|
 Badware Behavior |
|
| Installs Trojan horse application (Deceptive installation) |
|
| Installs adware (Deceptive installation) |
|
| Adds toolbar to Internet Explorer (Modifies other software without disclosure) |
|
| Redirects invalid web addresses (Interferes with computer use without disclosure) |
|
| Adds new link to the Windows Desktop (Modifies other software without disclosure) |
|
| Difficult to uninstall (Unacceptable uninstallation) |
|
| Bad or Undisclosed Behavior |
| Installs Trojan horse application |
|
After installing Puzzle Desktop, we detected a Trojan horse application on our system named Downloader.Agent.
Trojan horses are applications that can secretly install additional programs on a user's computer without telling
the user. In our tests, we found that Puzzle Desktop attempted to silently install a link on the user's desktop
after the initial installation process, and we speculate that Downloader.Agent's Trojan horse capabilities may have
been the means for accomplishing this. Installation of this Trojan horse is not disclosed to the user at any point.
However, any amount of disclosure would not justify the installation of such a component due to its inherently
deceptive nature.
|
| Installs adware |
|
Puzzle Desktop also comes bundled with Begin2Search, a component that is reported to be adware. Begin2Search reportedly monitors search queries and displays related pop-up ads. It also installs a Browser Helper Object (BHO) on Internet Explorer. Although we did not see pop-up advertisements during our tests, the Begin2Search BHO did redirect invalid web addresses and invalid domain names to pseudo error pages. These pages give users links to sponsored "Online Entertainment," "Pharmacy," "Online Resources," and "General" websites. Some of the search results contain terms that link to even more sponsored advertisements. The download page for Puzzle Desktop does not disclose to the user that Begin2Search will be installed, much less that it demonstrates these adware behaviors.
|
| Adds toolbar to Internet Explorer |
|
Puzzle Desktop installs a toolbar named Mirar Toolbar to Internet Explorer. The installation of the toolbar is not disclosed to the user.
|
| Redirects invalid web addresses |
|
Begin2Search, which is bundled with Puzzle Desktop, installs a Browser Helper Object (BHO) that redirects invalid web addresses and invalid domain names. An example of the former would be http://www.cnn.com/a_nonexistent_page, which the BHO would redirect to to http://453searches.com/404/?err=404 in place of the default 404 page. The latter would include http://www.this_site_should_not_exist.net, which the BHO would redirect to http://64.40.105.91/dns/?err=dns in place of the default DNS error page. Both of these psuedo error pages contain similar content, namely, sponsored links to "Online Entertainment," "Pharmacy," "Online Resources," and "General" websites. Puzzle Desktop fails to disclose the installation of this BHO and the behaviors it demonstrates to the user at any time prior to or during the installation of Puzzle Desktop.
|
| Adds new link to Windows Desktop |
|
Puzzle Desktop and its bundled components add a new link to the Windows Desktop: "Rate My Body ;)". This link opens up a sponsored advertisement for AdultFriendFinder.com, "The World's Largest Sex Personals Site." This link appeared approximately five minutes after we completed our installation of Puzzle Desktop and was not consented to by us either at that time or during the installation process.
|
| Difficult to uninstall |
|
Puzzle Desktop comes bundled with an uninstaller, and the application itself uninstalls without any problems. Begin2Search, meanwhile, is called "SearchEnhancer" in Add-Remove Programs. Although it, too, successfully uninstalls, neither uninstallation removes the "Rate My Body" link placed on the desktop. In addition, the average user would not know to correlate the behaviors displayed by Begin2Search (namely, the redirection of invalid web addresses) to the "SearchEnhancer" entry in Add/Remove Programs, especially since the installation of Begin2Search/SearchEnhancer was never disclosed to the user. This would make it difficult for the user to eliminate the Puzzle Desktop bundle entirely.
|
| Recommendations |
| We recommend that the producers of the Puzzle Desktop do the following: |
- Do not install adware without seeking the user's informed consent.
- Do not install Trojan horse applications.
- Clearly disclose on a main installation screen that invalid web addresses and DNS Error Pages will be redirected.
- Do not put links on Windows Desktop without disclosure.
- Provide the user with uninstallation that removes all the components that were installed.
|
|
We currently recommend that users do not install the version of Puzzle Desktop that we tested,
unless the user is comfortable with the level of risk we identify or until the application
is updated consistent with the recommendations in this report.
|
|
|
|
