The Spyware Warrior Guide to

Adware Installations of 2005

Example 1: Homer & Bart Desktop Theme
     
    The first adware installation to be examined is the "Homer & Bart Desktop Theme" package, which bundles six different adware programs, including three from the most prominent and widely recognized adware vendors in the business (180solutions, WhenU, Claria).

Return to Adware Installations of 2005 index page
    On this page... Summary of Key Findings...

180solutions
- no EULA or Privacy Policy presented during installation
- installer obscures functionality through euphemistic language
- uninstaller badgers user into refusing uninstall
- uninstaller misleadingly warns user that program is required
- uninstaller falsely suggests program does not display advertising

WhenU
- installer obscures functionality through euphemistic language
- installer uses outdated, erroneous privacy policy
- installer uses unmanageable scroll box to display EULA
- uninstaller attempts to persuade user into reinstalling advertising 
   program through "anti-spyware" program

Gator/GAIN/Claria
- installer obscures functionality through euphemistic language
- installer notice screen fails to disclose key privacy & data practices

ClearSearch
- installer fails to provide clear description of key functionality
- program hidden in randomly named directory
- no uninstaller provided

HyperLinker
- program not disclosed during installation
- program hidden in Windows directory

AT Partners
- program not disclosed during installation
- program hidden in Windows directory
- "Add/Remove Programs" entry cryptically named

Overview [return to top]
     
    The "Homer & Bart Desktop Theme" is a "free" desktop theme for Windows PCs available from aaathemes.com:

The download page bills this software package as a "free" theme, failing to indicate anywhere prominent that the software package installs advertising software that many users might find objectionable. When users click the download link, they are prompted to download a standard setup executable to their hard drives (homernbart.exe), which they must then run.
     
The Installation [return to top]
     
    When users run the setup executable they are greeted with a dialog box that discusses the "file transportation program" for the desktop theme, a seemingly technical subject that few users will care about.

Although this box does mention that the "transportation program" allows the vendor to "distribute advertising messages or vendor products," nothing in that vague description clearly indicates to users that they will be required advertising software on their PCs. For all users know, the "advertising messages" could be restricted to banner ads in further dialog boxes during the installation process itself, a practice which is not uncommon among all manner of software vendors. 
     
    Adware # 1: 180solutions  [return to top]
     
    Users are quickly presented with the first of several advertising software, or "adware," programs. The problem is that none of these "adware" programs is clearly and forthrightly described. The notice and disclosure screens offered during installation resort to sterilized euphemisms to describe functionality that many users will simply not recognize as something they would otherwise object to.

The 180search Assistant screen is the perfect example of that failure to use straightforward, unvarnished language to describe critical functionality and features. Notice that the description of the 180search Assistant is presented in an unusually small font, discouraging users from reading too carefully. Even those users who do bother to read the complete description will learn only that the 180search Assistant is a "permission-based search assistant application" that provides "comparative shopping opportunities" -- a program, in other words, that appears to be perfectly innocuous. Although there is some brief mention of data collection, that too appears rather innocuous.

Tellingly, this notice screen asks users to agree to the terms presented above without displaying the program's full End User License Agreement (EULA) or even offering to show it, perhaps by supplying a clickable link to an online version. In fact, the180search Assistant EULA available online is much more explicit about the advertising and data collection that users are unwittingly consenting to by clicking through this notice screen:

"180search Assistant" is a permission-based search assistant application that provides access to a wide range of websites, applications and information powered by 180solutions, Inc. ("180solutions"). This means that 180search Assistant will periodically direct you to our sponsors' websites. 180search Assistant will collect information about the websites you visit, but will not collect any information that will be used by 180solutions to identify you personally. The information that 180search Assistant collects and transmits to 180solutions will be used to provide you with access to comparative shopping opportunities at times when we consider them most relevant. 180search Assistant can be uninstalled at any time by going to the "Add/Remove Programs" menu on your computer and clicking the "Remove" button next to the entry or entries for 180search Assistant. [...]

5. Display of Advertising. The Software will collect information about you and the websites you visit ("Usage Data"), but will not collect information that will be used to identify you personally. This information will be used to provide you with comparative shopping opportunities when they are most relevant. By installing and/or using the Software you grant permission for 180solutions to periodically display sponsors' websites to you, and to collect, use and disclose the Usage Data The frequency of the advertisements will vary depending on your use of the Internet. You acknowledge that the Software includes an anonymous user ID and an electronic cookie that enables 180solutions to collect such information and to display advertising targeted to you. A "cookie" is a small amount of data that 180solutions' servers transfer to your browser and that only 180solutions' servers can read. You understand that 180solutions does not control your interaction with the websites and advertisements displayed to you and we assume no responsibility for their content or privacy practices and policies.

