AnyDVD trying to connect to internet

[Webslinger]

Then there is a bug, because the person said they had that option unchecked.

I fail to see how this is a bug if Microsoft is the cause.
click http://forum.slysoft.com/showpost.php?p=51682&postcount=9

 

[Slim]

I fail to see how this is a bug if Microsoft is the cause.
click http://forum.slysoft.com/showpost.php?p=51682&postcount=9

What is this certificate, and why is it just now starting to check for it?

BTW, I'm running XP pro, SP2.

 

[Webslinger]

What is this certificate, and why is it just now starting to check for it?

BTW, I'm running XP pro, SP2.

James will be best able to answer this question. If you have further concerns, I suggest contacting Slysoft directly: http://www.slysoft.com/contact.html

There's likely enough faulty speculation here already.

 

[Slim]

James will be best able to answer this question. If you have further concerns, I suggest contacting Slysoft directly: http://www.slysoft.com/contact.html

There's likely enough faulty speculation here already.

I guess I shouldn't state my theory about the army of monkey robots who have been unleashed upon the users of AnyDVD, created by the CIA in a sinister plot to slowly annoy us to death with the uncertainty of what's "really" happening?

OK, I'll keep it to myself.

 

[Webslinger]

I guess I shouldn't state my theory about the army of monkey robots who have been unleashed upon the users of AnyDVD, created by the CIA in a sinister plot to slowly annoy us to death with the uncertainty of what's "really" happening?

OK, I'll keep it to myself.

Errr . . . lol

Not knowing exactly what's going on in your specific case, I don't feel comfortable speculating about what's going on here (could be trojans, could be Microsoft, could be Anydvd, for that matter, but that seems pretty weird if you told Anydvd not to check for updates; I don't know).

 

[rlsuth]

I have the same problem. It has only started occurring with the latest update and on two different computers.

I don't see how it could be a Microsoft issue when Zone Alarm states that "AnyDVD is trying to connect to the internet" though?

I also have the box for checking for updates, unchecked.

 

[Peer]

I have the same problem. It has only started occurring with the latest update and on two different computers.

I don't see how it could be a Microsoft issue when Zone Alarm states that "AnyDVD is trying to connect to the internet" though?

I also have the box for checking for updates, unchecked.

It's a very simple thing - AnyDVD components are signed, these signatures are again signed by a certificate authority, some MS dlls check these certificates, to make sure, they weren't revoked or anything. That's all. It's a very plain genuinity check. Nothing evil. Nothing immoral. Nothing creepy...
Windows DLLs do the check and since these are loaded into the process space of AnyDVD, it appears that AnyDVD is contacting the internet.

And if you have the "check for updates" enabled, AnyDVD contacts our server(s) (several mirrors possible) to see if a new version is available.

 

[DetroitBaseball]

It's a very simple thing - AnyDVD components are signed, these signatures are again signed by a certificate authority, some MS dlls check these certificates, to make sure, they weren't revoked or anything. That's all. It's a very plain genuinity check. Nothing evil. Nothing immoral. Nothing creepy...
Windows DLLs do the check and since these are loaded into the process space of AnyDVD, it appears that AnyDVD is contacting the internet.

And if you have the "check for updates" enabled, AnyDVD contacts our server(s) (several mirrors possible) to see if a new version is available.

Thanks for clearing things up, peer.

 

[rlsuth]

It's a very simple thing - AnyDVD components are signed, these signatures are again signed by a certificate authority, some MS dlls check these certificates, to make sure, they weren't revoked or anything. That's all. It's a very plain genuinity check. Nothing evil. Nothing immoral. Nothing creepy...
Windows DLLs do the check and since these are loaded into the process space of AnyDVD, it appears that AnyDVD is contacting the internet.

And if you have the "check for updates" enabled, AnyDVD contacts our server(s) (several mirrors possible) to see if a new version is available.

Thank you, that makes sense to me now.

 

[Clams]

Thanks Peer, But I'm not sure this clears anything up for me. Or if it relates to my issue at all. (or his for sure).

My machine reports that crypt23 (the Windows Cryptographic Service) has tried and failed to connect -not AnyDVD. Perhaps some anti-virus software isn't as discriminating though.

But the short of it is.... is that versions of AnyDVD prior to 6.1.7.4 did not cause crypt32 to attempt to connect to verify digital signatures. So the question on the floor remains: "What changed and why?"

For that matter looking WAY back in my logs on my oldest machine, AnyDVD 6.1.7.4 is the first program out of anything I ever installed (including prior versions of AnyDVD) that had to go try to get a "root certificate" at all.
So the question "What changed and why?" remains. As well as "What can AnyDVD do to change it back"?

The problem (aside from virus software getting false positives) is that machines with no internet access are banging off 6 errors the moment AnyDVD starts up. And this is new behavior unique to 6.1.7.4

I've got a couple machines that are complaining, and they ain't getting internet access in the forseeable future.

