EA Games Rootkit - Pando Media Booter

Page 2 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

FuryofFive

Golden Member
Sep 7, 2005
1,544
9
71
Pando media booster pumped up my comcast bandwidth to over 400gb for the month...forgot it on my main rig.. LOTRO installs it, i believe league of legends also installs it...

i might be late, but this type of practice is BS...they should be notifying people that the software stays active when not running it.it sux up a ton of bandwidth without the user even knowning. Not until the person checks their bills. I dont believe it eats up alot when the person is using it, i didnt feel any slowdown
 

darkewaffle

Diamond Member
Oct 7, 2005
8,152
1
81
I played LoL for a while and I have quite a few friends that still play it heavily, but I've never heard from any of them about their upload being saturated by it.
 

AyashiKaibutsu

Diamond Member
Jan 24, 2004
9,306
4
81
I played LoL for a while and I have quite a few friends that still play it heavily, but I've never heard from any of them about their upload being saturated by it.

I was having issues with it without knowing. I just thought my connection was being shitty.
 

imaheadcase

Diamond Member
May 9, 2005
3,850
7
76
That is not true at all, i've had it installed for a long time. It uses ZERO bandwidth. I was out of town for 2 weeks from home, and used only bandwidth from other apps that i normally do when not at computer (utorrent, some scheduled usenet downloads, windows update).
 

FuryofFive

Golden Member
Sep 7, 2005
1,544
9
71
People - moral of the story is - YOU CAN UNINSTALL IT AFTER YOU INSTALL YOUR GAME. It's not the end of the world.
we could...
way to blame us for not knowing it would be like that. Most of us didnt even know it would continue sucking bandwidth after the fact. Do you uninstall every program after your done with it?
 

SunnyD

Belgian Waffler
Jan 2, 2001
32,675
146
106
www.neftastic.com
we could...
way to blame us for not knowing it would be like that. Most of us didnt even know it would continue sucking bandwidth after the fact. Do you uninstall every program after your done with it?

Only the ones I spot as "Why the hell did this get installed" and researched for 5 minutes on google to find out what it is and whether or not I need it. Other than that, I'm usually never "done" with a program.
 

FuryofFive

Golden Member
Sep 7, 2005
1,544
9
71
Only the ones I spot as "Why the hell did this get installed" and researched for 5 minutes on google to find out what it is and whether or not I need it. Other than that, I'm usually never "done" with a program.

first, i didnt know it got installed.
2nd there are possibly 10's to 100's of processes that run, to narrow it down to just one could take a little while. plus if i didnt know where to start, that would probaly not be fun.
3. when bandwidth is disappearing out of nowehere, also there is nowhere to start.
so sure i could google "where is my bandwidth going" but with no basis or evidence pointing towards anything, what good would that do?

like i mentioned before, how were we all supposed to know that PMB would contine to run even after closing the apps that were installed from it. Not me :)
 

Dankk

Diamond Member
Jul 7, 2008
5,558
25
91
first, i didnt know it got installed.
2nd there are possibly 10's to 100's of processes that run, to narrow it down to just one could take a little while. plus if i didnt know where to start, that would probaly not be fun.
3. when bandwidth is disappearing out of nowehere, also there is nowhere to start.
so sure i could google "where is my bandwidth going" but with no basis or evidence pointing towards anything, what good would that do?

like i mentioned before, how were we all supposed to know that PMB would contine to run even after closing the apps that were installed from it. Not me :)

You should be checking your Startup list every now and again to look at the programs that are automatically starting every time you boot up your computer. You may be one of those people who have way too much shady and unnecessary shit slowing your computer down as a result. If you have more than 10 things in there, then it's too much. Also, if you have "hundreds" of processes running, that seems to be way too much as well.
 

FuryofFive

Golden Member
Sep 7, 2005
1,544
9
71
You should be checking your Startup list every now and again to look at the programs that are automatically starting every time you boot up your computer. You may be one of those people who have way too much shady and unnecessary shit slowing your computer down as a result. If you have more than 10 things in there, then it's too much. Also, if you have "hundreds" of processes running, that seems to be way too much as well.
its not like PMB jumped out and said "hey were eating up bandwidth" it doesnt slow down the computer. and i dont have alot of processes,i was using that as an example :). this blame the user shit is stupid. Ive used other p2p downloads and did not get the same crap. Not one did this. Plus when installing the software, i didn't read the part where its on at all times.
 

palindrome

Senior member
Jan 11, 2006
942
1
81
You should be checking your Startup list every now and again to look at the programs that are automatically starting every time you boot up your computer. You may be one of those people who have way too much shady and unnecessary shit slowing your computer down as a result. If you have more than 10 things in there, then it's too much. Also, if you have "hundreds" of processes running, that seems to be way too much as well.

