Is RealPlayer spying on you?

Lucy · Post by **Lucy** » Fri Mar 10, 2006 5:17 am

RealPlayer has been on my personal 'Banned' list for a long time (Along with Nortons). If all you want to do is view video clips, there are many other players that are far less intrusive that RealPlayler.

Today I downloaded some flies with the .rm extension that need RealPlayer to view them. (Unless I use a converter). Anyway, I decided to download RealPlayer but analyse each step of the installation to see what it was attenpting to intrude on.

I told the instalation wizard that I didn't have an internet connection but it checked anyway and found one. It also re-configured my firewall to allow certain internet activities without notifiying me. If I only want to view a video clip, why does it need to access the internet?

The answer to that is a grey area.

The application wants to set a file called 'TkBellExe.exe' to run every time I start the computer. A quick Google tells me it is harmless, or spyware, or a variant og the 'W32.Lovegate.AO@mm' virus depending on where I look. Wow! Who do I believe?

Furthur research tell me that it's only to do with scheduling updates. The good news is that I dont need it and you may not need it either, but how to get rid of it?

If I disable it in 'Msconfig' and delete the registry key, it resets whenever I start RealPlayer. The answer is quite simple.

DISCLAIMER: This works for me because I only use RealPlayer to view video clips. If you use it for any other purpose (Downloading Mp3's etc) you may want to do some more research before going on. If your not comfortable with editing the registry you might like to find someone who is.

If you are running Windows XP:
Simply logon with an account with admin rights.
Use task manager (Ctrl-Alt-Del) to kill (Right click - End task) realsched.exe.
Then delete the file (C:\Program Files\Common Files\Real\Update_OB\realsched.exe) from your drive.
Click on the 'Start' button and 'Run'.
Type in 'regedit' and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete the entry called 'TkBellExe'

I have also set my firewall (Zone Alarm) to block RealPleyer from accessing the internet. If anyone wants to know how to do that, just ask.

Now I can keep control of my computer and use RealPlayer too.

Taylor · Post by **Taylor** » Fri Mar 10, 2006 5:26 am

Interesting. Useful info Lucy. Thanks.

I stay clear of RP just cos it's fucks my system up and associating itself with near enough everything. I can well believe that it does spy on you also. I ran Hijackthis the other day and was amazed at what was running!

Still, Microsoft have been spying on us for years with IE , media player and 99% of its programs. Bill is watching!

They are all as bad each other, but looks like you have them beat!

Thanks again for the info.. I learn something new everyday

inquisitor_uk · Post by **inquisitor_uk** » Sat Mar 11, 2006 11:16 am

Lucy wrote:If I only want to view a video clip, why does it need to access the internet?

Some firewalls have a program list that gets updated every so often, with programs that the firewall developer believes to be harmless and so if a program is installed that is on that list, then the firewall makes the decision for you and allows it access. I dont like that anymore then you do, but it's simply a case of manually going into the firewall and disallowing access for that program to the internet.

The answer to that is a grey area.

Lucy wrote:The application wants to set a file called 'TkBellExe.exe' to run every time I start the computer. A quick Google tells me it is harmless, or spyware, or a variant og the 'W32.Lovegate.AO@mm' virus depending on where I look. Wow! Who do I believe?

It is indeed a spyware worm, and if you click here, you can download the tool to remove it.

Lucy wrote:Furthur research tell me that it's only to do with scheduling updates.

This is incorrect, see above comment.

Lucy wrote:The answer is quite simple...

yes, delete Real Player.. lol..

and I will confirm the last part too IF YOU DELETE, MODIFY OR MOVE A REGISTRY KEY WITHIN YOUR REGISTRY INCORRECTLY, YOU COULD EFFECT PROGRAMS AND/OR EVEN THE STABILITY OF THE OPERATING SYSTEM IT SELF. THIS COULD LEAD TO LOSS OF ACCESS TO THE OPERATING SYSTEM, AND A FORMAT AND RE-INSTALLATION OF WINDOWS............ Do so at your own risk, personally, if you dont like what the program does, just delete it.

