DeepFreeze: Here is a Challenge!

I am writing today to let you all know about a new/er product that is out to stop all computer screw-ups. I am speaking of DeepFreeze. Let me explain what this does.

First you set up a computer how you would like it. Everything from screen savor and desktop background to what programs you would like on. Once you have the computer they way YOU would like it, you install DeepFreeze. Now when you reboot and come back up everything seems the same. When you take a deeper look you will notice that your C Drive icon is now a picture of a computer inside an ice cube. Now you also may notice that there is an extra drive. The new drive is the H Drive. Why do you now have an extra drive? Because you now cannot save anything on the C Drive. Let me explain. Once DF is installed ANY changes made to the computer are gone once you restart. If you move an icon on the desktop, it will be right back where it was after the reset. If you downloaded something off the Net, it will be gone. If you made ANY changes what so ever, they will be reversed. Cookies, Temps, EVERYTHING will be gone. Of course this is why you cannot save to the C Drive. You MUST save to H Drive or of course a floppy disk.

Now I have seen many things like Fortress and other little programs that are suppose to keep people out. This is NOTHING like those small programs. This is VERY good in what it does. The company is offering $500 to anyone who can get around it. (I assume they still are.). I and another technician spent 45 minutes trying to crack it after it was showed to us. I must admit it is the BEST I have EVER seen.

I am not going to tell everyone what I and the other tech did. I will let you all play around and see if you can come up with anything. You can download your evaluation version at the site wich will be posted at the end of this article.

Here is what the actual site has to say about the product:
--

Reduce or Eliminate Support & Maintenance



No Computer Downtime
Full utilization of expensive computer assets. Deep Freeze® "freezes" your
software configuration. Whatever hackers, mischief makers and innocent clickers
attempt, their "work" will instantly disappear when the computer is restarted. All
settings, files and programs are 100% restored to original configurations every
time.

Full Access for Users
The computer operates without restrictions or security barriers and all programs
run normally. Deep Freeze is invisible and totally non restrictive and does not
interfere with programs. The user enjoys full access to all computer functions.
Deep Freeze has set a new high standard of reliability and ease of use in
Windows Protection.

Simple & Extremely Flexible
Deep Freeze requires NO setup or configuration. Just install, restart and its
working. Save files to a floppy, network, or into a specified Deep Freeze "thawed" space (Pro version). It's easy to make permanent changes; just turn Deep Freeze off and install or remove your programs or make configuration changes.
--

The site also includes testimonials

--
Here is the site.
Download DeepFreeze Now!
Download it and hack, slash, crack, break, kick, punch, and curse away!
--
Please respond with your attempts and info you find. Let us know how it is going! I think you will agree that this product, for it's job, is the best EVER!
--

Thank you all.

Alive to Learn,

Yeah, I have to admit that DeepFreeze rocks at it's job. Ironically, I'm posting from a computer with it running right now. My school has been using it since near the beginning of the school year, and I don't mind it, since *I* don't install games, etc.

What DOES piss me off is that DeepFreeze is protecting a ghosted setup that really isn't set up correctly. They've protected computer with programs that have been installed, but not used for the first time!! So IE asks you EVERY SINGLE SESSION (Windows login session) for 'do you want to save this to a password list?', and other inane things. And it runs a file optimizer from Office at startup, when it isn't even NEEDED!!! The program works great, if you have the protected setup working already... but otherwise it can be a real pain.

I've discussed this with some people already, and here's my theory...

Deepfreeze makes it so that windows uses a copy of the FAT, a copy made during bootup. (c:\windows\system\iosubsys\ might shed light on this... ) And basically, that second fat is the copy that the computer works with... with one change. If you delete a file, the file entry is NOT marked 'okay for rewrite' in the new virtual fat, although it IS marked with something to denote 'deleted'... Does it make sense? It needs to have some non-standard-fat way of making sure that it doesn't overwrite physical data. Perhaps it restricts any data writing to sectors that were already marked as clear on bootup.