Yes, shame on everyone for trusting in big name publishers like EA, Turbine (Warner Bros.), etc. to not install random crap that runs in the background that eats our bandwidth. Shame on us.

Just to show how legitimate LOTRO is with their TOS, here is what it reads:

From: http://www.turbine.com/news/56
Not Found

The requested URL /index.php was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.


People in the NFS:W forums are saying that Pando Media Booster has a class action lawsuit being brought against them. I don't see how anyone can say that this software was not designed with deceit in mind.
 

Jeffg010

Diamond Member
Feb 22, 2008
3,435
1
0
I never had PMB installed but if it is not listed in your system tray and only runs as a background process then that is some shady shit. No one in there right mind should be defending anything like this. There are some pretty dumb people in this thread defending this.
 

palindrome

Senior member
Jan 11, 2006
942
1
81
People - moral of the story is - YOU CAN UNINSTALL IT AFTER YOU INSTALL YOUR GAME. It's not the end of the world.

No, its not the end of the world. But, it is more expensive for people with data usage caps (like me!). Yes, let this be a lesson learned for everyone to double check what's running in the background after installing software. However, that still doesn't change the fact that Pando Media Boosters installs the way it does in order to prevent detection by the end user. Unfortunately, we all cannot be perfect like you and be proactive about it prior to seeing the effects.
 

palindrome

Senior member
Jan 11, 2006
942
1
81
I never had PMB installed but if it is not listed in your system tray and only runs as a background process then that is some shady shit. No one in there right mind should be defending anything like this. There are some pretty dumb people in this thread defending this.

^QFT

I really don't understand why people keep defending this. Its not like EA is mailing out free copies of BF3 for random people who defend them for being shady...
 
May 13, 2009
12,333
612
126
Thanks for the heads up. I have a 150gb limit and a 3mb speed dsl Internet connection. I barely have enough speed to stream Netflix without it loading or freezing up on me. So yes a program such as this could really screw me up. I can't believe anyone is stupid enough to defend a practice like this. If they need more servers to distribute their game then that's not on me, it's on them.
 

darkewaffle

Diamond Member
Oct 7, 2005
8,152
1
81
I never had PMB installed but if it is not listed in your system tray and only runs as a background process then that is some shady shit. No one in there right mind should be defending anything like this. There are some pretty dumb people in this thread defending this.

It adds an icon to your control panel enabling you to configure it. Hardly hidden. Not to mention the agreement during the installation you would have had to make in order for it to be installed. Whether you read it or not is a different matter entirely.

There are a myriad of programs and services that work entirely in the background, largely because the user is less likely to screw them up that way and it reduces clutter.

Frankly I'd be more inclined to attributed the alleged bandwidth usage to something else on a user's computer, but it is possible that it was Pando; perhaps it behaves more actively depending on your location or how many other seeders a given game has. I know I never experienced any problems associated with it when I was playing LoL at least, and while my friends have had connection problems, far as I know it's never been Pando.

And again, this is not an EA product. In any way, shape or form. It is an independent service that a company can employ to help distribute their game.
 

Chiropteran

Diamond Member
Nov 14, 2003
9,811
110
106
If EA distributes it, it is an "EA product". Same for Riot games, or anyone else. A company distributing malware doesn't need to personally write it to be held responsible.

Does it add a control to control panel? That is nice. How often do you check control panel to see if random programs have added applets without your knowledge? Most people never do.

Startup folder? It doesn't show up there. Unless you go into the registry, you won't see it. Most casual computer users don't touch the registry, ever.

Add/remove programs? I'm glad it's in there, but unless you already know what you are looking for and know when it got installed it's pretty hard to find.

Oh, it tells you it's being installed as a part of the EULA click-through crap. Again, it's nice of them to cover their bases legal liability-wise, but nobody reads those.

It's malware. EA, Riot, & others are distributing it. Why? Bandwidth costs? From amazon, just as one example, with enough volume 10GB of bandwidth is $0.50 Compared to all the costs of conventional retail distribution, packaging, media, shipping, store space- bandwidth might as well be free. It's simply idiotic greed leading these companies to use pando or similar technology.
 