6. Updates. 180solutions, in its sole discretion, may provide you with released Updates to the Software as part of this Agreement. The Software will check with 180solutions for these Updates automatically, and in the event that an Update is available, the Update will be installed automatically by the Software. Nothing herein shall be construed or interpreted as requiring that 180solutions provide these updates. [...]

8. Collection of Information. 180solutions collects and uses certain information about you from your use of the Software. By installing the Software, you grant permission for 180solutions to collect this information, including the websites you visit while connected to the Internet. You acknowledge that you have reviewed 180solutions' 180search Assistant Privacy Policy, which describes 180solutions' practices with respect to the collection, use and disclosure of information in connection with the 180search Assistant Software. A copy of the 180search Assistant Privacy Policy is available at http://180searchassistant.com/privacy.html. 180solutions reserves the right to change the provisions of its 180search Assistant Privacy Policy from time to time. 180solutions will post any changes to the 180search Assistant Privacy Policy at the web address in the preceding sentence. Your use of the Software following the posting of such changes to the 180search Assistant Privacy Policy will constitute your acceptance of any such changes.

Beyond the advertising and data collection practices, this EULA discloses the fact that the program uses an auto-update mechanism to arbitrarily download updates to the program with no notice to users. This functionality is not even hinted at in the notice screen presented to users.

The online EULA itself points to the 180search Assistant Privacy Policy, which again is not immediately available to users installing the "Homer & Bart Desktop Theme." This Privacy Policy discloses still more details about advertising and data collection practices that many users might find objectionable:

By installing 180search Assistant, you grant permission for 180solutions to periodically display targeted websites, to collect certain information, including the websites you visit while connected to the Internet, and to use that information as described herein. 180solutions will not use any of the information 180search Assistant collects to identify you personally.

180search Assistant. The 180search Assistant software ("180search Assistant") is a permission based search assistant application that provides access to a wide range of websites, applications and information. 180search Assistant will periodically direct you to our sponsors' websites. The information that 180solutions collects under this privacy policy allows 180search Assistant to provide you with content and advertising that is targeted to your interests.

What We Collect. When the 180search Assistant software is actively running on your computer, it generates logs of your web browsing activity, including web pages you have visited and the order in which you visited these pages. These logs are then uploaded to 180solutions' servers, along with an anonymous user ID assigned to the 180search Assistant software installed on your computer (your "Anonymous User ID"). We use these logs for market research purposes and to allow 180search Assistant to provide you with content specifically targeted to your interests at the time when the content is relevant. 180solutions stores these logs on our servers, for our use. We may aggregate information from these logs and share the aggregate data with third parties. The 180search Assistant software will also put a "cookie" on your machine so that we are able to recognize you and display appropriate targeted websites. A Cookie is a small amount of data that 180solutions' servers transfer to your browser and that only 180solutions' servers can read.

The net effect of these sterilized descriptions and the failure to display the EULA and Privacy Policy is that many if not most users will blithely click the "I Accept" button with little idea of the true functionality of the software they have consented to.
     
    Adware # 2: ClearSearch  [return to top]
     
    The next notice screen for ClearSearch is almost the complete inverse of the 180search Assistant notice screen. This screen fails to offer even a bare bones description of the ClearSearch application, presenting only the program's EULA.

Without a basic description of the program itself and its key features, most users will be lost as to what to look for in the license, if they are even inclined to peruse that document, which is loaded with impenetrable legalese. Readers who do venture to read this 1500 word document will find a discussion of advertising functionality almost at the very end of the ClearSearch EULA:

By accepting to download the Clear Search Address Bar Search Software you are also accepting that Clear Search may also deliver to you relevant contextual advertising in the form of advertisements based on URLs and/or search terms you enter when navigating the Internet. The technology used to do this anonymously identifies the interests of computer users based on their computer usage, and the URLs associated with the Web pages viewed. Often, such ads and informational messages will be published to computer screens on behalf of those who are competitors of the Web pages users may be viewing, or may have recently viewed. We do not transmit or collect your browsing activity or personal information and do not store any information that records your browsing behavior. We do not build profiles of our users or attempt to correlate demographic or personal information.

But, of course, most users will never see this, nor will have any other inkling that this program could, too, contain potentially objectionable functionality.
     
