Freemake Software: Help With A Service

[y0himba]

Hello.  I am sure that a lot of folks have heard of Freemake's utilities, a video downloader and a video encoder/transcoder. If you are using the software, it installs a service without your permission or knowledge called "FreemakeUtilsService" which runs at system start and sits there in the background, occasionally transmitting data over the Internet, even when the software is not running.

The software is actually quite nice for encoding with a TON of features.

They state that it collects bug and crash data and then chooses the best time to send that data based on when their servers are least busy.  If there are no bugs or crashes, and even if the software has never been run, it still transmits something. (I installed it on my laptop but have not used it yet) The service can be deleted and the software continues to run. The next time you upgrade (and upgrades are frequent), the service is re-installed, set to automatically run, without the user's permission or knowledge.

Can someone help me check this service out and see what exactly it is doing and transmitting? Someone with more knowledge than me.

http://www.freemake.com (Download the Video Encoder or Video Downloader)

[mouser]

They state that it collects bug and crash data and then chooses the best time to send that data based on when their servers are least busy.  If there are no bugs or crashes, and even if the software has never been run, it still transmits something.

There may be reasons they say it needs to do this.. This may be a great service for all I know.  But something sounds fishy to me.

Regardless, I would never ever use software that did this.  My advice: uninstall and find alternative software.

[worstje]

I agree with mouser.

Besides, think about it: how can that service know when those servers are least busy? Right, by connecting to them. But once you start connecting, you might as well send that crash data already, since unless we are talking Windows or SAP-like monstrosities, those reports can't be more than say, 1mb.

Doing that stuff when you start the program is more than good enough in my opinion.

[y0himba]

They are removing Facebook posts that ask about the service's activity and purpose.  Something is fishy here.  Again, if it looks too good to be true...

[cmpm]

Use this to remove the add-ons if you installed them.

http://toolbarcleaner.com/

Then stop and disable the FreeMake service.
via services.msc

[y0himba]

No toolbars or addons, just this service, thanks though. I alredy disabled it on my desktop, but left it running on the laptop to see if it would transmit even though I never ran the program. It does.

I have no idea how to debug it, see what it is sending and where, so forth.  A lot of people use and love this "freeware" which is why it concerns me that they may be collecting more than bug or crash data.

[worstje]

I just looked on their website, and was a bit concerned to see the bottom:

© 2010-2011 Ellora Assets Corporation. Privacy policy Terms of use.

That's exactly what the footer has on it. Or, in case the obviousness is lost in the quote: there are no actual links. I didn't see any such pages by browsing to other pages either.

More concerning even is their Wikipedia page, which has a section about a licensing controversy:

FFmpeg has added Freemake Video Converter to its Hall of Shame. An issue tracker entry for this product, opened on 16 December 2010, says it is in violation of GNU General Public License as it is distributing components of FFmpeg project without including due credit. Ellora Assets Corporation has not responded yet.

In other words, you are dealing with a company that (despite all of the 'social media buttons' on its front page) lacks the capacity to communicate and/or doesn't give a crap about licenses. It is probably a single individual running this entire site, but even if that isn't the case they operate under the guise of a company. As such they should be held to the standards of one. Throw in the fact that you say they censor the social media stuff about that service, and little remains to trust them with.

[y0himba]

So how would I go about debugging the service to see what it is doing/transmitting and where?  If I am wrong, I will eat crow and apologize up and down.  However, their actions are suspicious and I want proof.

[worstje]

Install Wireshark and use that to zone in on the service. You'll probably need an Administrator account. Tutorials are all over the net I believe.

[y0himba]

Will do.  Any Sysinternals tools that would be of use?

[Shades]

Wireshark is a (free/open source) tool to see content of anything that travels through your LAN. Find out to which IP number the service is sending the data and filter the output of Wireshark to only show the traffic to that particular IP number.

Working with Wireshark is not that easy but there is a helpful manual included, so it is not too hard either.

Finding out to which IP number data is sent, is not that hard either. I believe that Process Explorer (Sysinternals/Microsoft) or Process Hacker (open source) show you this when selecting the service.

If you don't like the data that is sent but still want to use the software after you found out, it should be easy enough to identify the files that are used by the service by using either Process Explorer, Process Hacker or Dependency Walker. After identifying create path rules for each file with 'Start > Run... > secpol.msc > Software Restriction Policies > Additional Rules > New Path Rule'. That should make the service unable to start even after you updated the software (if they don't change file names / or structure).

Seems others were already faster with typing...

[y0himba]

Finding the files was easy enough. I already use Process Hacker as my task manager of choice. I think I can use Wireshark to actually see inside the packets, or reconstruct them to see what is being sent, I don't really know.  I am reading about it now and reading the manual.

I already had WinPcap installed from using some program I picked up somewhere:  URLSnooper2.  You may have heard of it.

[y0himba]

From Facebook:

Hi everybody,

as promised yersterday we released an update with the fix of all found issues related to FreemakeUtilsService.

1. Now FreemakeUtilService which aroused so much concern is installed only upon user's permission who wants to help improve Freemake. The bug with the running service was fixed.
2. The service is uninstalled if software is uninstalled, no files are left. This was fixed too.
3. If the service was installed with the previous software version, a user can opt out in the new version. In this case the service will be automatically removed from PC.

Here to avoid confusion brought by some people we'd like to stress once again that the service didn't send before and doesn't send now any data if a user opted out.

The only function of the aforementioned service is to collect our software usage stats which will allow us to improve Freemake further, to your benefit. In case of a crash report a user is asked an additional permission to send a report through dedicated message window.

If permitted, the service runs when a user is online to synchronyze with our server for best time to send crash reports and usage stats. This is done to avoid our server time overload.

A user is given full information about the service via a link to a webpage during software installation.

-Facebook

My reply:

A "bug" for how many versions? Why wasn't this "bug" addressed when it was first reported around a month ago?

Good to see you admitting it was collecting statistics other than crash and bug data.

To be clear, the service DID send data even after opting out. It even sent data if the software was never run, and after the software was uninstalled.

You cannot say you fixed a "bug" and then say there was no issue.

Honesty folks, honesty.

[Stoic Joker]

So how would I go about debugging the service to see what it is doing/transmitting and where?  If I am wrong, I will eat crow and apologize up and down.  However, their actions are suspicious and I want proof.

-y0himba (July 24, 2011, 12:45 PM)

Quick-N-Dirty:

1. Open a command prompt and keep it handy.

2. Stop and then restart the service (this assumes it will try some type of connection on start up).

3. At command prompt run:
    netstat -bnep TCP
and if it doesn't showup there (it should), try
    netstat -bnep UDP

You should get a listing showing the name of the binary (service you're looking for), its target IP, and port.

Then use that info to filter what WireShark captures to better track what the little bugger is doing.

[y0himba]

Thank you!  That is helpful...seriously appreciated.

[kyrathaba]

You cannot say you fixed a "bug" and then say there was no issue.

Honesty folks, honesty.

+1.

The quote from the developer was fraught with double-speak.  Your rebuttal was spot-on, y0himba!

[y0himba]

Notice there was no reply to that...