CONTENTS OF POST
-Application Data
-Spyware or Malware?
-Registry Values
-EDIT: InterLok Driver License Agreement
APPLICATION DATA
I found another interesting thing about the "Application Data\PACE Anti-Piracy" folder, at least on my computer. The folder claims to be of size 2.25KB, but takes up a total of 8.00KB. The tree follows:
PACE Anti-Piracy
--7ut68RkAddUed
----Xo1WnzAUSzt.va_ (Size: 1.16KB, Size on Disk: 4.00KB)
--GYqw2sBZCrRLZQG
----OVcBywg4CCyfUr5.dl_ (Size: 1.08KB, Size on Disk: 4.00KB)
Apparently these files are given a specific amount of space to use by the system, but do not fill that whole space. To me, this makes it more believable that this is a kernel-level driver, by allocating more space than is needed, it ensures that the file can not run out of space if it needs to be modified or modify itself, which would add stability.
I will attempt to investigate more on what these files actually are with our violating EA's or PACE's agreements or protection measures, but I intend to find whether these files are licenses or the drivers themselves.
SPYWARE OR MALWARE?
On the EA forums, there seems to be much talk about whether or not this can be considered spyware or malware.
This article seems to believe, because it installs silently with out the user's knowledge, that this is spyware. I, however, disagree. To my current knowledge this program makes no additional contact to anyone or anywhere other than EA Downloader/EA Link's validation and updating of the license, and it also does not track any usage data whatsoever. This disqualifies it from the spyware category in my opinion. As far as malware is concerned, the software does not intentionally cause damage to the system or anything else, which would remove it from being malware. I do, however, believe it to be BAD BUSINESS PRACTICE to silently install third-party software that installs kernel-level drivers that could potentially (in rare and extreme circumstances harm the operating system).
REGISTRY VALUES
Something I had forgotten to mention earlier was that the driver is named "TPKD" and I have heard mention of registry keys. Upon further personal investigation of my registry, I have found the following in the registry:
-HKEY_CURRENT_USER\Software\PACE Anti-Piracy
-HKEY_LOCAL_MACHINE\SOFTWARE\PACE Anti-Piracy
-HKEY_USERS\S-1-5-21-1659004503-2139871995-839522115-1004\Software\PACE Anti-Piracy
The values under HKCU and HKU seem to be identical, with HKLM being different and containing much larger amounts of hex data. I will look at these values again in 3 days after opening 2142 to find any changes in the values, as they look like they may be the licenses.
EDIT: INTERLOK DRIVER LICENSE AGREEMENT
It also appears that the
documentation for InterLok is for PACE Licensees only, so although you are able to see download links, it asks for customer information in order to view the documentation. I did, however find a License Agreement by running their installer (but not installing) for their
InterLok driver. I have uploaded the License Agreement
here, but do not believe that it contains any worthwhile or useful information, and may not even be for the exact version of the product that we are concerned about.