Oh, and you *can* shut down the depfrz.exe program by killing a thread before killing the main thing, but it's just a decoy. As far as I can tell, the .exe itself is just to A) Trick you and B) Let you know Deepfreeze is running.

As for cracking it, I haven't tried to any major extent, but I would suspect possible avenues would involve either getting to it before it loads, such as a bootdisk (Bios passworded on this comp), or loading your own Ring 0 VXD or something... But I'm hardly a low-level programmer.

Taking the HD out and connecting it to a laptop :D Or "Ye Olde Manual Bios Resette"...

Question: Should I bother attempting this? Or do you think I would need a crash course in assembly or something? Or is it really simple but one of those things nobody thinks about?

As far as the ghosted comp that was not setup completely before hand, well, that was just a mistake on the schools part. Before we install we make changes in the registry so that bookmarks in both Netscape and IE may be set or removed. We have other settings there for other things.

Quote:

---

Oh, and you *can* shut down the depfrz.exe program by killing a thread before killing the main thing -Terr

---

What do you mean here?
--

Quote:

---

Getting to it before it loads, such as a bootdisk -Terr

---

You can not use a bootdisk to startup on. DF prevents this. Nor can you use F8. As far as trying to catch it on startup, I have. I have tried that is. For a split second there was a file (I forget the name now) having something to do with DF. We "End Tasked" it but nothing. :mad:
--

Quote:

---

loading your own Ring 0 VXD or something... But I'm hardly a low-level programmer. -Terr

---

Could you please explain this a bit more? Thank you.
--

Quote:

---

Taking the HD out and connecting it to a laptop Or "Ye Olde Manual Bios Resette"... -Terr

---

What do we expect to gain from moving the HD to a LT?... or did I misunderstand? Am I missing something? By "Ye Olde Manual Bios Resette"... do you mean just reset the bios?
--

Oh! By the way. I too am on a computer with DF on it! :eek: Heh.

Also, I have been wondering… What would/will happen when some sick freak decides to make a virus using the DF tactics/methods!? Wow. Scary thought. :eek:

01101001,

Quote:

---

Originally posted by DISLEX

What do you mean here?

---

I mean that the program depfrz.exe, which makes the nice little systray icon, is just to distract you. The program normally has some scheme for restarting itself when you try to close it, but if you terminate running parts of it before trying to terminate the whole process, you can make it stop running and stay that way. But the program .exe itself doesn'ts seem to have anything to do with the real workings of the system.

Quote:

---

You can not use a bootdisk to startup on. DF prevents this. Nor can you use F8. As far as trying to catch it on startup, I have. I have tried that is. For a split second there was a file (I forget the name now) having something to do with DF. We "End Tasked" it but nothing. :mad:

---

AFAIK Deep Freeze does not automatically change your bios settings... Just windows bootup settings. If the Bios does not have a password on it (at least one keeping you from editing bios/cmos/etc. settings) then you can set it to try booting to floppy BEFORE trying to boot to the hard drive. As for F8, and other windows-specific startup stuff, etc... I think most of that is in msdos.sys... (edit it in notepad)

Quote:

---

Could you please explain this a bit more? Thank you.

---

A .vxd files is a Virtual Device Driver... with X being... well, whatever the device is... But they all end in .vxd. They are used by windows and are one of the most basic ways to interact with windows. Let me find some links...
More Here.

Quote:

---

What do we expect to gain from moving the HD to a LT?... or did I misunderstand? Am I missing something? By "Ye Olde Manual Bios Resette"... do you mean just reset the bios?

---

[/b][/quote]

What I mean to say is that you could remove the drive from the computer, and stick it in another computer as a non-bootable drive, and edit the drive contents to uninstall deepfreeze (because it hasn't loaded itself, because you are using a different OS). Alternately, you could reset BIOS, allowing you to boot from diskette, letting you boot to an alternate OS and delete DeepFreeze.