    Adware # 3: WhenU  [return to top]
     
    The next adware notice screen is a kind of hybrid of the previous two. It presents a description of the WhenU SearchBar, though this description is as loaded with misleading euphemisms ("contextually relevant offers," "special offers and websites," et al) as the 180search Assistant description is.

Towards the bottom, in a scroll box that displays a miserly five lines of text, is a copy of the program's EULA and Privacy Policy. As with the 180search Assistant EULA and Privacy Policy, the WhenU EULA and Privacy Policy disclose quite a few more details about advertising and data collection practices that many users could find objectionable:

Functionality

The WhenUSeach Toolbar brings relevant information, search results, and offers to your desktop, or browser, at all times. The WhenUSearch Toolbar displays this information in the form of rotating text links accessible from within the application.

WhenUSearch Toolbar software selects which ads and offers to display to individual users based on several factors, including: URLs associated with web pages visited by the user, search terms typed by the user into search engines and into the WhenUSearch Toolbar, HTML content of the web pages viewed by the user and the local zip code of the user. WhenUSearch Toolbar ads and offers are delivered in a separate, independent window or application controlled by WhenU.com, are not endorsed or affiliated with anyone other than WhenU.com and may in fact be competitive with some of the sites visited by the user while online. To uninstall Search ToolBar, you must uninstall all WhenU- supported software. [...]

PRIVACY STATEMENT

By downloading the WhenUSearch Toolbar software, you give permission to WhenU.com to display relevant contextual information and offers. The WhenUSearch Toolbar software selects which ads and offers to display to individual users based on several factors, including: URLs associated with web pages visited by the user, search terms typed by the user into search engines and into the WhenUSearch Toolbar, HTML content of the web pages viewed by the user and the local zip code of the user. 

The software protects users' privacy by uploading a database of content in small chunks to individual desktops and then determining on the desktop whether or not to retrieve information from WhenU.com or third-party servers. To protect user privacy, the same database of content is sent to all desktops. Decisions regarding which ads to retrieve to an individual desktop are all processed on the user's desktop - and isolated from WhenU.com servers. User privacy is also protected in the following manner:

1) Personally identifiable information is NOT required in order to use the software and WhenU.com does NOT know the identity of individual users of the software
2) As the user surfs the Internet, URLS visited by the user (i.e. the user's "clickstream data") are NOT transmitted to WhenU.com or any third party server 
3) WhenU.com does NOT assemble personally-identifiable browsing profiles of users
4) WhenU.com does NOT assemble anonymous machine-identifiable browsing profiles of individual users
5) WhenU.com does NOT track which ads and offers are seen or clicked on by individual machines - analysis and tracking is done in the aggregate

Each individual desktop is assigned anonymous, unique machine IDs. These machine IDs are used ONLY to enable WhenU.com to count unique, active desktops in the network. The machine IDs are NOT used to determine which ads to serve individual users or to create browsing profiles of users. When ads are displayed by the software, impressions and clickthroughs are reported to WhenU.com servers. To protect user privacy and prevent WhenU.com or any third party from assembling user profiles, the unique machine IDs are NOT included in the impression and clickthrough reports sent by the desktop to WhenU.com servers. 

Few users will be willing to negotiate the difficulties of reading the entire EULA and Privacy in that narrow scroll box. Still fewer would ever think of comparing the Privacy Policy presented in this software bundle with the WhenU Privacy Policy for this application available online, which contains at least one critical difference (highlighted in red text) from the copy bundled with the desktop theme:

WhenUSearch Browser Toolbar Privacy Statement

By downloading the Desktop Toolbar ("the Toolbar"), you give permission to WhenU.com, Inc. ("WhenU") to display relevant contextual information and offers. The Toolbar selects which ads and offers to show you based on several factors, including: which webpages you visit, search terms you use while searching online, your local zip and/or country code, and content of the webpages you view. The Toolbar displays contextual ads and offers in the form of rotating text links accessible from within the application.

The Toolbar protects your privacy by uploading a database of content in small chunks to your desktop and then determining on your desktop whether to retrieve information from WhenU or third-party servers. To protect your privacy, the same database of content is sent to all desktops. Decisions regarding which advertising and offers to retrieve are processed on your computer desktop. In this way, WhenU is able to deliver to you relevant coupons, information and advertisements without establishing any profile about you (even anonymously) on WhenU servers.

