"TKBELLEXE" reg entry being added by realsched.exe

[Richard White]

program C:\Program Files\Common Files\Real\Update_OB\realsched.exe (I think!!) is intermittently
attempting to add a startup registry entry as follows:-

===============================================
02/09/2004 23:42:15 - Registry modification detected
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\Run
Value:TkBellExe
Data:
New Data:"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

Attempt to alter the autostart section (Blocked)

===============================================

I was wondering if somehow my RealPlayer software that I have is infected with the W32/Lovgate.ad@MM
or W32/Lovgate.af@MM virus. (See http://vil.nai.com/vil/content/v_126560.htm)

However, after running an extra virus scan, and also running the McAfee "Stinger" program, I can
find no trace of infection.

So QUESTION .... what is actually happening?
Which program is doing this?
(unfortunately, Ad-Aware doesn't record the program *attempting* the Registry Update - only the
update attempt itself)

If the RealPlayer software is behaving correctly:-
a) why has this problem only recently started?
b) how do I stop it?

Thanks in advance

Richard

 

[t.cruise]

By default RealPlayer is set to perform certain automatic services, like loading at
Startup, automatically updating, and other things. Personally I don't want anything
automatically downloading and installing to my system, nor do I need RealPlayer and yet
another Messenger service loading at Startup. I turned off those Automatic Services using
the RealPlayer Tools menu/Preferences. When I need RealPlayer, I either open it from a
shortcut, double click a Real file, or it will stream from a web site, all of which don't
need RealPlayer to load on Startup.

 

[Vance G]

Real Player is a nasty, invasive little bastard.

Even doing what t.cruise suggested won't stop it
completely.

If you REALLY want to lobotimize it, you need
to delete the entire \Update_OB directory with everything
under it.

Just MOVE it first, in case RP coughs a hairball
without it, you can move it back.

In my situation, deleting that directory stopped ALL
RP's crappy behavior when ALSO turning off all
its other crap from within the program as t. suggests.

By default RealPlayer is set to perform certain automatic services, like loading at
Startup, automatically updating, and other things. Personally I don't want anything
automatically downloading and installing to my system, nor do I need RealPlayer and yet
another Messenger service loading at Startup. I turned off those Automatic Services using
the RealPlayer Tools menu/Preferences. When I need RealPlayer, I either open it from a
shortcut, double click a Real file, or it will stream from a web site, all of which don't
need RealPlayer to load on Startup.
--

T.C.
t__cruise@[NoSpam]hotmail.com
Remove [NoSpam] to reply

program C:\Program Files\Common Files\Real\Update_OB\realsched.exe (I

think!!) is
intermittently

attempting to add a startup registry entry as follows:-

===============================================
02/09/2004 23:42:15 - Registry modification detected
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\Run
Value:TkBellExe
Data:
New Data:"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

Attempt to alter the autostart section (Blocked)

===============================================

I was wondering if somehow my RealPlayer software that I have is

infected with the
W32/Lovgate.ad@MM

or W32/Lovgate.af@MM virus. (See http://vil.nai.com/vil/content/v_126560.htm)

However, after running an extra virus scan, and also running the McAfee

"Stinger"
program, I can

find no trace of infection.

So QUESTION .... what is actually happening?
Which program is doing this?
(unfortunately, Ad-Aware doesn't record the program *attempting* the

Registry Update -
only the

update attempt itself)

If the RealPlayer software is behaving correctly:-
a) why has this problem only recently started?
b) how do I stop it?

Thanks in advance

Richard

 

[Kelly]

http://www.google.com/search?hl=en&ie=UTF-8&q=TkBellExe&btnG=Google+Search