Why is TomeRaider 3 trying to connect to Google IPs?

Ashley81 · 04-30-2008, 10:58 AM

When I start up TombRaider 3.3.9 , it tries to connect with an IP address that's registered to Google.

I tried using two different 3.3.9 installers just to make sure I didn't download a bad one.
One is from downloads.com and the other is directly from the official TomeRaider website, and both of them produce installations that try to connect with a Google IP address.

The one from downloads.com tries to connect to 209.85.139.176 and the one from the official site tries to connect to 74.125.19.99.
Both are registered to Google.

I really don't like it when any software attempts internet communication without at least asking my permission.
It's sneaky and especially inappropriate for software that I paid $30.00 for.

And I'm particularly bothered that TomeRaider is not only sneaking internet communication, it's sneaking it with a third party IP.

To make matters worse, I scanned TomeRaider's installed files and VBA32 heuristics detected the "Downloader.Small.7" Trojan.

I understand that heuristics scans can often turn up false positives, but I've virtually never had it happen with software that I've paid for.
In fact, the only other times that I can recall receiving false positives with purchased software were when I was scanning complex security software, which is understandable.

Anyway ... I've been unable to find anything on this subject while searching the web, so I figured I'd post here and see if anyone knows what's up.

- Ash

Alexander Turcic · 04-30-2008, 01:16 PM

Ash, this doesn't sound good. I suggest you PM Mat directly and ask him for advice.

Ashley81 · 05-05-2008, 06:47 PM

Nothing from Mat yet

pilotbob · 05-05-2008, 06:49 PM

Quote:

Originally Posted by Ashley81

Anyway ... I've been unable to find anything on this subject while searching the web, so I figured I'd post here and see if anyone knows what's up.

Perhaps you can through Fiddler on your machine and you can actually see what data is being sent/recieved. Perhaps it is just some usage stats or maybe a built in updater like many apps have in them these days.

BOb

Ashley81 · 05-07-2008, 08:30 AM

It's not acceptable for TomeRaider to be sending or receiving anything without my permission, even if it is "just" usage stats or a built-in updater.

That's the stuff of spyware and lowly freeware, not reputable software that costs $30.

igorsk · 05-07-2008, 09:33 AM

It's not nesessarily TomeRaider. It could be one of the DLLs it loads, or even a DLL which is loaded into every new process (antiviruses and firewalls like to do that, or software like Google Desktop). I would recommend investigating the matter properly before accusing anyone. Did you check on another machine? Can anyone else confirm this behavior?

Ashley81 · 05-07-2008, 02:01 PM

Quote:

I would recommend investigating the matter properly before accusing anyone.

Interesting tone.
Posting in a forum in search of feedback from others isn't quite how I would go about accusing someone of something.
It is, however, how I would go about getting feedback from others.
I think I investigated well enough before posting here, and my posting here is part of my 'investigating the matter' further.

Quote:

Did you check on another machine?

Yes
Nothing on either of the machines has ever tried to access a Google IP before installing TomeRaider.

Quote:

Can anyone else confirm this behavior?

I'm hoping so.
As you can see, nobody's posted much of anything so far.
I think they're waiting to hear what Mat says, same as me.

pilotbob · 05-07-2008, 02:14 PM

OK, I give up and I'm curious. What is TombRaider? I couldn't find anything about it.

BOb

DaleDe · 05-07-2008, 02:22 PM

Quote:

Originally Posted by pilotbob

OK, I give up and I'm curious. What is TombRaider? I couldn't find anything about it.

BOb

Did you look on our wiki?

Dale

montsnmags · 05-07-2008, 11:36 PM

Quote:

Originally Posted by DaleDe

Did you look on our wiki?

Dale

I believe the problem may lay with the Lara Croft Effect, which, alas, the wiki cannot rectify (except perhaps with a redirect).

Cheers,
Marc

pilotbob · 05-08-2008, 12:00 AM

Quote:

Originally Posted by montsnmags

I believe the problem may lay with the Lara Croft Effect, which, alas, the wiki cannot rectify (except perhaps with a redirect).

Cheers,
Marc

You are correct sir.

BOb

04-30-2008, 10:58 AM	#1
Ashley81 Junior Member Posts: 4 Karma: 10 Join Date: Apr 2008 Device: TomeRaider3	Why is TomeRaider 3 trying to connect to Google IPs? When I start up TombRaider 3.3.9 , it tries to connect with an IP address that's registered to Google. I tried using two different 3.3.9 installers just to make sure I didn't download a bad one. One is from downloads.com and the other is directly from the official TomeRaider website, and both of them produce installations that try to connect with a Google IP address. The one from downloads.com tries to connect to 209.85.139.176 and the one from the official site tries to connect to 74.125.19.99. Both are registered to Google. I really don't like it when any software attempts internet communication without at least asking my permission. It's sneaky and especially inappropriate for software that I paid $30.00 for. And I'm particularly bothered that TomeRaider is not only sneaking internet communication, it's sneaking it with a third party IP. To make matters worse, I scanned TomeRaider's installed files and VBA32 heuristics detected the "Downloader.Small.7" Trojan. I understand that heuristics scans can often turn up false positives, but I've virtually never had it happen with software that I've paid for. In fact, the only other times that I can recall receiving false positives with purchased software were when I was scanning complex security software, which is understandable. Anyway ... I've been unable to find anything on this subject while searching the web, so I figured I'd post here and see if anyone knows what's up. - Ash

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Problems with Google Book Search on Sony Connect	Tom Swift	Sony Reader	18	03-31-2009 12:14 AM
HTML to TomeRaider 3	pruss	Reading and Management	4	10-09-2007 05:46 AM
Change PDF title in Connect/Import files w/o Connect	jessesn	Sony Reader	6	10-02-2006 01:55 PM
TomeRaider 3: P r i n t i s D e a d	sUnShInE	Reading and Management	7	11-16-2004 06:15 PM
TomeRaider 3 is Final now	Colin Dunstan	Reading and Management	3	10-23-2004 02:20 PM

04-30-2008, 01:16 PM	#2
Alexander Turcic Fully Converged Posts: 18,175 Karma: 14021202 Join Date: Oct 2002 Location: Switzerland Device: Too many to count here.	Ash, this doesn't sound good. I suggest you PM Mat directly and ask him for advice.

05-05-2008, 06:47 PM	#3
Ashley81 Junior Member Posts: 4 Karma: 10 Join Date: Apr 2008 Device: TomeRaider3	Nothing from Mat yet

05-07-2008, 08:30 AM	#5
Ashley81 Junior Member Posts: 4 Karma: 10 Join Date: Apr 2008 Device: TomeRaider3	It's not acceptable for TomeRaider to be sending or receiving anything without my permission, even if it is "just" usage stats or a built-in updater. That's the stuff of spyware and lowly freeware, not reputable software that costs $30.

05-07-2008, 09:33 AM	#6
igorsk Wizard Posts: 3,442 Karma: 300001 Join Date: Sep 2006 Location: Belgium Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear	It's not nesessarily TomeRaider. It could be one of the DLLs it loads, or even a DLL which is loaded into every new process (antiviruses and firewalls like to do that, or software like Google Desktop). I would recommend investigating the matter properly before accusing anyone. Did you check on another machine? Can anyone else confirm this behavior?

05-07-2008, 02:14 PM	#8
pilotbob Grand Sorcerer Posts: 19,832 Karma: 11844413 Join Date: Jan 2007 Location: Tampa, FL USA Device: Kindle Touch	OK, I give up and I'm curious. What is TombRaider? I couldn't find anything about it. BOb