Your privacy is also protected in the following manner:

1) Your personally-identifiable information is not required in order to use the Toolbar. WhenU does not know your individual identity and does not attempt to discern it in any way.
2) As you surf the Internet, your "clickstream data" (i.e. a log of all the sites you visit) is not transmitted to WhenU or any third party server. (Although impressions and click-throughs that contain indicia of browsing activity are transmitted each time an ad is served, as described below, these communications are never linked to personally identifiable information and are otherwise carefully designed to protect your privacy.)
3) WhenU does not assemble any personally-identifiable browsing profiles of you or your individual machine.
4) WhenU does not assemble any anonymous machine-identifiable browsing profile of you or your machine.
5) WhenU does not track which ads and offers you see as an individual user — all of our analysis and tracking of ads is done in the aggregate.

The Toolbar does send back certain information from your desktop in order to count the number of users in our network and optimize the performance and relevancy of the ads. For example, when an offer is displayed to you in the Toolbar and whenever you click on such an offer, the Toolbar sends WhenU a communication that may include information about the webpage you were viewing before you saw or clicked on a particular ad. WhenU has intentionally designed these communications back to WhenU to be highly protective of user privacy, in the following ways:

(a) Each individual desktop is assigned an anonymous, unique machine ID. This machine ID is used only to enable WhenU to count unique, active desktops in the network. The machine ID is not used to determine which ads to serve individual users or to create browsing profiles of users.

(b) When ads are requested and/or displayed by the Toolbar, impressions and click-throughs, including the factor (e.g., the URL, the keyword, or the search term, or some combination thereof) that caused the ad to be displayed are reported to WhenU. Because the Toolbar's advanced functionality is designed to display ads whenever contextually-relevant activity is detected, a continuous series of impressions and click-throughs may be transmitted to WhenU.com's servers as you surf the Internet. To protect your privacy and prevent WhenU or any third party from assembling individual user profiles or knowing which Web sites you visit, your unique machine ID is intentionally excluded from any communications sent back to WhenU that may include a URL or such other browsing-specific information.

Put simply, the bundled Privacy Policy presented to users installing the "Homer & Bart Desktop Theme" is outdated. That outdated policy states flatly, "As the user surfs the Internet, URLS visited by the user (i.e. the user's "clickstream data") are NOT transmitted to WhenU.com or any third party server." In fact, as Ben Edelman has demonstrated with packet logs from WhenU network traffic, some URLs visited by users are transmitted to WhenU.com, making this absolute denial false. 

In response to Edelman's public criticism, WhenU revised its Toolbar Privacy Policy to make clear that a "log of all the sites you visit" is not transmitted, while admitting that some URLs are transmitted when "ads are requested and/or displayed by the Toolbar." WhenU continues to distribute the older version of its Privacy Policy with applications such as the "Homer & Bart Screensaver," thus giving the false impression that no URLs whatsoever are transmitted by the application.

As noted earlier, though, most users will not be inclined to read the bundled Privacy Policy, much less the revised online version. They will simply click through the WhenU notice screen, unaware of what they have in fact consented to.
     
    Interlude  [return to top]
     
    Once the user clicks through the WhenU notice screen, the setup program appears to prepare to install the desktop theme proper -- the software that users specifically requested.


 

In fact, there is one more adware program to be installed.
     
    Adware # 4: Gator/GAIN (Claria)  [return to top]
     
    Just before the installation of the desktop theme commences, the user is presented with one last adware notice screen -- this, for Gator and OfferCompanion, two programs from Claria.

First, a description of Claria's software is offered, and it is primarily oriented towards describing the Gator application, which has functionality that some users might actually be interested in. The advertising functionality of the OfferCompanion program, however, is mentioned only in passing and in terms that are as misleadingly innocuous and sterilized as those used to describe the 180solutions and WhenU programs earlier ("OfferCompanion delivers great offers to you based on the web sites you visit"). 

Nothing in this description, however, mentions the data privacy implications of Claria's software. Those are mentioned only in the EULA and Privacy Policy for the Gator software, which are presented next.

 

This EULA and Privacy Policy for the Gator/GAIN software details quite a number of data collection and transmission practices that many users would likely find alarming:

--- Privacy Policy ---

[...] Here's the deal. And why it is a win-win opportunity. 
You get: free services and software applications that make it faster and easier to perform online activities such as filling in registration and order forms, remembering passwords and saving money while shopping. 

