Why is TomeRaider 3 trying to connect to Google IPs?

[Ashley81]

When I start up TombRaider 3.3.9 , it tries to connect with an IP address that's registered to Google.

I tried using two different 3.3.9 installers just to make sure I didn't download a bad one.
One is from downloads.com and the other is directly from the official TomeRaider website, and both of them produce installations that try to connect with a Google IP address.

The one from downloads.com tries to connect to 209.85.139.176 and the one from the official site tries to connect to 74.125.19.99.
Both are registered to Google.



I really don't like it when any software attempts internet communication without at least asking my permission.
It's sneaky and especially inappropriate for software that I paid $30.00 for.

And I'm particularly bothered that TomeRaider is not only sneaking internet communication, it's sneaking it with a third party IP.


To make matters worse, I scanned TomeRaider's installed files and VBA32 heuristics detected the "Downloader.Small.7" Trojan.

I understand that heuristics scans can often turn up false positives, but I've virtually never had it happen with software that I've paid for.
In fact, the only other times that I can recall receiving false positives with purchased software were when I was scanning complex security software, which is understandable.


Anyway ... I've been unable to find anything on this subject while searching the web, so I figured I'd post here and see if anyone knows what's up.



- Ash

[Alexander Turcic]

Ash, this doesn't sound good. I suggest you PM Mat directly and ask him for advice.

[Ashley81]

Nothing from Mat yet

[pilotbob]

Originally Posted by Ashley81

Anyway ... I've been unable to find anything on this subject while searching the web, so I figured I'd post here and see if anyone knows what's up.

Perhaps you can through Fiddler on your machine and you can actually see what data is being sent/recieved. Perhaps it is just some usage stats or maybe a built in updater like many apps have in them these days.

BOb

[Ashley81]

It's not acceptable for TomeRaider to be sending or receiving anything without my permission, even if it is "just" usage stats or a built-in updater.

That's the stuff of spyware and lowly freeware, not reputable software that costs $30.

[igorsk]

It's not nesessarily TomeRaider. It could be one of the DLLs it loads, or even a DLL which is loaded into every new process (antiviruses and firewalls like to do that, or software like Google Desktop). I would recommend investigating the matter properly before accusing anyone. Did you check on another machine? Can anyone else confirm this behavior?

[Ashley81]

I would recommend investigating the matter properly before accusing anyone.

Interesting tone.
Posting in a forum in search of feedback from others isn't quite how I would go about accusing someone of something.
It is, however, how I would go about getting feedback from others.
I think I investigated well enough before posting here, and my posting here is part of my 'investigating the matter' further.

Did you check on another machine?

Yes
Nothing on either of the machines has ever tried to access a Google IP before installing TomeRaider.

Can anyone else confirm this behavior?

I'm hoping so.
As you can see, nobody's posted much of anything so far.
I think they're waiting to hear what Mat says, same as me.

[pilotbob]

OK, I give up and I'm curious. What is TombRaider? I couldn't find anything about it.

BOb

[DaleDe]

Originally Posted by pilotbob

OK, I give up and I'm curious. What is TombRaider? I couldn't find anything about it.

BOb

Did you look on our wiki?

Dale

[montsnmags]

Originally Posted by DaleDe

Did you look on our wiki?

Dale

I believe the problem may lay with the Lara Croft Effect, which, alas, the wiki cannot rectify (except perhaps with a redirect).

Cheers,
Marc

[pilotbob]

Originally Posted by montsnmags

I believe the problem may lay with the Lara Croft Effect, which, alas, the wiki cannot rectify (except perhaps with a redirect).

Cheers,
Marc

You are correct sir.

BOb