Tony,
See the following Cisco Bug Tool: CSCec83770
Symptom:
Some versions of Autocad do not start, or exit suddenly during use.
Conditions:
The license checking code inside some versions of Autocad detect the CSA
software, and treat it as a license cracking tool. To thwart this, the Autocad
program shuts down.
Workaround:
In CSA 4.0.2 and 4.0.3, this problem can be solved with the following steps:
1) Enable the behavior change with the following command:
cd \program files\cscopx\csamc\cfg
..\bin\dosql.csapl csamcdsn CSCec83770.sql
2) Create a buffer overflow exclusion rule for the troublesome processes.
3) Generate rules
However, these steps have a side effect, which is to turn off all COM rules in
processes which have buffer overflow exclusions.
Further Problem Description:
The csauser.dll hooks itself into a number of system calls in order to
detect and prevent malicious behavior. It does this by modifying the code of
kernel32.dll (and others). We believe that
Autocad detects one or more of these hooks and decides to active its defenses
(by shutting down). The purpose of (1) above is to change the system behavior
so that a buffer overflow exclusion also turns off COM rules. Once this is
done, the hooks are not needed; csauser.dll does not insert the hooks; the
hooks are not detected, and so Autocad runs normally.
It is possible that other programs apart from Autocad will behave the same way.
In particular, the Microsoft RMS (Rights Management Services) fails certain
requests when it detects csauser.dll hooks. The solution above works for RMS.
Caveats:
Once this change is made, buffer overflow detection is not performed for the
targeted processes. This may be an acceptable tradeoff for non-networked,
commercial grade applications like Autocad.
However, in the case of Microsoft RMS, it appears that the MS Office
applications needed to be excluded from buffer overflow detection. This is
potentially very risky. Further, since the buffer overflow exclusion also
disables COM rules, some of the email worm protection is also eliminated (as
Outlook
has to be excluded).
Hope this helps!