We get: the chance to occasionally show you special offers and advertisements that are selected to match your interests and to bring you useful desktop software applications and services that we think might make your internet experience more enjoyable. We determine your interests by collecting information about where you surf and shop on the web. For example, if you frequently shop for books, OfferCompanion may introduce you to a money-saving offer from a bookstore. Or if you use Gator Form Helper to fill out a registration form on a recipe site, we might display an advertisement for cookware in the Form Helper window. Depending on which services and applications you use, as well as your preferences, these special offers and advertisements may be displayed using popup windows, on web pages, and/or sent to you via electronic mail.

The money we earn from our advertisers and business associates allows us to provide these applications and services to you free. 

Basic stuff we need to know about you. And how we use it.
Gator ServWareApps pay attention to where you are on the web in order to know when to offer assistance (e.g., automatically recognizing and offering to help fill out forms that appear in your browser) as well as to create a profile that is used to select and deliver special offers and advertisements that we think might be of interest to you. This profile is stored on Gator.com servers and consists of:

- Your email address, first name, country and ZIP code (limited to first 5 digits in the U.S.)
- Your Gator.com ID which is a numeric identifier that is generated by Gator.com when you receive Gator ServWareApps
- Your master Gator password, if you choose to use one (we store this so we can share it with you if you happen to forget it)
- Information about web pages you visit -- this information includes a site's web address, time spent at a site, transaction activity, where Gator ServWareApps were used, site entry and exit patterns, and some products and information viewed 
- Any optional demographic information you choose to provide us such as gender and income
- History of various special offers and advertising delivered by Gator ServWareApps, and your various responses to them
- Standard web log information and system settings such as user IP addresses, browser type and versions, screen resolution, time zone selected and the version numbers of some of the software installed on your personal computer

Your email address, first name, ZIP code and country information that you have stored in a Gator ServWareApp is updated on our servers whenever you change this information. To ensure that we and our third party service providers can deliver special offers and advertising we can also collect, store and/or update the email address, first name, ZIP code and country information that is most often used to fill out popular web based forms using your computer. Your profile is updated for as long as you are using any Gator ServWareApp so that we can continue to send you special offers and advertising via email. Upon email request to removeinfo@gator.com, we will promptly remove the information that links your email address to the rest of your profile in our online database. Please note that we do not delete information from our back-up copies of earlier versions of our databases; these back-up copies, however, are used solely to recover data that we still have your permission to use that is inadvertently lost due to such things as equipment failure.

Since each Gator ServWareApp has both a client (software) and server (network) component, Gator.com-controlled servers do communicate with your computer on a regular basis. We use technology that automatically delivers software applications, automatic updates to these applications, and other information to your computer without requiring any action on your part so that they will be ready and waiting for you when you need them. For example, in order for Gator Form Helper to know how to fill out an order form on a web site you visit, it must retrieve the instructions for how to fill out that form from our server. 

Gator.com may occasionally utilize certain rich media viewing/playing applications and/or browser plug-ins ("Rich Media Player/Viewers") such as those published by Macromedia, OnFlow, Microsoft, Real Networks and others in order to include audio and visual effects such as animation, video and sound. Gator.com may install certain Rich Media Player/Viewers, which may be required to view such content. Please note that these Rich Media Player/Viewers are third party technologies and may be subject to third party license agreements, privacy policies and other terms and conditions. Visit http://www.gator.com/richmediaapps for a list of current rich Media Player/Viewers used by Gator.com and links to their respective policies.
Gator ServWareApps may also include price comparison technology powered by Click-the-Button ("Gator PriceCompanion"). Visit http://www.gator.com/servwareapps for a list of current Gator ServWareApps and links to their respective policies.

Stuff Gator.com and partners don't need to know about you. 
The following information is not stored on Gator.com servers unless you request us to do so by registering for optional services: your last name, street addresses, phone numbers, credit card numbers and login IDs/passwords for web sites which Gator Login Helper remembers for you. And the basic information that we do store on our servers (specified above) is physically locked up and firewalled for safety. [...]

While this Gator/OfferCompanion bundle is optional -- users can uncheck the box at the bottom of the notice screen to decline installation -- many users will see no reason to refuse installation of software that appears to offer convenient functionality and which has no immediately apparent features that would be objectionable.

Still further, although the Gator software does pop up a notice box above the System Tray after installation is completed...

...users who click the link to "learn more" are taken not to a page with more forthright descriptions of the advertising and data collection practices of the software, but rather a "demo" of the Gator application.

Summary

At this point four different adware applications have been presented to users, and not a single one of those programs has been described in a straightforward fashion or in terms that would allow users to make sense of the true functionality of that software. Still further, one of the applications simply did not present a EULA or Privacy Policy to users, and another presented a EULA and Privacy Policy with one clause known to be false. A third adware application offered no basic description of the software's functionality, and a fourth failed to disclose key data and privacy practices in the notice screen put in front of users.

