Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

C:\program Files\common Files\real\update_ob\realsched.exe -osboot


  • Please log in to reply
15 replies to this topic

#1 easydoesit

easydoesit

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:27 PM

Posted 25 April 2008 - 03:20 PM

C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot

This program keeps poping up in winpatrol dialog box trying to gain access to the startup page.
I keep denying it but every two minutes it pops up again. How do I stop this. What is this? Thanks!

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,405 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:27 PM

Posted 25 April 2008 - 03:39 PM

Do you have Real Player or Real-anything software installed?

The path you posted looks like an update mechanism to me.

Louis

#3 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:12:27 AM

Posted 25 April 2008 - 04:41 PM

"Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player, to remind AutoUpdate and Message Center to perform their tasks at pre-scheduled intervals. If it can't be disabled try deleting or renaming realsched.exe and then delete the entry in the registry": http://www.castlecops.com/s2978-Realsched.html

#4 easydoesit

easydoesit
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:27 PM

Posted 26 April 2008 - 06:36 PM

I had realone player and now uniblue registry booster. I deleted them and now I can't get rid of these. How do I
delete in the registry. I managed to delete realsched.exe through winpatrol but I can't get rid of these.

#5 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:27 PM

Posted 26 April 2008 - 06:58 PM

Hello.

We need to backup the registry before we continue.
Registry edits can be potentially dangerous; we can revert to the backup if needed.
Go to Start » Run » type: regedit » OK.
  • On the leftside, click to highlight My Computer at the top.
  • Go up to File » Export
    • Make sure in that window there is a tick next to "All" under Export Branch.
      Leave the "Save As Type" as "Registration Files".
      Under "Filename" put RegBackup.
  • Choose to save it to C:\
  • Click save and then go to File » Exit.
It's a good idea to keep backups dated and in a separate folder.

We can just the find feature to locate all entries pointing to that file
  • Click on your Start Menu, then Run.
  • Type regedit and hit OK.
  • Click Edit, then Find.
  • Copy in C:\Program Files\Common Files\Real\Update_OB\realsched.exe and hit Find Next.
  • Right click and select Delete for the entry found.
  • Hit F3 to find any other entries pointing to it and delete them.
With Regards,
The Panda

Edited by PropagandaPanda, 26 April 2008 - 06:58 PM.


#6 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:12:27 AM

Posted 26 April 2008 - 07:29 PM

If you have uninstalled Realplayer via add/remove then remove this folder: C:\Program Files\Real. And C:\Program Files\Common Files\Real. If you couldn't because the file was in use open the task manager (Ctrl+Alt+Del) , select realsched.exe under processes and press End Presses. Then remove the folders.

If you have Spybot Search & Destroy you can remove the startup item using the application.

#7 easydoesit

easydoesit
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:27 PM

Posted 27 April 2008 - 04:53 PM

I tried the registry edit but the popups won't stop. When I use c cleaner it also picks up the realsched and registry booster.

#8 PropagandaPanda

PropagandaPanda


  • Malware Response Team
  • 10,433 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:27 PM

Posted 27 April 2008 - 06:08 PM

Hello.

Your registry cleaners are finding entries for realsched.exe because it sees that the file is missing, but an entry is still pointing to it.

Are you sure you have uninstalled Real Player? Could you please take a screenshot of what the pop-up warning from WinPatrol looks like?

With Regards,
The Panda

reason for edit: grammar fix

Edited by PropagandaPanda, 27 April 2008 - 06:08 PM.


#9 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:12:27 AM

Posted 27 April 2008 - 06:22 PM

If you have uninstalled Realplayer via add/remove then remove this folder: C:\Program Files\Real. And C:\Program Files\Common Files\Real. If you couldn't because the file was in use open the task manager (Ctrl+Alt+Del) , select realsched.exe under processes and press End Presses. Then remove the folders.

If you have Spybot Search & Destroy you can remove the startup item using the application.


1. Kill the process.
2. Remove the folders.
3. Remove the startup item. It won't come back.

#10 easydoesit

easydoesit
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:05:27 PM

Posted 29 April 2008 - 01:09 PM

Just got the problem resolved, it was the tea timer and sd help in spybot that prevented me from deleting this. Miekiemoes showed me how to remove it on another post " popups for start page" Thanks for the help!