-W

 

[Webslinger]

The problem (aside from virus software getting false positives) is that machines with no internet access are banging off 6 errors the moment AnyDVD starts up.

I'm pretty sure that is related to what peer wrote:

It's a very simple thing - AnyDVD components are signed, these signatures are again signed by a certificate authority, some MS dlls check these certificates, to make sure, they weren't revoked or anything. That's all. It's a very plain genuinity check. Nothing evil. Nothing immoral. Nothing creepy...
Windows DLLs do the check and since these are loaded into the process space of AnyDVD, it appears that AnyDVD is contacting the internet.

As for your other questions, if peer and James are too busy to respond, you may want to try contacting Slysoft as well, as I doubt others will be able to respond as well as they can.

 

[Peer]

So the question "What changed and why?" remains. As well as "What can AnyDVD do to change it back"?

The problem (aside from virus software getting false positives) is that machines with no internet access are banging off 6 errors the moment AnyDVD starts up. And this is new behavior unique to 6.1.7.4

I've got a couple machines that are complaining, and they ain't getting internet access in the forseeable future.

What changed: AnyDVD checks it's signature.
What you might be able to do (untested): turn off Windows XP's setting to automatically check and update root certificates (somewhere in the group policies, I think).

 

[Clams]

Which begs the question... Why does AnyDVD now feel a need to check it's signature - it's worked fine for years without doing so?

And assuming the answer to the above is something to do with Vista etc.., why not just include a check box in this nice little applet (AnyDVD) to disable that function for people it causes trouble for - as opposed to presuming that System Admins everywhere need to change Group Policies (and lower thier security standards) just to accomodate AnyDVD?

I'm not trying to be combative..... but I am aware of system (and sysop) "pecking order" - and AnyDVD is suddenly asking for a lot - when it always did the job before without needing special attention. I'd rather AnyDVD provide a box to fix its interaction with Windows - than to assume that Sysops need to change Windows Policies to work-around AnyDVD - no?

-W

 

[fordman]

I can verify this action also. It seems that it is trying to connect to www.download.windowsupdate.com, which samspade.org verifies as a Microsoft domain. So, the explanation of AnyDVD checking it's certificates seems legit, but I second the motion to remove this feature, or provide a box for the end user to remove it. I have plenty of drivers, etc. that have not be ceritified by Microsoft, and I'm fine with that. Knowing that Microsoft recognizes Slysoft's certificate provides NOTHING to me - I know I downloaded my update directly from Slysoft's own site, and that's all the verification I need. Perhaps I'm wrong, but I always thought that this certification stuff (provided by Verisign, etc.) was more for software that routinely access the internet, such as an internet browser.

Slysoft, please remove this feature...

And those that haven't seen this behavior with 6.1.7.4 must not have a firewall that monitors unsolicited OUTBOUND traffic. Windows XP SP2 firewall is an example of such an "inbound only" firewall. It DEFINITELY is NOT trying to access spyware or spam sites as some have asserted!

fordman

 

[freeop]

Looks like all the ip's you listed were for slysoft.com in different countries. Here's a list of what I got:

67.15.8.99 - ev1.slysoft.com - Texas
85.10.195.108 - h3.slysoft.com - Germany
91.121.16.109 - ns23842.ovh.net - France
209.172.55.182 - iw2.slysoft.com - Canada
213.251.133.91 - ovh1.slysoft.com - France

And they are all going to HTTP port 80. I am sure it is like others have said just Slysoft trying to verify the key or something in that order...

 

[fordman]

Looks like all the ip's you listed were for slysoft.com in different countries. Here's a list of what I got:

67.15.8.99 - ev1.slysoft.com - Texas
85.10.195.108 - h3.slysoft.com - Germany
91.121.16.109 - ns23842.ovh.net - France
209.172.55.182 - iw2.slysoft.com - Canada
213.251.133.91 - ovh1.slysoft.com - France

And they are all going to HTTP port 80. I am sure it is like others have said just Slysoft trying to verify the key or something in that order...

In my case ZoneAlarm Pro only showed it trying to access the windowsupdate.com site, though there were a few entries in the blocked program log that showed no IP at all.

UPDATE: I verified that those entries that seemed to show no IP did indeed show the IP for the Windowsupdate.com site....so no slysoft.com sites, in my firewall log, though I would have suspected that it was trying to verify the key. So, for my copy the explanation about trying to verify the root certificate still holds for me. I wonder if AnyDVD only does the root certificate if the program can identify the key as a legitimate purchaed one, and connects to the Slysoft site only if the key technically matches the algorithm but is not otherwise verified as legitimate (i.e., one produced from a key generator)?

fordman

 

[Giljorak]

I posted information on how to turn off root certificate updates HERE.