Skip to content

Windows Media Player phones home

by Fred de Vries and Andavari

Windows Media Player 10 and 11 both have developed a nasty tendency to behave like spyware: they report back to their master and do so to a multitude of sites. They automatically retrieve content even if you don't explicitly click Online Stores and/or Guide, simply launching WMP will result into WMP retrieving content.

What is this spyware-like activity?

The spyware-like activity is the automatic downloading of content when you launch Windows Media Player (aka WMP) with an active Internet connection. The content (images, cookies, javascript, etc.,) will end up in Internet Explorer's Temporary Internet Files.

This can easily be confirmed by first emptying Internet Explorer's Temporary Internet Files and Cookies, and then launching WMP.

To counter these problems you could simply try to block the offending sites by putting them in your Windows HOST file, and into Internet Explorer's Security-> Restricted Sites, and Privacy areas. But alas, the HOSTS-file method won't necessarily work because Microsoft has decided to implement a strategy to bypass the HOSTS file in certain instances for some microsoft.com URL's.

And you can't simply turn the update function in Windows Media Player (aka WMP) off because you only have the choice between updating every day or week or month.

The result is that you cannot prevent your WMP from contacting Microsoft's sites.

How to prevent WMP from phoning home

To prevent WMP from automatically contacting sites which WMP automatically retrieves content from you'll only have a few options:

  1. The best choice is to install a third-party two-way personal firewall such as Comodo, Kerio, ZoneAlarm, etc. In your personal firewall set it to Block/Disallow WMP access to your Internet connection by creating a permanent rule. Or at the very least and perhaps a better recommendation is to set your personal firewall to Ask every time WMP is launched so that permission must be first granted by you rather WMP is allowed to automatically retrieve online content or not.
  2. Compile a list of the sites which are loaded by looking into Internet Explorer's Temporary Internet Files and Cookies.
  3. Using the list you compiled in #2 block the cookies, scripts, etc., from offending sites in Internet Explorer.

Note: Don't block go.microsoft.com as doing so will break many links that Microsoft utilizes when visiting microsoft.com.

On the other hand: do you really care? It only checks for updates and bypassing the HOST-file is done for security reasons in order to prevent malware from wrecking Windows Update.

In the end it depends on your mindset: do you think that Microsoft spies on you or do you think Microsoft helps you to keep your system safe.