Cheers

MANNEKEPIS · Post by **MANNEKEPIS** » Sat Mar 11, 2006 1:47 pm

Thanks to all. I ran the removal tool and got rid of it. Question is, when will the program reinstall itself? Whenever I run an update?

Taylor · Post by **Taylor** » Sat Mar 11, 2006 2:17 pm

inquisitor_uk wrote:
Lucy wrote:The answer is quite simple...
yes, delete Real Player.. lol..

Or dont install in the first place. Thanks Inquisitor

Lucy · Post by **Lucy** » Sat Mar 11, 2006 2:29 pm

So, inquisitor, you are confirming that RealPlayer is spyware just as I believed.

The removal tool is necessary for getting rid of the worm, but because I never allowed the file to run, I didn't need it. I should have pointed that out for anyone who has run the application. Thanks for filling in that blank for me.

The license agreement for RealPlayer states:

8. SCHEDULER. An application Scheduler, known as "realsched.exe," is installed along with RealPlayer. Once installed, it runs independently of RealPlayer. The Scheduler does not collect personal information or communicate with RealNetworks' servers. It is used to remind AutoUpdate, Message Center and the Watch Folders feature to perform their tasks at pre-scheduled intervals. Scheduler also watches for and alerts RealPlayer to connection and disconnection of portable devices. You can control these activities via the Automatic Services section of the Preferences dialog, located under the Tools menu.

Well we know thats bullshit don't we?

MANNEKEPIS wrote:
Question is, when will the program reinstall itself? Whenever I run an update?

The answer is to block RealPayer from gaining access to the internet. It will then never know that an update is available.
If what license agreement tell us is true, the removal of 'realsched.exe' will prevent updates anyway.

How do you guys view .rm files without RealPlayer. Answer that and RealPlayer once more becomes history on my computer. I haven't been able to find a converter thats works.

Taylor · Post by **Taylor** » Sun Mar 12, 2006 6:48 am

Lucy wrote:How do you guys view .rm files without RealPlayer. Answer that and RealPlayer once more becomes history on my computer. I haven't been able to find a converter thats works.

Have you tried Real Alternative? Make sure it is 1.48 beta

Code: Select all

http://www.free-codecs.com/Real_Alternative_download.htm

From what I have read, it contains no spyware.

or Jet Audio (AUDIO ONLY)

Code: Select all

http://www.cowonamerica.com/download/

Jet Audio wrote:We don't collect ANY personal/private information of our users.
During auto-update, jetAudio sends ONLY version information to our server to check if new version is available.
After checking version, jetAudio downloads update file from our server if it is available.
During this process, any personal/private information is not sent to us. Some users asked us the following question:

Q: During updates, jetAudio will occasionally (not always) access "armadillo"; a DRM (Digital Rights Media) bot that it installed in the registry under:
HKEY_LOCAL_MACHINE\SOFTWARE\The Silicon Realms
Toolworks\Armadillo\\{0D5770197E405C419}.

A:Armadillo is a software protection package that wraps the TrueUpdate runtime to keep it from being hacked or decompiled. We are using TrueUpdate software from IndigoRose, Inc. for auto-update function of jetAudio.

These are the only two alternatives I can find that will play rm without having Realplayer installed on your computer.

I did read somewhere that Microsoft and the developers of RM had been at each other for years, but Microsoft had backed down and introduced a plugin to allow rm files to be played on WMP. This is all hearsay but if I find the link, Ill post it here.