#11 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:12:27 AM

Posted 29 April 2008 - 01:16 PM

Glad it is sorted out and all the credits to Miekiemoes.

#12 patop

patop

  • Members
  • 65 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:San Francisco
  • Local time:05:27 PM

Posted 06 May 2008 - 10:50 PM

I've just encountered the same problem from Real. I have deleted everything I can find. There is no longer a Real folder in the program files or common files. I have killed it in WinPatrol and removed it. I have removed it from start up in both WinPatrol and Spybot. I can't find any traces of it anywhere, but surely it is still lurking somewhere, because the WinPatrol Alert tells me that it is still located in C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot, even though that folder does not exist on my computer.

I have a Dell XPS 400, running xp pro, with 3G of RAM, at 2.8 GHz. I'm sure I did something stupid to cause this. So I hope it is fixable!!! After it is fixed, I will install Real Alternative.

Thanks

#13 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:12:27 AM

Posted 07 May 2008 - 11:12 AM

Weired situation.

You may try this:

1. Turn off system restore: go to start-right click My Computer-select properties- under system restore tab- check turn off system restore on all drives. Click apply. By doing this you loose all your restore points.

2. Use the windows search advanced options:
  • Go to start ->search ->click all files and folders.
  • Click more advanced options.
  • Check search system folders, search hidden files and folders and search sub-folders.
  • Type realsched in the upper box and click on search. Remove if you found any instances of realsched.
3. Check the startup items with advanced options of Spybot. Delete (not just uncheck) the entry pointing to realsched.exe.

2. Reboot and don't forget to uncheck “turn off system restore on all drives" to create a clean restore point.

#14 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:27 PM

Posted 07 May 2008 - 07:01 PM

Hi,
This is a very awkward situation never heard of it

I would do what Farbar said:

2. Use the windows search advanced options:
Go to start ->search ->click all files and folders.
Click more advanced options.
Check search system folders, search hidden files and folders and search sub-folders.
Type realsched in the upper box and click on search. Remove if you found any instances of realsched.

3. Check the startup items with advanced options of Spybot. Delete (not just uncheck) the entry pointing to realsched.exe.

4. Reboot and don't forget to uncheck “turn off system restore on all drives" to create a clean restore point.
Also is Real still in your add/remove programs, if it is remove it.
Try removing it from the registry. I'm too lazy to tell you the steps so just read this tutorial, its staright forward so nothing you won't understand : http://www.bleepingcomputer.com/tutorials/manually-remove-programs-from-add-remove-programs/ Just realized our you could just look at The Panda's instruction. REMEBER TO BACK UP THE REGISTRY

Regards
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#15 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,696 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:12:27 AM

Posted 07 May 2008 - 07:51 PM

I didn't wanted to get you to the registry, but in case the above steps didn't work this is the solution, even if you install and use realplayer. It does not effect Realplayer's functioning :

How to disable realshed.exe:

1. Backup your registry:

Registry edits can be potentially dangerous; you can revert to the backup if needed.
Go to Start » Run » type: regedit » OK.
  • On the left side, click to highlight My Computer at the top.
  • Go up to File » Export
    • Make sure in that window there is a tick next to "All" under Export Branch.
      Leave the "Save As Type" as "Registration Files".
      Under "Filename" put RegBackup.
  • Choose to save it to C:\
  • Click save and then go to File » Exit.
2. If you use Realplayer disable the auto-update feature in your Tools- Preferences- Automatic Services- AutoUpdate (In RealPlayer).

3. Search through your registry for 2 locations of "realsched" (start >run > Type regedit in the run box and press Enter. Under File menu select Find, type realsched ): The first will be a "(Default)" key, modify the key and erase the path; the second will be in the 'HKLM- Software- Microsoft- Windows- Current Version- SharedDlls' folder. Modify this key to "0"

4. Go to "C:\Program Files\Common Files\Real\Update_OB\ and delete "realshed.exe"




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users