Beware of Apple crapware

NathanE

NathanE

NathanE

Soldato
Joined
21 Oct 2002
Posts
18,022
Location
London & Singapore
A few weeks ago I uninstalled some crappy "Apple Bonjour" service from my PC. Job done I thought.

Or not...

I rebooted today after installing some routine Windows Updates.

Upon getting back into Windows I knew something was not right. It took AGES to get to the desktop. Then a bubble in the Systray appeared saying some COM Event service couldn't start. Then I noticed I had ZERO network access at all. Even going into the Networking control panels resulted in lots and lots of errors like "Service dependency not started". The DHCP Client service was stuck on the "Starting" state in Services.msc. Not a good sign.

I suspected it was related to the Bonjour service from the start. Because I knew that that piece of crap installs a LSP (layered service provider) into the Winsock API. These LSPs tend to be very fragile little things.

Anyway, no matter I thought. A simple case of doing a "netsh winsock reset" command from an elevated command prompt.

Not so. I tried this numerous times. Whilst I could see using Sysinternals ProcMon that it was doing what it deemed a full reset of my networking stack. It was not really a "full" reset.

Even the Netsh tool was giving errors. Some "wshhttp.sys" couldn't initialize and an 11003 error code.

Somewhere else on Google mentioned doing a "netsh ip reset" but that didn't have any affect either.

I was beginning to run out of ideas. But I fired up RegEdit (for about the 20th time) and took a look at the HKLM\System\Services\Winsock2 set of keys.

I noticed that there were a set of keys for 32-bit WoW and the native 64-bit keys as well. But, after a while I noticed there was a irregularity between these two. On the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 are two keys called "Num_Catalog_Entries" and "Num_Catalog_Entries64". The former was set to 6 and the latter was on 7. Strange. Given that the sub-keys underneath these there were only 6 in each, both 32 and 64-bit.

So I took a punt and set the Num_Catalog_Entries64 key to 6.

Rebooted, and it was all fixed.

So it would appear that Apple Bonjour installed a 64-bit driver but then the uninstaller was a 32-bit application and therefore didn't decrement this special counter in the registry like it should have done.

Poor show, Apple. Poor show.

I'm going to alter my Registry security privileges to prevent anything modifying this clearly very sensitive area. Because generally any software that relies upon inserting an LSP driver into your Winsock stack is software you don't want to install anyway.
 
Nice troubleshooting. Bonjour and the Apple Software Updater are two things I regularly get rid of because I'd just rather they were not there - I don't need Bonjour and I update my software manually when I'm ready.

To be fair though, they always uninstalled without a problem in my experience.
 
bledd. said:
Yup,

This is why I refuse to get in iPod. Apple can't write software for Windows
Click to expand...

I was using SharePod anyway.

But, as part of the debugging this afternoon of this issue, I can confirm that iTunes, Quicktime, "Bonjour" and "Apple Software Update Service" are not installed on my PC anymore.

icon14.gif
 
lol you might think apple is trying to sabotage microsoft people by making it look like its a MS Windows fault :D

far fetched I know. I read too much Dan Brown :D
 
Shoddy stuff from Apple. That's why I don't use iTunes anymore and when I did I tried to not install Bonjour and other stuff.

I just use Media Monkey for my iPod now. I don't even have Quicktime installed!
 
Funnily enough I uninstalled bonjour yesterday, no problems yet. Nice catch though, you obviously know your stuff.

EDIT: just had a peek at the reg...

Num_Catalog_Entries = 8

Num_Catalog_Entries64 = 7
 
Last edited:
if i want to use apple software, i bung it in a VM. there's no way i'd let that crap loose on my main system. i've had this policy for a couple of years now. :p
 
marc2003 said:
if i want to use apple software, i bung it in a VM. there's no way i'd let that crap loose on my main system. i've had this policy for a couple of years now. :p
Click to expand...

Pretty sure even Hyper-V struggles to virtualise USB devices such as an iPod though? Maybe wrong... I know that Virtual PC 2007 certainly can't!
 
Carter said:
Funnily enough I uninstalled bonjour yesterday, no problems yet. Nice catch though, you obviously know your stuff.

EDIT: just had a peek at the reg...

Num_Catalog_Entries = 8

Num_Catalog_Entries64 = 7
Click to expand...

How many sub-keys do you have though? I had 6 for each, 32 and 64-bit.

But the Num_Catalog_Entries64 was set one higher at 7 which was clearly wrong.

It could be that you really do have 8 32-bit drivers installed and only 7 64-bit drivers.

Here's an illustration:

EG6uD.png
 
NathanE said:
Pretty sure even Hyper-V struggles to virtualise USB devices such as an iPod though? Maybe wrong... I know that Virtual PC 2007 certainly can't!
Click to expand...

i use vmware. no problems using any usb device so far. my mp3 players (MTP and MSC devices), bluetooth adapter, external drive, usb keys all work perfectly.

(plus i couldn't use microsoft products even if i wanted to. my cpu isn't up to it - no hardware VT.)

btw, i don't even have an ipod. i just use itunes occasionally for the odd exclusive release you can't buy anywhere else. if only they'd run their store through a browser. they should do now that DRM isn't an issue (well for the music anyway).
 
I'm not going to say it's great, but I wouldn't go so far as to run it in it's own VM or anything like that. In my experience it's not that bad.

I've run Windows iTunes for years and I'd be lying if I said I'd had lots of problems with it - no more or less than the next program. I've just noticed over time they have added lots of different packages that I'd rather not have running.
 
While annoying, it does appear to be an isolated incident this time round - I've removed Bonjour via the normal way on both Vista and 7 x64 and x86 editions without any issues multiple times.
 
mrk said:
While annoying, it does appear to be an isolated incident this time round - I've removed Bonjour via the normal way on both Vista and 7 x64 and x86 editions without any issues multiple times.
Click to expand...

I found loads of discussion on Google about the removal of Bonjour. People have even written scripts to do it.

Problem is that nobody had a solution to fixing the Winsock registry corruption that it leaves behind.

Admittedly, I was running a very old version (from 2007). And the majority of discussion threads on Google are from the 07/08 timeframe. I suspect they've fixed it by now.
 
I think it's disgusting how apple encourage people to install all this extra crap with iTunes, it really should be looked into by the EU.
 
Concorde Rules said:
In all fairness Windows apps for mac are hopeless too!

But I agree, apples windows software leaves much to be desired!
Click to expand...

I've used Messenger for Mac and that was pretty nice, and I've heard that Office for Mac is pretty sweet too. Even Steam worked alright with crossover! I haven't tried any other ported apps though.

As for iTunes and QT I will try and avoid it and only use it if strictly necessary as I don't like the other gubbins it likes to install. QT is rather useful as an MP4 tool though, and I used iTunes for the exclusive Mock The Week outtakes podcast by Frankie Boyle. As suggested though I'll probably run them in a VM from now on though as I reinstalled my PC, and I have Win 7 Pro which has the XP VM :)
 
Looks like your diagnosis was spot-on. I have 6 32-bit drivers and 7 64-bit ones. One of the 64-bit ones is this:

bonjour.png


Generally I don't mind iTunes, but this kind of interference with my system does annoy me.
 
You must log in or register to reply here.
Back
Top Bottom