DOWNLOAD THESE PLAYERS AT YOUR OWN RISK. I HAD REAL ALTERNATIVE ON MY SYsTEM 4 YEARS AGO WITH NO SPYWARE. I haven't had it installed since

Taylor · Post by **Taylor** » Sun Mar 12, 2006 7:21 am

OK, for some stupid reason, I just downloaded and installed Real Alternative on my system. Not something I normally do but this will go on for ever if someone doesnt do it. IMPORTANT. REALPLAYER MUST BE TOTALLY REMOVED FROM YOUR SYSTEM BEFORE INSTALLING REAL ALTERNATIVE

Make sure you download the 1.48 Beta version. Link in post above!

When you download it, it comes with WMC (windows media classic) Why the fuck they put that in I do not know, but it's up to you if you want to install it!

Make sure all browsers are closed, then install.

I have just tried it with an audio rm and it works in WMP 10!! NO ADWARE/SPYWARE/WESTERN SUPERMARE/OLD MARE or any other mare you can think off.

Once I find a video, Ill test it.

2 mins later........

Ok, found a rm and a ram video and it works ok.

Again, it's up to you if you try this!!!

inquisitor_uk · Post by **inquisitor_uk** » Mon Mar 13, 2006 12:42 am

waits for the comments along the lines of : " My one doesn't have the red arrow, does that mean I have the demo?? "

LMAO

(ps, mind wonders as to why you have a robotic arm chemist RM File in the first place..

)

Taylor · Post by **Taylor** » Mon Mar 13, 2006 1:07 am

inquisitor_uk wrote:waits for the comments along the lines of : " My one doesn't have the red arrow, does that mean I have the demo?? "

LMAO

(ps, mind wonders as to why you have a robotic arm chemist RM File in the first place.. )

Ha ha... I didn't even think of that man... as to the robotic arm chemist file... Im keeping quiet!

Lucy · Post by **Lucy** » Mon Mar 13, 2006 2:44 am

Thanks Taylor. I really didn't like having that crap on my computer.

I've downloaded the alternative and it works fine. I've also blocked it's internet access.

Once again RealPlayer has been consigned to the round filing cabinet. The uninstall program does not remove the permissions from the firewall. There were five of them that need to be stripped out manually.

inquisitor_uk · Post by **inquisitor_uk** » Mon Mar 13, 2006 2:52 am

No un-install program is meant to be able to change ANYTHING within the firewall, as it would be a security risk. think about it, if a program could tell the firewall to remove an entry, whats stopping them telling the firewall to do the reverse? ADD entrys ? (for trojens and what not)... the only thing automatic that ANY firewall should act on, is its own update program (which is CRC checked and validated before changes are made)

Nothing should be able to add or remove from any firewall automaticly, and if you find one that does (firewall that is) change it as soon as possible.

Edit: oh and Taylor, I just saw your NO ADWARE/SPYWARE/WESTERN SUPERMARE/OLD MARE comment.. LMAO.. the contents of my coffee are now all over my monitor.. cheers..

Taylor · Post by **Taylor** » Mon Mar 13, 2006 5:34 am

No problem Lucy. Glad We could all help

Inquistor

sorry pal LMAO

Lucy · Post by **Lucy** » Mon Mar 13, 2006 9:11 am

inquisitor_uk wrote:No un-install program is meant to be able to change ANYTHING within the firewall, as it would be a security risk. think about it, if a program could tell the firewall to remove an entry, whats stopping them telling the firewall to do the reverse? ADD entrys ? (for trojens and what not)... the only thing automatic that ANY firewall should act on, is its own update program (which is CRC checked and validated before changes are made)

Nothing should be able to add or remove from any firewall automaticly, and if you find one that does (firewall that is) change it as soon as possible.

Yeah, I understood that. I was pointing it out for anyone who uninstalled RealPlayer.

justalurker · Post by **justalurker** » Tue Mar 14, 2006 8:00 pm

I agree to Taylor - I learn something new every day!

lurker

Fatso's Pee Board

Is RealPlayer spying on you?

Is RealPlayer spying on you?

Re: Is RealPlayer spying on you?

Re: Is RealPlayer spying on you?

Very interesting Topic!