Found C-DILLA on my computer! GET IT OFF GET IT OFF! HEEEELP!

[CZroe]

Noticed a hidden folder on my C:\ root named "C_DILLA" with a hidden subdirectory and file (SafeCast Product Licences\BD6A0000.DAT)
I remembered hearing about it in the same breath as spyware and copy protections so I did a search and came up with THIS. Scary stuff. I didn't install 3DStudio Max or Maya or any other suspected software and I don't know what installed it. All I know is that I want it OFF NOW. Adaware can't detect it, so what can? Can't they be sued for not providing software to uninstall it?! I searched their site but it turned up 'nill. Could the leaked Beta of UT2003 have this included? I couldn't resist: It's not like I'm pirating UT2003 if it isn't even released yet and I do plan on buying it as soon as it's available! Other than that, I don't know what else it could be...

 

[grunjee]

First off I wouldn't bring up 'beta' copies of stuff.

To get to your issue... do you run Kazaa or Kazaa lite? Pretty sure Kazaa uses C-Dilla. Kazaa lite however supposedly just puts a dummy C-Dilla file to fool the Kazaa software, since it won't work without it.

 

[Gaunt]

I noticed that hidden directory as well after installing some software... Didn't really surprise me, I knew it was there. Infact, I think it was in the add/remove programs list as well.

That site you link to seems to be very long, and admittedly I just scanned over it, but it doesn't really say anything bad about the software. It mentions something about it hiding itself, which seems reasonable to try and keep out of the user's way since they don't care about the licensing methods of the software.

The site also mentions something about shutting down CDRW drives on the computer. I must say, I didn't notice this at all, and any software that does this would most likely be rejected by the company trying to protect their product through licensing of this sort. It is my understanding that CDILLA doesn't prevent you from copying the CD by making your drive inoperable, it makes it a moot point, because the licensing will be on the copied CD and won't let you use it without a license anyways.

These sort of sites just tend to aggrevate me since they seem to suggest that any method used by a company to protect their software is evil. Admittedly, some of these companies charge insane amounts for software that possibly should be cheaper. But code is not cheap, and being a developer, I feel it is much within their right to protect their software. That shouldn't mean they have free reign of your machine to do that, of course. I would never use software that attempted to limit what I could do with my computer in any way. But, if a licensing system is used, such as CDILLA or FlexLM, I think it is very reasonable. The CD can be copied for backup purposes, etc. All you need is a valid license file when you want to run the software. The CD you use for the install doesn't really matter.

Sorry for the rant, just basically wanted to let you know that you can remove CDILLA easily (uninstall from add/remove programs should work, unless my memory is completely gone) and you shouldn't have to worry about spyware or it affecting your cdrw, because it shouldn't do either of those things, especially not spyware.

EDIT: Just skimmed over that link again, and it seems the whole thing about the CDRW drive was just speculation on the part of the author of the article. He carries it quite a ways, and says at one point "For the sake of a good conspiracy, let's say I'm right", so I think we can assume he's just trying to figure out what they mean by "Compatible with standard hardware configurations", which he's taken to mean it works with most cdroms to prevent copying...

 

[CZroe]

grunjee: Anandtech's news aparantly doesn't mind bring up beta MS stuff or leaked drivers AND providing sources :| KaZaa is known for spyware, but what do they have to do with a macrovision copy-protection spyware application?

Gaunt: I can say for absolute certainty that it is not in my Add/Remove programs control panel. It does not have permission to operate on my computer though it does, it does not have permission to steal resources from my computer which it does from boot until shutdown though it does, the executable is hidden *somewhere* and their website does not provide a removal method. That makes it malware in my book...

Thnx for the input... I'll keep looking!

 

[Gaunt]

Ok, well, if it is doing all those things, then yes, I agree, it could be called malware... definately not "spyware" though... not by my definition anyhow.

I didn't have any problems with it at all on my machine though. It showed up in add/remove programs, and the DLL for it was easily found, although I forget exactly where it was at the moment. I don't know whether that's a function of the CDILLA people, or the people who create the software that uses it. If I had to guess, I would say it's probably not the cdilla people who added it to my add/remove programs list, otherwise it wouldn't have the ability to be truly hidden from the user. This way, it's optional... too bad it can be used for evil.

As for the resources, unless it's badly implemented, it shouldn't be running constantly. I remember having it running while the application that was using it was running, but I don't know if it was closed when I closed that application, which isn't a good thing. But it definately didn't just run constantly.

I think once you track down what is using it, you will have all of the answers you're looking for. There should be a DLL somewhere, like cdilla32.dll or something (I don't quite remember). If you delete that, it shouldn't end up being run, ever, and when the program that wants it can't find it, it should complain.

Maybe try searching your drives for any files containing "cdilla" or "c_dilla" ? that might help you find the executable atleast.

 

[Gaunt]

Apparently the names of the DLLs cdilla uses are clcd16.dll and clcd32.dll. The exe file, which should be cdilla*.exe (version number in place of * I believe) is most likely found in the windows directory (c:\windows, c:\winnt, whatever). There is also a cdantsrv.exe file that is stored in your drivers directory (c:\winnt\system32\drivers). This is most likely what you seen running and sucking up resources since I'm not quite sure what it does. To remove the exe in the drivers directory, you might have to boot to safe mode, or find a way to kill the process, because apparently windows won't allow you to kill it normally.

Hope you're able to get it removed. Really sorry about going off on such a rant earlier... I'm fairly sure I didn't have this many problems with cdilla, but I was expecting it to be running, and I think the people using the licensing system were nice enough to add the option to my add/remove programs so I could find it.

Edit: Just added a little more info

 

[jema]

I had h*ll getting ridd of it but then I found out that it also installs itself as a HW device (not telling anyone ofcourse), it might depend on the version you have but run a HW uninstallation and make sure that it shows hidden devices and see if you find anytihng that matches the file names and regestry settings. Cant remeberd what the device was called, I'll be back if and when my menory actually decides to work.

Oki I cant remeber the whole thing but these files are also in it: cdac13ba.exe, cdac14ba.dll and cdac11ba.vxd.

 

[Cat]

3DS Max uses C-Dilla for licensing, I believe. Have you ever installed it?

 

[grumm3t]

I just found the C:\C_DILLA\ folder myself...

It was installed with 3D Studio Max R5.

C_DILLA itself comes up under the Add/Remove panel for me, and I read you have to remove the programs (3ds max for me) that use the liscencing software before removing C_DILLA itself.

 

[bulldawg]

Could the leaked Beta of UT2003 have this included?

It does.