Massassi Forums Logo

This is the static archive of the Massassi Forums. The forums are closed indefinitely. Thanks for all the memories!

You can also download Super Old Archived Message Boards from when Massassi first started.

"View" counts are as of the day the forums were archived, and will no longer increase.

ForumsDiscussion Forum → Fake a norton install?
Fake a norton install?
2007-02-05, 8:53 AM #1
Or any other way to get around my stupid school's little policies. I am absolutely dreading to put that absolute crap (i.e. norton, they only AV choice they give you) on my computer. They use this program CSA.exe (client secure access or some crap) to validate what you have.

After the standard google searching, I tried user agent switching on firefox to see if they'd let linux users slide, but all that did was give me CSA.sh when I tried to register again. I think Mac and Linux users are free from the anti-virus shangeans, but still need to be scanned regardless (I guess to make sure they aren't trying to do what I tried to do).

Suggestions would be great. Although I have an aching feeling that I'll have to grin and bear it, I though I might as well as post.
2007-02-05, 8:54 AM #2
thats pretty lame, you can't even use AVG?
free(jin);
tofu sucks
2007-02-05, 8:56 AM #3
Originally posted by 7:
thats pretty lame, you can't even use AVG?


Yes, no avg, no avast, no mcaffe (not like that is better), no nothing. ONLY Norton. I wouldn't mind that much otherwise.
2007-02-05, 8:58 AM #4
is the CSA program running on your computer or on the server?

It probably just looks for certain norton registry keys.

run regmon to see if it does just look for registry keys.
TheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWho
SaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTh
eJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSa
ysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJ
k
WhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSays
N
iTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkW
2007-02-05, 8:59 AM #5
Originally posted by TheJkWhoSaysNi:
is the CSA program running on your computer or on the server?


You download and run it (on my computer), and it generates a report that is basically pass, fail, and why you failed. But yeah, to make sure I'm not misunderstanding, you download the exe, run it, and then a webpage opens up (that is stored locally C:\stuff...) that tells me that I fail at life; I'm assuming that it runs on my comp from that.
2007-02-05, 9:05 AM #6
Heres what I'd do:

Find out exactly what it looks for, if it is just looking for registry keys it wont hurt you to get the keys from someone else and add them to your registry.


If it's doing something more complicated then (either on someone else's PC with norton installed or install norton under vmware) use a packet sniffer to see exactly what gets sent to the IT department. I'm guessing this program wont use any complicated checks on the data it receives back, just alter the packets to pretend it's working.
TheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWho
SaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTh
eJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSa
ysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJ
k
WhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSays
N
iTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkW
2007-02-05, 9:06 AM #7
Originally posted by TheJkWhoSaysNi:
Heres what I'd do:

Find out exactly what it looks for, if it is just looking for registry keys it wont hurt you to get the keys from someone else and add them to your registry.


Yeah, I was thinking about doing that reguardless as a shot in the dark. I have no idea how it's looking for the install at all, sadly.

Quote:
If it's doing something more complicated then (either on someone else's PC with norton installed or install norton under vmware) use a packet sniffer to see exactly what gets sent to the IT department. I'm guessing this program wont use any complicated checks on the data it receives back, just alter the packets to pretend it's working.


I'll try that out. Thanks for the replies.
2007-02-05, 9:09 AM #8
If it just sends the report file to the server, get a success one from someone, replace yours with it and make the file read only.
TheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWho
SaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTh
eJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSa
ysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJ
k
WhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSays
N
iTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkW
2007-02-05, 9:30 AM #9
Your university IT department needs to be shot like now. No way they should force you to put a substandard AV on your computer. At our helpdesk it's almost policy to remove Norton AV and throw on Trend/AVG/Avast.

I would seriously start calling/e-mailing some people and tell them they are are substandard humans.
Code to the left of him, code to the right of him, code in front of him compil'd and thundered. Programm'd at with shot and $SHELL. Boldly he typed and well. Into the jaws of C. Into the mouth of PERL. Debug'd the 0x258.
2007-02-05, 10:00 AM #10
I had Norton fully updated and still got a frigging Boot sector virus.

Switched to Bullguard and had no issues.
2007-02-05, 10:02 AM #11
Funny story; I had to install Norton this morning to get validated too. Then I promptly uninstalled it. What a piece of crap program.
Stuff
2007-02-05, 10:10 AM #12
What's in the CSA.sh?

