Spyware in iRiver software??

dartiss · #1 (**permalink**) February 7th, 2005, 05:14 AM

I've just got an IFP-790T. Had to install the music manager before I could upgrade the firmware to turn it into UMS. Anyway, uninstalled the software once that was done.

Zonealarm then started asking me if I wanted Moodlogic Updater to contact the internet. I declined it and did some investigation...

In the task manager I found "updater.exe" running. Closed this down.

Running MSCONFIG I found it had started from that so I removed it.

Lastly, I tracked down the software - there were 2 files in C:\ (including updater.exe). Both were tagged with the "Moodlogic" name. Moodlogic is the company that produces the software for iRiver.

So let's get this right... the iRiver software is uninstalled but "conveniently" forgets to uninstall some software left in the root of your main drive which still runs after every boot and accesses the internet.

Thinking it was a bad uninstall I tried it again on another PC and it didn exactly the same.

Seems to me Moodlogic have some explaining to do !!

Anybody else have any experience of this ?

Astec · #2 (**permalink**) February 7th, 2005, 05:18 AM

This isnt spyware, the thing is probably trying to make sure you have the latest version of the app to make it the best experience for you.

**andrewmel** · #3 (**permalink**) February 7th, 2005, 05:19 AM

Welcome to MisticRiver. Good find, I will be interested to see what comes of this....

z

dartiss · #4 (**permalink**) February 7th, 2005, 05:22 AM

Quote:

Originally Posted by Astec123

This isnt spyware, the thing is probably trying to make sure you have the latest version of the app to make it the best experience for you.

Nah. Sorry, don't agree with you. If you look in the list of programs to add/remove their are 2 entries for the Music Manager - the manager itself and the software updater. When you uninstall the main music manager the other goes as well. It's uninstalled. Removed. Gone.

So why is a piece of software still there and contacting the internet ? And why is it in the root drive and not in "Program files" where it should be ?

If I've uninstalled the software where's the need to check for updates ?

David.

dartiss · #5 (**permalink**) February 7th, 2005, 05:33 AM

Quote:

Originally Posted by azesty

Welcome to MisticRiver. Good find, I will be interested to see what comes of this....

z

Thanks - glad to be here

I've emailed both Moodlogic and iRiver about my concern so we'll see what comes of it !

**andrewmel** · #6 (**permalink**) February 7th, 2005, 05:35 AM

I dont imagine that they will admit to that.

But there are sure to be some here with good enough firewalls that tell you if something is trying to connect out. But I know that many use xp, and the sp2 firewall doesnt detect that, which sucks....

z

Praz · #7 (**permalink**) February 7th, 2005, 06:57 AM

I would attribute this to bad programming more than spyware. Especially with software that comes bundled with a hardware product. They anticipate that you will install it and keep it on your computer for as long as you have the player. I doubt they did comprehensive testing to make sure it uninstalled all related files. I mean, what could they be reporting back?

**andrewmel** · #8 (**permalink**) February 7th, 2005, 06:59 AM

The same as all spyware, anything from where you go on your browser to the keystrokes you type when you are typing on an encrypted page......

But if it was iRiver spyware it would more likely be taking stats on how often you connected your player, how much music you transfer at a time, which music sites you go to, ect.

z

Praz · #9 (**permalink**) February 7th, 2005, 07:32 AM

Seems like a lot of trouble to go through, plus the risk of a potential owner backlash considering they could have gotten most of that information from this site.

dartiss · #10 (**permalink**) February 7th, 2005, 09:10 AM

I'd agree with all this if it was iRiver software but it's not. And who knows what information Moodlogic is after. Ok, so it may just be information about usage stats, configuration etc. But what if I don't want to send them this ? And that's what Spyware is about - software installed on your computer without your knowledge reporting information that you're not aware of.

David.

Renfield · #11 (**permalink**) March 8th, 2005, 08:03 PM

I've also been getting the notices from Zone Alarm that the Moodlogic Updater was trying to access the internet.

I tried to remove the iRiver updater from the Control Panel / Add/Remove Programs and it fails - but does give me the option to just eliminate it from the software list. A lot of help that does.

First - kudos to Zone Alarm for detecting and blocking this software.

Second - I agree that no software like this should ever be installed without explicitly asking first. iRiver has some explaining to do in my opinion.

I e-mailed iRiver support requesting instructions on how to completely remove the software from my system. This kind of thing really ticks me off and if I have to rebuild my system to get rid of it, I will.

I am waiting to hear what iRiver says about removing the software and exactly what it does. I can still return my player and will if I'm not happy with iRiver's reply.

I almost bought an iPod. Right now I'm kind of wishing I had.

I hate supporting companies that inject extra software where it doesn't belong. All they had to do was add a menu item to check for updates and give people the option to turn on and off automatic checks for updates.

I view this as an unwelcome invasion pure and simple.

There is no need for a separate application that tries to link up who knows where for what purpose.

captures_polar_bears · #12 (**permalink**) March 8th, 2005, 08:08 PM

but how would an updater be classified as "spyware." if the updater is rountinely checked for updates that seems normal. is there any way to see just what information is being sent and received? seems like there would be, but i'm just not computer savvy enough to know anything about it.

also, how would this be different from macaffee's update program?

i'm not contesting or trying to be a jerk, i'm just really curious about this. i'm not sure why as i don't use the software. i guess just the cat's cliche curiosity.

dartiss · #13 (**permalink**) March 9th, 2005, 02:13 AM

Quote:

but how would an updater be classified as "spyware."

Simple - it won't uninstall with the rest of the software and is using the internet without authorisation.

Let me get this clear - this application isn't the iRiver software updater. This only starts accessing the internet ONCE you've uninstalled that software.

