? Realsched.exe is still not blocked

[Mark]

Realsched.exe is listed as blocked, it really isn't. I am looking in
Advance Tools\System Explorers\Startup Programs\Blocked Startup Programs.

I had a heck of a time finding out where this is controlled to unblock,
this message is virtually looseness, but eventually I found it. "To
un-block this Startup program, navigate to the Security Agents >
Application Agents > View Blocked Events".

However, even though I checked to see if this was actually blocked in
"Realtime Protection\Application Agents\Startup Files

Thanks

M

 

[Bill Sanderson]

You can't successfully block this with Microsoft Antispyware. You can
remove it on a one-time basis, but Real will put it back next time you run
the app.

If you want this not to run, uninstall Real's player, or use an alternative
player which can handle the formats.

http://www.free-codecs.com/download/Real_Alternative.htm

is one possibility. I should state that I am quite dubious about the wisdom
of using these alternatives. 1) I suspect that they use Real's IP and code
to get the job done, probably without license from Real. This may not be
legal, free or not. 2) Given that they use that code--if there is a
security vulnerability involved (and there have been such in the past)--will
you get timely notice and fixes to such security issues from the folks
behind the alternative player?

 

[Tom Emmelot]

Hello Bill,

all the best wishes for 2006!
I use the Alternative player for 2 years now, never had any problems.
But you are right, no warnings you must go to there site to get updates.

Regards >*< TOM >*<




Bill Sanderson schreef:

 

[Guest]

Thanks! There are tradeoffs in every choice, I'm afraid. I find that for
Real's stuff, I'm willing to go out and configure it carefully, and find the
end result of that satisfactory. This is not the case with Quicktime,
unfortunately--and every once in a while I blow that away in disgust.

 

[Bill Sanderson]

And best wishes to you as well! (still not too wide awake!)

--

 

[Guest]

An alternative to RealPlayer is OK but the real question (forgive the pun) is
why is an apparently blocked process still being allowed to run? Is this a
one off case and there is some tie up between MS and Realplayer, or will MS
antispyware always override your manual exceptions?...

 

[Guest]

Realplayer is not spyware as defined by Microsoft Antispyware.

That's the heart of the issue. The UI allows you to block this process on a
given startup, but it does not allow the user to "tag" a given process as
spyware and retain that information across reboots. So--maybe this is an
informational or labelling issue--clearly users expectations are different
than what the program actually is intended to do.

Microsoft Antispyware does not allow you to permanently block software which
isn't spyware which you've knowingly installed and could perfectly well
uninstall.

This isn't a matter of some collusion between Microsoft and Realplayer--all
vendors are treated equally. See the info here, about how Microsoft
determines whether a given application qualifies for removal by Microsoft
antispyware:

http://www.microsoft.com/athome/security/spyware/software/isv/analysis.mspx

Additionally, I believe that realplayers executables can be set not to start
via UI within the program, unlike Quicktime--is that not the case?

 

[Guest]

I think that I agree with you about the perceptions of the suer expectations.
My focus was not intenionally specific to RealPlayer but on the whole
process where spyware is only spyware when it is defined as that by
Microsoft.... The control lies with Microsoft alone without the individual
user having an override position.

When is the option to block a specific process not an option?... When MS
wants to override it. My expectation of the software is built upon the
feature that MS themselves have incorporated. If there was no facility to
individually block a process and therefore all blocking was done centrally by
MS then I would not have any expectations as to the features of the software.

However, the application does allow the blocking of specific processes, but
then allows those process to re-instate themselves! This appears to more of a
security issue, or bug in the coding than excessive expextations.

As I see it, it is simple either we can, or we cannot, block a process
successfully and permanently. My expectations and use of the software will
stem from that. What is not appropiate is for the software to tell me that a
process is 'blocked' but then to not actually block it.

 

[Guest]

I'll be interested to see how this feature works in beta1. I do think that
it causes the kind of confusion about capabilities that is evidenced by your
question--and you are not alone--many users expect to be able to block a
specific process of their choice based on the UI in the beta1 product.

It is true that the individual user cannot directly choose whether a given
process is labelled spyware. In the larger sense, however, the spynet
"voting" process does give the users a level of choice about what happens.
This anonymous data collection process is a significant strength of the
technology Microsoft bought from Giant, and they show every sign of
continuing and expanding its use.

In general, I view the system explorers as a mechanism provided to allow a
user to disinfect a machine when the spyware or virus in place is not
something known to Spynet yet. It is confusing--if you block an entry in the
hosts file, for example, that's permanent--it persists across reboots.
Blocking realplayer, however, isn't.

I'm not sure how they can improve this, but I think it is a matter of
description and documentation.