I'd never trust an exe sent to me from people who make such suggestions.
Sorry for the lousy German
2007-02-05, 1:09 PM #13
Originally posted by Impi:
What's in the CSA.sh?

I'd never trust an exe sent to me from people who make such suggestions.


If I'm wrong, don't shoot me, but I think it's a UNIX executable? I think? I mean, they gave that to me when I 'faked' being on a linux OS.
2007-02-05, 1:12 PM #14
ah, paste (or attach) the sh file. We should be able to see how it works.
TheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWho
SaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTh
eJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSa
ysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJ
k
WhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSays
N
iTheJkWhoSaysNiTheJkWhoSaysNiTheJkWhoSaysNiTheJkW
2007-02-05, 1:15 PM #15
Originally posted by TheJkWhoSaysNi:
ah, paste (or attach) the sh file. We should be able to see how it works.


Alright; thanks again for the help.

[url]www.members.cox.net/lord_kuat/CSA.sh[/url]

Originally posted by kyle90:
Funny story; I had to install Norton this morning to get validated too. Then I promptly uninstalled it. What a piece of crap program.


I woulda done that, but I heard from my fellow classmates that they can check somehow. Although I'm not sure how they can do that, and maybe it's just one of those rumors they let spread to help their job. Like the one about Ft. Knox being protected by orbital ion cannons.
2007-02-05, 2:08 PM #16
Yeah, on my own PC I can do whatever, but on the school laptop, you have to have McAfee and they've disabled the option to turn off active scan, so it can just eat up your memory. Not as bad as your situation though.

I've never gotten a virus, I'm an engineering student, yet I have to be told how to use a computer ... But I guess there are stupid people out there, what are you gonna do?
Steal my dreams and sell them back to me.....
2007-02-05, 2:16 PM #17
Originally posted by Lord Kuat:
Alright; thanks again for the help.

[url]www.members.cox.net/lord_kuat/CSA.sh[/url]



I woulda done that, but I heard from my fellow classmates that they can check somehow. Although I'm not sure how they can do that, and maybe it's just one of those rumors they let spread to help their job. Like the one about Ft. Knox being protected by orbital ion cannons.



Technically the ion cannons can be fired at any location, but yes they could be used as a defense system agianst stuff coming towards the building.
2007-02-05, 2:56 PM #18
The computer services here at my school recently started running Cisco Clean Access. It checks to see that you have an updated anti-virus, anti-spyware, as well as having the latest Windows updates. It's not quite as restrictive about what anti-virus you use, though.
2007-02-05, 3:35 PM #19
Your school's techies are the epitome of "dee dee dee", as Mencia would say.

And I hate Mencia.
D E A T H
2007-02-06, 12:13 AM #20
Originally posted by Lord Kuat:
Alright; thanks again for the help.

[url]www.members.cox.net/lord_kuat/CSA.sh[/url]


Hmmm, looks like it extracts some executable, runs it and then runs whatever browser it can find to display results.htm. Sorry, can't help you there.
Sorry for the lousy German
2007-02-06, 1:22 AM #21
I'd just like to take this opportunity to point out that Symantec and McAfee's corporate and enterprise solutions are unbelievably better than their retail cousins. I guess because they're selling it to companies and organizations that are gonna be pissed if they lose data to malware, as opposed to OEM builders that only want to give their buyers some sense of security.
Bassoon, n. A brazen instrument into which a fool blows out his brains.
2007-02-06, 8:18 AM #22
Originally posted by Zecks:
The computer services here at my school recently started running Cisco Clean Access. It checks to see that you have an updated anti-virus, anti-spyware, as well as having the latest Windows updates.



How does it respond to a Linux or OS X install?
2007-02-06, 12:46 PM #23
Norton. Pain the backside
AVG is okay actully, I use it as my main anti-virus software. :)
'Its always a good idea to move foward not back'

/Axecrasher/
2007-02-07, 8:40 AM #24
After I installed norton and all the other crap, the freaking network has problems. The bastards only allow you to have 1 computer connection per account, but it never recognizes my MAC address. Ah well, whatever, we have cable jacks here and I'm half tempted to get myself my own line. They throttle everything; I had to make azerus use encryption so they wouldn't sense it and throttle it to all hell. Ventrilo and Hamchi are shot (for some reason). This blows, blows, blows.
2007-02-07, 9:49 AM #25
You could just hook TE up to their network.

I'm sure he'd find a way to give everyone blaster virus.

↑ Up to the top!