BBC iPlayer and KService.exe looked like a Worm
I noticed the activity light on my router at home going crazy last night. I initially thought it was Thunderbird checking all my Imap accounts but after 5 minutes it was still going.
I closed down all running software and it was still going full speed. My next thought was oh hell I have a worm. I pulled up a command prompt and entered netstat and saw 30-40 connections to my computer. I googled some of the port numbers to find out what it was and got no joy. I then downloaded netstatagent. This showed it was a program called Kservice.exe. I immediately killed this process off before trying to find out what was going on.
Apparently (if you google this) it is a P2P package used by Sky, BBC iPlayer and channel 4′s 4OD service. In my case it was the BBC iPlayer. What was confusing is that I shut the iPlayer software down after I have used it.
I have just looked at the menu (right click on iplayer icon in task bar) and click on settings. There is an option “Allow programs to be shared when you exit download manager” which is ticked by default. Disabling this does resolve this issue.
I find this default on action to be very underhanded. I know a couple of people who have PAYG style BroadBand connections. They are pensioners and have limited income. If they had used the BBC iPlay even once they would then have an ongoing usage problem that would escalate their bills.
Here are some links to other people who have more information on this.
http://mou.me.uk/2007/08/25/woops-kontiki-did-it-again-kserviceexe-and-the-bbc-iplayer/
http://mou.me.uk/2007/05/09/kserviceexe-channel-4-and-the-stolen-bandwith/
http://hintofsarcasm.com/2006/01/12/sky-by-broadband/
A more technical account
http://strix.org.uk/posts/The-BBC-iPlayer
Leave a Comment