It is named as MoodLogic (the author of the iRiver software) so, with all respect to Renfield, I wouldn't blame iRiver - they've probably bought this software from them with good faith.

Of course it may be that this software simply is requesting updated. But why - I've uninstalled the software? Why is it installed in C:\ and not in the iRiver directory? Why does it only start working once you uninstall the iRiver software?

Something doesn't seem right.

But, as I say, simply delete it from your C:\ root and it should be okay.

I never got a reply from Moodlogic or iRiver though, which is rather disappointing.

David.

Renfield · #14 (**permalink**) March 9th, 2005, 06:00 PM

It has been trying to contact the internet on my system even though I didn't uninstall (yet) the iRiver software.

And why it is in the C:\ directory instead of in the iRiver directory is a good question.

I've found other discussion about this rogue piece of software elsewhere. Nobody knows what it actually does.

MoodLogic appears to have some kind of service that "fixes" the names/artists/genre of your mp3 files. It would seem this piece of software is snooping for what files you have but I don't know how to determine if it really is or not.

And it's now been 24 hours and no response from iRiver from my questions as to what the software is and how I can remove it.

They have 24 more before I pack my 790 up and return it.

Terry · #15 (**permalink**) March 9th, 2005, 06:23 PM

I too have Zonelab and have received the update message regarding MoodLogic from the firewall. However, after I deleted MoodLogic software (via remove software in XP), it has not reappeared. The updater.exe does not appear in my task list. It sounds more a matter of completely getting the program deleted.
Having said that, I'm not certain you can consider an update request spyware. Many programs that are revised frequently do update i.e. Norton Antiviris and even Zone Lab itself. Zone Lab itself is a truly outstanding investment, wouldn't be without it.

Terry

SilverX · #16 (**permalink**) March 11th, 2005, 10:37 AM

Why is it that when I install Halo, it creates a gamesave folder in MyDocuments rather than the Halo folder? Because they can. Meh

iriver took 2 1/2 weeks to respond my simple N10 question. (Does the unit shut down after being fully charged; I found out it doesn't on my own).
Yep, 2 1/2 weeks, so start packing your iFP-790.

danimal1968 · #17 (**permalink**) March 11th, 2005, 01:10 PM

Quote:

Originally Posted by Terry

I too have Zonelab and have received the update message regarding MoodLogic from the firewall. However, after I deleted MoodLogic software (via remove software in XP), it has not reappeared. The updater.exe does not appear in my task list. It sounds more a matter of completely getting the program deleted.
Having said that, I'm not certain you can consider an update request spyware. Many programs that are revised frequently do update i.e. Norton Antiviris and even Zone Lab itself. Zone Lab itself is a truly outstanding investment, wouldn't be without it.

Terry

Well, ZoneAlarm is free so it's not really an investment.

Incubus311 · #18 (**permalink**) March 11th, 2005, 02:39 PM

Quote:

Why is it that when I install Halo, it creates a gamesave folder in MyDocuments rather than the Halo folder?

a lot of recent games do this, it's Microsoft's way of taking advantage of the XP Fast User Switch feature, so your dad or some other person who uses your computer can log into XP and have their save files seperated from yours. Well... that was way offtopic. Anyway I can definitely see Moodlogic as being spyware. This website looks interesting. http://ask-leo.com/updaterexe.html

SilverX · #19 (**permalink**) March 11th, 2005, 09:03 PM

But I'm running Win2K,

Oh well.

I dunno about you guys, but I deleted updater.exe with ease. The guy in the link said he couldn't.

ghostface_killah24 · #20 (**permalink**) March 11th, 2005, 11:14 PM

I think that this is not at all spyware. It maybe is looking for updates for the program itself. Anyways, the program is terrible.

jlessick · #21 (**permalink**) May 11th, 2005, 10:08 AM

It might be a good idea to mention here that in this always connected world there are a lot of programs that use a file named "updater.exe". Adobe Acrobat Reader is one of them. There are also Spyware and/or Trojans that use a file by that name. If it is installed in the root directory, it is almost certianly not a file you would want there, and I would delete it.

The one you want to keep is installed in "Program Files\iRiver\iRiver Manager\Updater".

mozetti · #22 (**permalink**) May 11th, 2005, 11:46 AM

You're all off your nut - just cuz it doesn't uninstall doesn't mean that it is spyware. Spyware reports your activities back to a person/server/whatever.

As far as "not being informed it would be installed" - I haven't installed or used the software, and I don't know if it's spelled out in any documentation or not, but unless you've read the full EULA (that thing you always click "I Accept" when installing software) and all the documentation you can't complain that you weren't informed.

Finally, software that doesn't fully uninstall is nothing new ... in fact alot of software is like that. Ever tried uninstalling Norton/Symantec products? How about MS products? Corel? ... the list goes on.

Spyware is the latest buzzword, so everything must be spyware nowadays, I guess.

Triskelios · #23 (**permalink**) May 11th, 2005, 12:00 PM

Quote:

Originally Posted by mozetti

You're all off your nut - just cuz it doesn't uninstall doesn't mean that it is spyware. Spyware reports your activities back to a person/server/whatever.

Indeed, someone pointed out that there might be an uninstall option as well, that was just being overlooked.

Quote:

Originally Posted by mozetti

As far as "not being informed it would be installed" - I haven't installed or used the software, and I don't know if it's spelled out in any documentation or not, but unless you've read the full EULA (that thing you always click "I Accept" when installing software) and all the documentation you can't complain that you weren't informed.

The "click to accept" software licences are known as "shrinkwrap" licences, and it's questionable whether they qualify as a legally binding contracts; in many cases the user has no obligation to abide by the terms they "agreed" to because it's a fake, unsigned contract.