![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Nenu
[H]ardened
- Joined
- Apr 28, 2007
- Messages
- 20,314
Hi chaps,
While jumping round the web I came across a new ASIO2 and WASAPI 2 codec on Sourceforge.
I'm not linking it because I dont want to promote them because...
Preface:
I run a very tight ship Windows 7 install with Comodo HIPS.
Every new program that runs gives an alert so I know what happens under the hood.
I do not use encryption, I am only concerned about keeping the OS safe from malware etc.
I installed this new codec using Foobar, I gave the installer full permission to install.
On Foobar restart, Foobar and components began triggering access to the encryption driver, ksecdd.sys while they tried to load.
I didnt want to allow this but there were so many requests and I wanted to see if this codec was real.
In the end allowed it knowing I could revert to a backup from a few days ago.
After installation, there was no WASAPI interface available, only a method of using ASIO2.
This created a stuttery sound that was no use.
From then on, every time I tried to do something in "Windows", it would ask permission to load ksecdd.sys !!
Opening task manager, explorer, any program, all try to load ksecdd.sys.
So I removed the WASAP2 codec from Foobar and rebooted.
Soon after the boot, more programs were asking for ksecdd.sys to load.
I ran a virus scan, checked everything that loads on boot with Autoruns, no joy, it all looked fine.
I did not find a way to stop it and didnt want to trust my OS any more.
I could have put an earlier backup of my OS on another drive and monitored exactly what installs, where and how, but its a potentially long process. Not my idea of fun, I didnt.
My concern at this point was why an encryption driver was being invoked and what damage could it cause.
There have been users and companies held to ransom by shady people encrypting their data, this could be a prelude to something of this nature.
As I couldnt stop it, I booted my spare OS install, backed up the OS (to recover any data I forgot to copy out), restored a recent backup, copied changed data across and am back to normal again.
This new WASAP2 codec is only a few months old and it may be entirely innocent.
The problem could be a consequence of beta code, but my feelings are different.
This new codec is supposed to increase audio fidelity beyond that of the older WASAPI and ASIO codecs.
Its not going to do that while accessing system encryption as that will generate more system noise and reduce CPU availability, inclusion of this doesnt look like an accident because it would have been corrected in the 2 months it has been online.
To top that, the WASAPI 2 element doesnt appear to even be there and ASIO2 was useless for me!
I recommend avoiding WASAP2 until it is known for sure to be safe.
Only test it on a disposable OS install. Unplug all other drives in case they get encrypted.
While jumping round the web I came across a new ASIO2 and WASAPI 2 codec on Sourceforge.
I'm not linking it because I dont want to promote them because...
Preface:
I run a very tight ship Windows 7 install with Comodo HIPS.
Every new program that runs gives an alert so I know what happens under the hood.
I do not use encryption, I am only concerned about keeping the OS safe from malware etc.
I installed this new codec using Foobar, I gave the installer full permission to install.
On Foobar restart, Foobar and components began triggering access to the encryption driver, ksecdd.sys while they tried to load.
I didnt want to allow this but there were so many requests and I wanted to see if this codec was real.
In the end allowed it knowing I could revert to a backup from a few days ago.
After installation, there was no WASAPI interface available, only a method of using ASIO2.
This created a stuttery sound that was no use.
From then on, every time I tried to do something in "Windows", it would ask permission to load ksecdd.sys !!
Opening task manager, explorer, any program, all try to load ksecdd.sys.
So I removed the WASAP2 codec from Foobar and rebooted.
Soon after the boot, more programs were asking for ksecdd.sys to load.
I ran a virus scan, checked everything that loads on boot with Autoruns, no joy, it all looked fine.
I did not find a way to stop it and didnt want to trust my OS any more.
I could have put an earlier backup of my OS on another drive and monitored exactly what installs, where and how, but its a potentially long process. Not my idea of fun, I didnt.
My concern at this point was why an encryption driver was being invoked and what damage could it cause.
There have been users and companies held to ransom by shady people encrypting their data, this could be a prelude to something of this nature.
As I couldnt stop it, I booted my spare OS install, backed up the OS (to recover any data I forgot to copy out), restored a recent backup, copied changed data across and am back to normal again.
This new WASAP2 codec is only a few months old and it may be entirely innocent.
The problem could be a consequence of beta code, but my feelings are different.
This new codec is supposed to increase audio fidelity beyond that of the older WASAPI and ASIO codecs.
Its not going to do that while accessing system encryption as that will generate more system noise and reduce CPU availability, inclusion of this doesnt look like an accident because it would have been corrected in the 2 months it has been online.
To top that, the WASAPI 2 element doesnt appear to even be there and ASIO2 was useless for me!
I recommend avoiding WASAP2 until it is known for sure to be safe.
Only test it on a disposable OS install. Unplug all other drives in case they get encrypted.