All your ideas sound good. I think I will try them all. I icon you speak of in the system tray is only with the evaluation version. When you have the full version of DF it will not be there. I had forgoten about this because once the school district saw how well the program worked we bought the full version for the whole district. I also failed to mention the key command that brings up the password screen. I think that it is the same everywhere but I may be wrong. The actual admin (people with the admin prog) may be able to set it to anything. Here it is Ctrl+Shift+Alt+F6. This will bring up the password screen also known as the "Token Screen". Once this screen is up you will see an alpha-numeric code. You type this code into the admin prog and it will then use it to give you a password which is also alpha-numeric. You type in the pass and then it will give you three options that look something like this:

--Status on Next Boot--
Boot Frozen
Boot Thawed on next [x] restarts (X=1-99)
Boot Thawed
------------------------------

The first option (Boot Frozen) will bring the computer up to its frozen stage. This would be if you had it thawed. Thawed meaning DF is in a stage you can make changes to the system.

The second option is if you would like to make a change or a few. You can set it to stay thawed for a number amount of restarts. You can choose any number from 1-99. I assume you can pick 0 but that would void the whole point! If you choose 2 this would allow you to restart the computer and still be thawed. You restart once more and the system is still thawed. That was 2 restarts so once you restart the computer will be back to the frozen state. 2 restarts may be best when instaling software because some may need to be restarted to make it's final changes.

Of course Boot Thawed is booting up "UnFrozen". If I am right you will have to have another token (password) to freeze the computer back. I think you can restart as many times as you want. I may be wrong.
--

I will let you all know that once a token is used it can not be reused. Next time you bring up the token screen it will have a different alpha-numeric code. I along with 7 other techs have to call our bosses to get a token (password). They type in the token we give them into the DeepFreeze Admin program and in return it gives them our token.
--
I hope many of you will play around with this program. and let us all know what you find out. I wish I knew a bit more (Actually, anything) about programing. Is there anyway DF can be de-compiled? Then we could look at the code and maybe see how it comes up with it's tokens. Then I'm sure a crack prog could be made to generate tokens. I really want to know how this program works. It is amazing! I have not found anything online about it. I have not seen any books. I am calling you all together to explore and share this program. Once again I hope you all will join in. Thank you.

01101011,

Quote:

---

I and another technician spent 45 minutes trying to crack it after it was showed to us. I must admit it is the BEST I have EVER seen.

---

Ah, it sounded like you DID crack it. My bad. I was wondering how you did it :P

The version my school uses *says* it has one license (perhaps they are being thrify? Maybe I should just talk to these Deep Freeze guys about how-my-school-didn't-pay-you-enough, that might make it disappear :D). Now, this version has a screen that comes up early in windows boot and gives you a few seconds to enter in the key-combo to stop th bootup and let you type in the password. (This is the default which they mention somewhere on their website.) I thought the token was so that you could get in in case you lost the password, you could talk to the Deep Freeze techs to get a one-use p/w.

Sorry I had you thinking I cracked it.

So you are getting a startup password screen. Strange. Can you please find out what version the school is illegaly running!? Im kidding.

The full version we are using has no starup screen at all. Also, like I have mentioned there is no Icon in the System tray. I do remember a small Icon on the evaluation version we had. I may be wrong but do belive you have an evaluation copy. When you open My Computer is the CDrive icon a computer within ice? We have that on the full version but it was not on the evaluation version.

Ok I am going to go now before I confuse myself! I will try and figure out what version we are running. See you around.

