|
 Badware Behavior |
|
| Encourages installation of software without explaining its nature or functionality (Deceptive installation) |
|
| Installs Trojan horse application (Deceptive installation) |
|
| Difficult or impossible to uninstall (Unacceptable uninstallation) |
|
| Bad or Undisclosed Behavior |
| Encourages installation of software without explaining its nature or functionality |
When a user visits a site that has DollarRevenue (such as http://thekeys.ws), a large pop-up window appears, obscuring the user's view of the website beneath. This pop-up lists three steps that the user must take in order to close the pop-up ad: "Step01 - Click on the 'information bar'"; "Step02 - Click on 'install ActiveX Control'"; "Step03 - Click on the 'install' button." At no point does the dialogue box indicate what will occur if the user follows these steps, although a savvy user might infer that some sort of installation will take place. However, what exactly will be installed is never disclosed.
The true nature of this installation is further obscured by the yellow shield icons that appear in the dialogue box, and which are identical to the yellow shield symbol that Internet Explorer uses in a number of its dialogue boxes and security warnings. Users might be led to believe that this pop-up is generated by Internet Explorer, and might be more likely to follow the official-looking steps, thinking they are necessary in order to see the web page beneath.
|
| Installs Trojan horse application |
|
After installing DollarRevenue, we detected a Trojan horse application on our system named drsmartloader.exe. Trojan horses are applications that can secretly install additional programs on a user's computer without telling the user. This Trojan connects to other computers in the background without notifying the user. According to other anti-badware groups, DollarRevenue installs various adware components, including SurfSideKick, Webhancer, NewDotNet, and Command Service. Installation of this Trojan horse is not disclosed to the user during installation of DollarRevenue, nor is the installation of the later software that the Trojan horse downloads.
| | Difficult or impossible to uninstall |
|
The DollarRevenue application that we tested failed to provide any uninstallation tools to the user in order to guide removal. The plugin is also not listed in Add/Remove programs. As such, it would be very difficult or impossible for the average user to remove this application.
|
| Recommendations |
| We recommend that the producers of the DollarRevenue do the following: |
- Do not install additional applications without seeking the user's informed consent.
- Do not install adware without informing the user and seeking their consent.
- Do not install Trojan horse applications.
- Clearly disclose any and all changes made to previously installed software on the user's computer and give the user an option to accept or decline these changes.
- Clearly disclose any system configuration changes made and provide the reasons for such behavior.
- Clearly disclose any and all components that run on startup.
- Disable and discard any components that result in retardation of system performance and interfere with computer use, such as excessive pop-up advertisements.
- Provide the user with simple, effective uninstallation of the software, including bundled apps.
- Disclose to the user during installation that links that will be added to the Windows Desktop.
|
|
We currently recommend that users do not install the version of Starware News Toolbar that we tested,
unless the user is comfortable with the level of risk we identify or until the application
is updated consistent with the recommendations in this report.
|
|
|
|
