home
products
contribute
download
documentation
forum
Home
Forums
New posts
Search forums
What's new
New posts
All posts
Latest activity
Members
Registered members
Current visitors
Donate
Log in
Register
What's new
Search
Search
Search titles only
By:
New posts
Search forums
Search titles only
By:
Menu
Log in
Register
Navigation
Install the app
Install
More options
Contact us
Close Menu
Forums
MediaPortal 1
Support
General Support
Playback Problems
Contact us
RSS
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Reply to thread
Message
<blockquote data-quote="MPKeith" data-source="post: 306757" data-attributes="member: 82758"><p>Hello,</p><p> I have been using MP for a year or so now without problems (great program guys, thanks!). A seemingly unrelated spyware problem and long exhaustive search and process of elimination has led me to this thread - but I have something new to add to the discussion so far.</p><p></p><p>My problem was the same as has been described above by others in this thread: For many months and seemingly randomly, the ZoneAlarm Spyware scanner would pick up bass.dll as spyware. </p><p>My next steps were to:</p><p> - update to latest svn snapshots, make sure that MP installation files+bass.dll were not infected before being installed. </p><p> - triple check that bass.dll was the original that came with MP, </p><p> - Complete in-depth Scans of whole system with multiple spyware systems and over multiple days turned up nothing - my system appeared clean (woohoo!)</p><p></p><p>This process leans towards the conclusions that bass.dll was either A) a false positive in ZA, or B) infected after MediaPortal install. Not finding any other infections for many weeks of searching, I decided it was all a false positive, and so did the same as RichieB above; setting bass.dll to be ignored always by ZA. All seemed well and good.... but then the problems begun</p><p></p><p>My machine would seemingly randomly start trying to contact 888.com. Looking up that domain quickly shows it to be a well known location for the CasinoOnNet spyware. ZA spy site blocking would quickly pick it up and block the attempt, blink and you would miss the warning. Intrigued and alarmed that something was directing my Firefox browser to contact a known spyware supplier, I set out to track the problem down... which has led me back to bass.dll.</p><p></p><p>Starting from a clean install of MP, clean sweep(s) of system to determine there is no Virus/Spyware and running machine and no attempts to connect to any known spyware sites from my machine for a month or so. I fire up MP and use internet radio:</p><p></p><p>- bass.dll appears to "activate". ZoneAlarm suddenly picks it up as spyware where there was none before. </p><p>- I hardly ever use internet radio in MP, but now I had solved the "seemingly randomly" part of my problem - it's not random, its when I actually use the internet radio.</p><p>- Shortly after (usually the day later for me), my machine attempts to connect to 888.com. Other registry keys seem to be being set. This rules out that it is a false positive - this is a real spyware problem. (I quickly removed the "ignore always" option of ZA)</p><p>- Researching, and Mediaportal is not the only one effected. Kantaris <a href="http://www.kantaris.org/forum/viewtopic.php?f=3&p=251" target="_blank">www.kantaris.org &bull; View topic - Adware found</a> and a few other people around the net are discussing the same thing from different angles and combination's of these topics: 888.com, bass.dll, spyware, zonealarm. I have not yet found anything to the level of detail being discussed here though.</p><p>- I research bass.dll, who's behind it, what exactly is it and where does it come from? Turn up next to nothing. All I can find so far is what it does: <a href="http://www.un4seen.com/bass.html" target="_blank">BASS</a> . Its not open source I cannot check the source code. Un4seen alright, looks very suspicious so far.</p><p></p><p>Two conclusions I am drawing towards from all this:</p><p>1) bass.dll could still possibly somehow be infected after it is being activated for use streaming internet radio. However I am finding this explanation increasingly unlikely after hours of repeating the above process, pouring through security task manager/whats running logs and file access stats to figure out whats going on here. It appears to be coming from the file itself and only after it connects to a radio station.</p><p>OR</p><p>2) bass.dll IS a backdoor that is activating when it connects to any internet radio station. </p><p></p><p>In either case, for now I have no choice but to consider it real spyware. Either indirectly or directly bass.dll is allowing something/someone to enter into my machines, setup 888.com (known), do other damage (unknown).</p><p></p><p>Does anybody know more about bass.dll and un4seen and how trustworthy is it from this communities point of view? How likely could it be that this closed source library from unknown programmers is a clever front for a backdoor into every machine it is installed on?</p><p></p><p>Sorry for the long post, all comments and suggestion very welcome, thanks!</p><p></p><p>Keith.</p></blockquote><p></p>
