How to delete spying files and Windows registry keys.

[mu...@compuplus.net]

I always had a strong dislike for software vendors who left
spying traces behind after an uninstall and since there was
a mention/info request recently, I will post about it again.

I'm not talking about repeating/extending the trial period.

For that, there were utilities like Trial-Reset (which must
be obsolete by now?) and other ways like using debuggers to
change trial period constant from lets say 30 to 3000 days.

My issue is with spying bugs planted in a user's computer
(which is illegal) with the assumption that one will commit
a crime in the future (which is also illegal and insulting
to potential customers) by repeatedly trying some software.

Snowie initially was leaving behind an inconspicuously named
file in the Windows system folder with an invalid creation
date which was corrected at the expiration of the trial (or
something like that). After I had revealed it, I think they
switched to a different scheme but who cares anymore??

Many software nowadays plant hard to trace registry keys using
copy protection software like Armadillo, Asprotect, etc. One
way to deal with them is to use an installation monitor like
Revo Ininstall Pro (which I used/liked and is free to try) to
automatically/manually uninstall/delete the remnant keys/files.

Another general purpose tool is Trashreg (that has 32/64 bit
free versions which I also used/liked). Free versions don't
completely reveal the Asprotect keys (used by extreme gammon)
and entices you to buy the paid version but you can manually
search/delete them in regedit yourself. It does nicely tag the
fake keys also (if you copy/save contents to a file) but again
you yourself need to make the connection between them (like the
Typelib value of CLSID key pointing to the Typelib key).

BTW, all these are easily found general knowledge that will
work with any software that uses Armadillo, Asprotect, etc.

So, keep your registry clean but don't reinstall any trialware
after they expire... ;)

MK

[michae...@gmail.com]

Thank you for responding to my request.
I was almost certain XG was using either Armadillo or Asprotect but never cared checking it out. It took me a few seconds after reading your post to confirm it's using ASprotect and a few minutes more to check if it is sending info over the net. It doesn't. All protection is done locally.

ASProtect is a really strong protection costs about $100 but is not as strong as Armadillo costing 3 times as much. If you were the developer of XG (making all that assumed huge money) which of the two would you choose? ;-)

[mu...@compuplus.net]

On Friday, November 21, 2014 12:50:27 PM UTC-7, michae...@gmail.com wrote:

> ASProtect is a really strong protection costs about $100 but
> is not as strong as Armadillo costing 3 times as much. If you
> were the developer of XG (making all that assumed huge money)
> which of the two would you choose? ;-)

I wouldn't use any protection. I don't think it achieves
anything beyond mildly inconveniencing / annoying users,
and turning off potential purchasers. (If that's what a
developer wants, it can be done in other ways for free,
like Bgblits does for example).

I think the need for developers of so-called "world class
bots" to use copy protection probably comes from the fact
that they are targeting mostly mentally sick gamblers who
are very commonly cheaters. I think it's the same need as
for using cheat proof dice cups, etc.

The only people who would want a legal license for those
bots are probably the few dozen "experts" who comment on
bot play publicly and/or know the developers personally.

Even so, some of them may be given free licenses in return
for promoting those bots. Aside from them, I can't see any
wannabe gambler being eager to pay for bots when they can
just keep trying them forever... :)

Besides, why would anybody really even bother with trying
to use those bots for free by defeating copy protections,
when there is the gnubg for free..??

A bigger revenue may come from the online gambling sites
that bot developers operate or associate with. But even
then, it may not be much more than the same money going
around and around, among a very small incestuous circle
of sick gamblers, slowly trickling up into the hands of
a few who waste their lives at being "professional gamblers"...

MK

[michae...@gmail.com]

I share your feelings Vs gamblers but let's not over generalise shall we?

All commercially available software use some sort of protection. It's not because they are targeting gamblers but because people would never pay otherwise.
Bg software as for example XG cost only a few Euros that's nothing compared with some commercial software costing tens of thousands. My brother works at a company of Land Surveyors it costed them 20,000 Euros to install software, the company that made it sent a representative to install it personally, and they made papers with lawyers to check it every month until they paid.They gave them no exe file no cd no nothing.
That's what I would call protection :-)))

Imagine the software used by the Banks ...

[Gammon Player]

Hi MK,

I use Trashreg and find 3 ASProtect key of XG
1-ASProtect 2.2 SKE/1.35
2-ASProtect Fake Typelib
3-Common Key of ASProtect

I delet all of them and trial time reset to 14 day.
but after about one month it expire and deleting the asprotect key dosn't work anymore.
can you explane how i can fix this problem and reset trial version again?

Best

[mu...@compuplus.net]

Assuming that you are using Trashreg and XG as of my post,
and that you cleaned all keys other than Asprotect keys
by some other means, I can't tell you how to reset the
trial but I may be able to tell you how to delete some
more garbage keys XG leaves behind ;)

The CLSID key with the random name has a Typelib subkey
which contains the value of the name of the actual key
at HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\ but the
free Trashreg only finds and/or show one of them.

I don't remember if it shows the CLSID or the Typelib
key but when you save the Trashreg results to a file,
it actually shows the value (something that looks like
{4B215DD8-D43E-F794-91C7-B5A80EC355FB}) which you need
to search for in order to find and delete the other one
that it doesn't show.

MK

[Gammon Player]

Hi again,

I Install new windows and I install Trashreg Full version (with crack file)
befor installing any program on my new windows i install XG and see 3 ASProtect key appears.I show them in this screenshot:

http://www.imageurl.ir/images/31338266062814623396.jpg

Firs ASProtect Key in this picture is CLSID, Second is Typelib and third is main ASProtect key. I'm pretty sure these 3 keys raleted to XG.
You must delete all 3 keys to resset 14 days trial but when you do that several times and after about 1 month deleting these keys dosnt work anymore, even reinstall XG not working and show "EXPIRE".
I guess after a while XG enables secondary protect key that trashref can't show
I really confused and hope you can help me

Thanks

[michae...@gmail.com]

I think Murat made it clear that his topic is only about removing unwanted entries from the Registry. Not for cracking XG.
If you think it would be easy to simply crack XG just by deleting values from the Registry you should better go read some crackers's forums where they all admit that software protected by this or Armadillo are next to impossible to crack.
If you want to use XG then do the decent thing and buy it. Or use GNUbg, it's equally good and free.