AyashiKaibutsu

Diamond Member
Jan 24, 2004
9,306
4
81
A control panel icon is not a valid place to keep a program that's actively eating your bandwidth. If the program is running it needs a task or tool bar icon. Designing the thing as a backround service and most installs only informing you through fine print and in the control panel is not acceptable.
 

zokudu

Diamond Member
Nov 11, 2009
4,364
1
81
its not like PMB jumped out and said "hey were eating up bandwidth" it doesnt slow down the computer. and i dont have alot of processes,i was using that as an example :). this blame the user shit is stupid. Ive used other p2p downloads and did not get the same crap. Not one did this. Plus when installing the software, i didn't read the part where its on at all times.

Its in the Terms of Service linked above. Do you people not read this stuff? Also windows offers you a program to monitor resource usage so yes it can come out and say "I'm using alot of bandwidth":
QIJGl.png


Also not that it matters but NFS:World foes not even use Pando Media Booster. I went to double check the EULA to show that you did indeed agree to allow p2p usage when you installed the software.

NFS: World uses a similar program called Akamai NewSession same thing different company. SO if your obscene usage stats were from a Pando Media Booster process then its not even an EA game causing the issue. Oh you also agreed to the usage of Akamai NetSession in the EULA for NFS:World:
d7q6Z.png
 

DaveSimmons

Elite Member
Aug 12, 2001
40,730
670
126
This certainly is NOT a "rootkit" but continuously using high bandwidth on some PCs is not acceptable behavior.

The fact that you can uninstall it is nice, but it shouldn't be acting this way in the first place.
 

rivan

Diamond Member
Jul 8, 2003
9,677
3
81
No, its not the end of the world. But, it is more expensive for people with data usage caps (like me!). Yes, let this be a lesson learned for everyone to double check what's running in the background after installing software. However, that still doesn't change the fact that Pando Media Boosters installs the way it does in order to prevent detection by the end user. Unfortunately, we all cannot be perfect like you and be proactive about it prior to seeing the effects.

I think you should blow your cap away, then bill EA or whatever for the cost.
 

palindrome

Senior member
Jan 11, 2006
942
1
81
Its in the Terms of Service linked above. Do you people not read this stuff? Also windows offers you a program to monitor resource usage so yes it can come out and say "I'm using alot of bandwidth":

Also not that it matters but NFS:World foes not even use Pando Media Booster. I went to double check the EULA to show that you did indeed agree to allow p2p usage when you installed the software.

NFS: World uses a similar program called Akamai NewSession same thing different company. SO if your obscene usage stats were from a Pando Media Booster process then its not even an EA game causing the issue. Oh you also agreed to the usage of Akamai NetSession in the EULA for NFS:World:

Akamai is what NFS:W used to use. New installations of NFS:W use Pando Media Booster as of October. This has already been confirmed. I honestly cannot tell if you are trolling or just being a jerk.
 
Oct 25, 2006
11,036
11
91
No, its not the end of the world. But, it is more expensive for people with data usage caps (like me!). Yes, let this be a lesson learned for everyone to double check what's running in the background after installing software. However, that still doesn't change the fact that Pando Media Boosters installs the way it does in order to prevent detection by the end user. Unfortunately, we all cannot be perfect like you and be proactive about it prior to seeing the effects.

Read the TOS before complaining. Once you click I agree, you forfeit all rights to complain. The TOS clearly states what you are installing ( pando media booster), what it is expected to do ( act as a bittorrent like service), etc.
 

RavenSEAL

Diamond Member
Jan 4, 2010
8,661
3
0
I think you are completely missing the point of this. Pando was indiscriminately utilizing 100% of my upload bandwidth at all times. Other than psychically knowing that PMB.exe was utilizing all of my available bandwidth. So it did, in fact alter my OS's functionality and affected every application that needed internet (Netflix, browsing the web, games, etc). Yes, this rootkit was probably mentioned in the EULA somewhere. I can honestly say I didn't ready. Typically, garbage like this has a separate TOS/EULA with little check boxes that are pre-check and you can opt out by deselecting the boxes. I'm sure that 99% of people who install software never read the EULA. However, I, like most other people, have realistic expectations of what software is supposed to do for you and what it will do to your computer as a result. Nowhere in the agreement you posted above does it warn you Pando will utilize your entire bandwidth, crippling your ability to even use the internet.

Call me a noob or whatever you like. I'm just trying to help people to become aware of this potentially running in the background.

Also, I wasn't trying to be deceitful with the quote.
rootkit.png


You agreed to it, sucks to be you. A judge would laugh in your face if you even thought about bringing this to court.