and incorporating layers of shit programming to try to control what the fuck the customers want to do with their own stuff (as you can see by the very LENGHTY pain in the ass process of removing WMP9 from XP)."

I missed this before. :) (Smile) The instructions you posted for wmp9's removal is not a lengthy nor really a pain in the ass for anybody who knows what they are doing. However, it's highly doubtful that you do; Since how you spent... some time looking the information up, and you complain about it. :) (Smile)

You go on to talk about open source, non proprietary software, are you a programmer at all, or just talking smack?
DMembergrumpygeezer
Date: October 15, 2005 @ 5:56 AM

This is interesting.
It appears to be a matter of one techie calling another out (one nearly implying the other may be talking 'smack', and the other having almost accused the former of 'grand-standing').
DMemberIzzyOrrisney
Date: October 15, 2005 @ 1:11 PM
Hello chaps,
I noticed there were some queries for modded Windows OS, and getting rid of M$ shit; these people,

http://www.litepc.com/

do 98 lite, and XP & 2000 lite in pro versions or no-frill free trial versions which have no time limits (i.e. you can use them forever), and they slim the operating systems right down clearing out all the bloat, and letting you control what you want on there. They also do a free programme which just removes Internet Explorer, obviously download something like Firefox before using it.

These people,

http://www.codecguide.com/

do a beautiful app called Media Player Classic, which I can only compare to a hot-rod, it looks like the basic WMP, but under the hood it’s a lot more sophisticated, but without the Big Brother element , they also do Real Alternative, which handles Real streaming without the bollocks and bloatware, and Quicktime Alternative which takes care of Quick stuff without the popups. Or you can get the whole lot in one bundle of codecs, which should play ANYTHING you care to throw at it. The only thing it can’t do is play embedded WMP stuff.

I’ve been using Firefox browser with Zone Alarm firewall Grisoft AVG anti-virus, with Spyware Blaster and Spyware Guard running in the background, for a full year now, and in that year, nothing, not once, has been picked up in Ad Aware or Spybot Search & Destroy. I’ve also recently started using Peer Guardian 2.

Happy hunting, chaps,

A Brit in Spain.
IntermediateRaidHHI
Date: October 19, 2005 @ 10:26 AM
"I’ve been using Firefox browser with Zone Alarm firewall Grisoft AVG anti-virus, with Spyware Blaster and Spyware Guard running in the background, for a full year now, and in that year, nothing, not once, has been picked up in Ad Aware or Spybot Search & Destroy. I’ve also recently started using Peer Guardian 2."

You will find better system performance if you switch zone alarm out for Sygate Personal Firewall, and drop peer guardian in support of Protowall. It's a glorified IP filtering program, but seems to do reasonably well. Do not be alarmed if it goes off and tells you so and so was denied access. anytime your computer makes contact on a website to download pictures, if they are stored on a so called "bad" ip list, it'll flag. :) (Smile)
You must be logged in to post replies to news articles.
Log in or register with the form at the top of the page.

 

 

 

search

news tree


advertising



 

 
© DMusic LLC - Advertising | Employment | TOS | Subscribe