01100101,

AFAIK at my school, yes, the C:\ drive icon is an iced-over computer. The icon in the systray is also the same. (The icon in windows explorer exists in both 32x32 and 16x16 sizes, depending on how you are viewing things, although the systray one is only 16x16, of course)

I must admit I am a bit saddened by the lack of participation from other AntiOnline members. :(
--
I would now like to find out more on the Status tab. When you press Ctrl+Shift+Alt+F6 and bring up the token screen you will see another tab. The Status tab. When you select this tab you will see somewhat of a spreadsheet looking chart. On the left, going down the side it has (Mine at the moment). 1-11 with the head/title being #. At the top, to the right of the # symbol is A. Next to A is B. This continues on to D. Below each A-D header is an alphanumeric series. On line 0-A is 0000002E. 0-B holds 00000000. I advice everyone that has been viewing this thread, to examine these numbers. I hope many of you will join in on this discussion. Thank you. Go Download DF!


01001011,

I was talking with my boss and found out that the new DeepFreeze will *not* give you a choice of how many restarts you would like. This is another way to tighten security. Wow. DeepFreeze is by far the best of it's class. It is the *only* one it it's class!

01100101,

Quote:

---

I must admit I am a bit saddened by the lack of participation from other AntiOnline members

---

would have loved to test it.sounds like a good one.
but we only have win nt or 2000 (yeah linux too) here :(

hope theres' one with win2k support soon!!:p

:)

00110101,

Great solution for @ my school.
No Norton ghost imageing needed anymore.

DeepFreeze is the best program I have ever seen in any category, bar none. However, in spite of its mystical operation and very impressive security, it is vulnerable to booting from a floppy. It is easily removed if you know what to delete. So... hacking DeepFreeze is not a matter of hacking DeepFreeze, it is a matter of hacking BIOS and CMOS. Since most people who install DeepFreeze don't think to go into CMOS and disable A: in the bootup sequence, removing DeepFreeze from a computer is a cinch. However, if CMOS Setup is passworded and the floppy drive disabled in the bootup sequence, hacking DeepFreeze becomes a matter of hacking CMOS. DeepFreeze uses anti-debugging code to prevent BIOS/CMOS password crackers from working. But there are master passwords installed by most motherboard manufacturers. It didn't take me long to figure out mine. I have a DFI motherboard with an Award 4.51 BIOS, and the master password is Y. C. Lu, the name of the guy who started DFI! I know it may sound challenging to find out the master password to your BIOS, but it really works. OEM's use a program called MODBIN (for Award anyway) to program security default passwords into the BIOS's for their mobo's.

On most computer setups (schools, labs, etc.) it is usually not that hard to get access to the computer case either. I would download the mobo manual off the internet, find out the Clear CMOS jumper location, then get someone to watch my back, or find an opportune time to open the case and change the jumper, reboot, enable the floppy drive in the CMOS Setup, then change it back the way it was. Then boot from a BOOTDISK (created by format a: /s) and remove DeepFreeze.

The file which does all the magic in DeepFreeze is a system file called persis0.sys, located in the DeepFreeze folder. To view it from within Windows, you must make sure that "Show Hidden Files and Folders" is checked, AND UNCHECK "Hide Protected Operating System Files" right below it. All this under Tools, Folder Options in Windows Explorer. If you do this, you can see persis0.sys.

When you make the BOOTDISK, copy ATTRIB.EXE to it as well. You will need this to unhide persis0.sys before deleting it. Just attrib -r -a -s -h persis0.sys, then delete it, then the rest of the files, then the DeepFreeze folder, then the Hypertechnologies folder. Then restart the computer and Deep Freeze is GONE!!

They have no anti-tamper code to mess up your computer if you delete it from a BOOTDISK.

Deep Freeze 2000 Beta is out now.

www.deepfreezedownload.com/secure
User Name: df2000
Password: beta2a

DeepFreeze phone number: 800-943-6422

Happy Hacking!persis0.sys

I use gateway's "goback" program. It suits my purpose well as I do not want to lose every change I make when I reboot. I just want to be able to recover to a decent past state after a bad crash. goback peroidicly(you can make a choice on how often) takes a system "snapshot" and saves it.If a crash happens just activate it at

this sounds impressive, i think i'll try it. my school uses full armor, probably one of the worst ones out there IMO. at one building it continually corrupts system files so we have to use the undo32 utility that came with it. and the fact that my teacher wasn't paying attention and i watched her type in the pass isn't good for security either... so far i've only used it to fix up the pc's so they don't crash as much. the technician they have working at that same building, when he installed all 30 pc's, didn't know how to use win2000 so he uninstalled them all and put win98 on them. i think that's half the problem. that he didn't set it up right.