[QUOTE="MPKeith, post: 306757, member: 82758"] Hello, I have been using MP for a year or so now without problems (great program guys, thanks!). A seemingly unrelated spyware problem and long exhaustive search and process of elimination has led me to this thread - but I have something new to add to the discussion so far. My problem was the same as has been described above by others in this thread: For many months and seemingly randomly, the ZoneAlarm Spyware scanner would pick up bass.dll as spyware. My next steps were to: - update to latest svn snapshots, make sure that MP installation files+bass.dll were not infected before being installed. - triple check that bass.dll was the original that came with MP, - Complete in-depth Scans of whole system with multiple spyware systems and over multiple days turned up nothing - my system appeared clean (woohoo!) This process leans towards the conclusions that bass.dll was either A) a false positive in ZA, or B) infected after MediaPortal install. Not finding any other infections for many weeks of searching, I decided it was all a false positive, and so did the same as RichieB above; setting bass.dll to be ignored always by ZA. All seemed well and good.... but then the problems begun My machine would seemingly randomly start trying to contact 888.com. Looking up that domain quickly shows it to be a well known location for the CasinoOnNet spyware. ZA spy site blocking would quickly pick it up and block the attempt, blink and you would miss the warning. Intrigued and alarmed that something was directing my Firefox browser to contact a known spyware supplier, I set out to track the problem down... which has led me back to bass.dll. Starting from a clean install of MP, clean sweep(s) of system to determine there is no Virus/Spyware and running machine and no attempts to connect to any known spyware sites from my machine for a month or so. I fire up MP and use internet radio: - bass.dll appears to "activate". ZoneAlarm suddenly picks it up as spyware where there was none before. - I hardly ever use internet radio in MP, but now I had solved the "seemingly randomly" part of my problem - it's not random, its when I actually use the internet radio. - Shortly after (usually the day later for me), my machine attempts to connect to 888.com. Other registry keys seem to be being set. This rules out that it is a false positive - this is a real spyware problem. (I quickly removed the "ignore always" option of ZA) - Researching, and Mediaportal is not the only one effected. Kantaris [url=http://www.kantaris.org/forum/viewtopic.php?f=3&p=251]www.kantaris.org • View topic - Adware found[/url] and a few other people around the net are discussing the same thing from different angles and combination's of these topics: 888.com, bass.dll, spyware, zonealarm. I have not yet found anything to the level of detail being discussed here though. - I research bass.dll, who's behind it, what exactly is it and where does it come from? Turn up next to nothing. All I can find so far is what it does: [url=http://www.un4seen.com/bass.html]BASS[/url] . Its not open source I cannot check the source code. Un4seen alright, looks very suspicious so far. Two conclusions I am drawing towards from all this: 1) bass.dll could still possibly somehow be infected after it is being activated for use streaming internet radio. However I am finding this explanation increasingly unlikely after hours of repeating the above process, pouring through security task manager/whats running logs and file access stats to figure out whats going on here. It appears to be coming from the file itself and only after it connects to a radio station. OR 2) bass.dll IS a backdoor that is activating when it connects to any internet radio station. In either case, for now I have no choice but to consider it real spyware. Either indirectly or directly bass.dll is allowing something/someone to enter into my machines, setup 888.com (known), do other damage (unknown). Does anybody know more about bass.dll and un4seen and how trustworthy is it from this communities point of view? How likely could it be that this closed source library from unknown programmers is a clever front for a backdoor into every machine it is installed on? Sorry for the long post, all comments and suggestion very welcome, thanks! Keith. [/QUOTE]
Insert quotes…
Verification
Post reply
Forums
MediaPortal 1
Support
General Support
Playback Problems
Contact us
RSS
Top
Bottom