Thank you for the information williamtell323. :) I will play around with that and see what I come up with. It is good to see people getting involved in this! Thanks again!

Living To Learn,

You can reinstall DeepFreeze and get an infinite amount of 60 day trial periods by deleting the following two keys in the CurrentVersion folder of the registry:

HKEY_LOCAL_MACHINE\
SOFTWARE\Microsoft\Windows\CurrentVersion
NAffinityConfig (long alpha-numeric value)
Rebar_XXXXXXXX (eight digit alpha-numerica value)

There are a few other registry keys, but none that will prevent you from reinstalling DeepFreeze with a fresh 60-day trial period.
You will be prompted to "replace all" for the others when you reinstall.

Also, to launch the DeepFreeze password box (for those of you who may not know) shift+double click the DeepFreeze icon in the system tray. OR, Ctrl+Alt+Shift+F6. I do not know if these can be reconfigured or not in the purchased version. But those are the default methods of opening the password box. I think the password is stored in the swap file, but I'm not sure. I studied it thoroughly with RegMon and FileMon, but couldn't figure it out.

I would like to know though what the basic programming techniques are with DeepFreeze which allows all changes to be reversed. Does it do the same thing as GoBack? Someone else mentioned the FAT table. Did you know Bill Gates invented the first FAT? Anyway, we're making progress here. Let's get some more contributions from some of you out there.

What about a TSR or other program which would remain in memory and delete DeepFreeze on a warm reboot? I tried putting a shortcut on my desktop for "Exit 2 DOS", but DeepFreeze forced a complete restart when I double-clicked it.
There has to be a way to shut down/unload the persis0.sys file while DeepFreeze is running. If you talk to the people at the 800 number, they make a big deal out of the fact that DeepFreeze runs in "Ring 0" and can't be stopped because of that. Well, what about writing a special program to kill it. One C+ programmer told me you can do ANYTHING by calling API's. Let's get on the ball here folks!!! Let's torch this baby!!

Quote:

---

Originally posted by DISLEX
This will bring up the password screen also known as the "Token Screen". Once this screen is up you will see an alpha-numeric code. You type this code into the admin prog and it will then use it to give you a password which is also alpha-numeric.

---

Since it gives you a token to make a password, couldn't A) you get a copy of the admin software and use that key to get passed it or B) write your own code to do it.

If i'm missing something, tell me.

I have a hidden RUN command on my win98SE environment. I also hide FIND, SETTINGS, and some more features. Using Help I opened the add/remove programs and uninstall Deep Freeze...

Now I'm gonna go to see if this worked out!!!

I'll let you know.

(actually I did it a week ago, but haven't checked back)

It may act like it uninstalled. It even goes through the complete uninstall routine. But unless you did it when it was thawed (with the red X blinking on the system tray icon), as soon as you reboot, voila, guess who came to dinner?

Deep Freeze must be in thawed mode to be uninstalled. Then you need to restart your computer again and it will be truly gone.

hey i can't get to download this product from the link williamtell1323 has given.
after entering the username n password (as given by william) on this site : http://www.deepfreezedownload.com/secure/

i get this error -

>>Error: Invalid E-mail
>>Your e-mail address was not entered properly.
>>Press BACK on your browser to complete the present form, or start with a clear form.

Anyone else facing thjs prob??

Right after my last post, they updated their website. The W2K version is now available on the same page as the 9X version. Use the drop down list to find it at www.deepfreezeusa.com/

Cheers!

Thanks william...


i'm downloading it right now.





btw i liked ur signature.:)