The uninstallation process for this collection of software, unfortunately, isn't much of an improvement over the installation process.
     
The Uninstallation [return to top]
     
    However misleading and uninformative the installation process may be, it is relatively easy to negotiate -- at least for users who don't bother to ask too many questions. All users must do is keep clicking "I Agree" or "I Accept." 

The uninstallation process, by contrast, is quite a bit different, putting up a number of barriers in front of users seeking to remove this collection of software from their computers. Indeed, the uninstallation process provides more information about the programs installed than the installation process itself.
     
    Host Program (Desktop Theme)  [return to top]
     
    To uninstall this software package completely, one could do worse than start with the "Homer & Bart Desktop Theme," which is effectively the host program for the accompanying software -- it is the program on which all the others piggybacked.

The "Add/Remove Programs" Control Panel applet contains an easy-to-find entry for the desktop theme.

Strangely, the uninstall from "Add/Remove Programs" does not appear to work. In my test with this uninstaller, files and directories for the desktop theme remained in the \Program Files directory.
     
    Further investigation revealed that the Start Menu icons for the desktop theme remained as well, including one to uninstall the desktop theme.

This second uninstaller works reasonably well, removing all the major files and directories for the "Homer & Bart Desktop Theme." Unfortunately, removing the desktop theme does not remove the programs that piggyback on it during installation. To uninstall those adware programs, users must seek out separate uninstallation entries for each of the advertising software programs.
     
    Adware # 1: WhenU  [return to top]
     
    The WhenU SearchBar program is labeled simply "SearchBar" in the "Add/Remove Programs" applet.

The uninstall for WhenU SearchBar also works reasonably well, though it opens a survey page at the end of installation:

This survey page attempts to persuade users to reinstall WhenU's advertising software in the guise of an anti-spyware application (UControl).
     
    Adware # 2: 180solutions  [return to top]
     
    The uninstallation process for the 180search Assistant is not nearly as straightforward. Clicking the entry for the 180search Assistant "Add/Remove Programs" entry produces this notice:

If the user's internet connection is not available, then the uninstallation process will fail.
     
    The 180 uninstaller opens a series of web pages, each of which attempts to talk users out of uninstalling the 180search Assistant. The first page warns the user that other software might break if the 180search Assistant is uninstalled, without ever specifying what program that might be. If the user has already uninstalled the "Homer & Bart Desktop" theme, this warning is simply not applicable. 

Another of those pages even attempts to give the false impression that the 180search Assistant does not display advertising on the user's desktop, again resorting to slippery euphemisms to describe the browser windows this advertising application opens on the user's desktop.

 

If the user again elects to remove the 180search Assistant, the uninstall process continues, but not before giving the user several more opportunities to refuse the uninstallation.


 

 

All told, the user must click six buttons to uninstall the 180search Assistant. Contrast those six clicks with the one click necessary to get through the 180search Assistant notice screen during installation, which doesn't even hold the user up with so much as a fleeting glance at a EULA or Privacy Policy.
     
    Adware # 3: HyperLinker  [return to top]
     
    Observant users will notice a new entry in "Add/Remove Programs" for a software program that was nowhere disclosed during installation: HyperLinker.

As described by Andrew Clover of doxdesk.com, HyperLinker is a "link-adding adware comprising an Internet Browser Helper Object (BHO) and HTML filter called lmf32v.dll, stored in the System32 folder, and an updater task LMU.exe in the Windows folder." As Clover goes on to explain, this is yet another advertising software program: "When targeted words are seen on the page being viewed, Hyperlinker adds its own double-underlined advertising links to the words, and may contact the controlling server to request a pop-up advert."

While HyperLinker was not disclosed at all during installation and the program is effectively hidden in the Windows \SYSTEM32 directory, the uninstaller works perfectly fine.
     
    Adware # 4: Gator/Offer Companion (GAIN/Claria)  [return to top]
     
    Although the programs from Claria (Gator, OfferCompanion) are installed as a package, they must be uninstalled separately.

First to go is the Gator form-filling program, for which there is an "Add/Remove Programs" entry.

As with the 180search Assistant, the Gator uninstaller attempts to talk the user out of uninstallation.


 

Once the Gator program is uninstalled, the OfferCompanion advertising program remains, though.
     
    Yet another "Add/Remove Programs" entry exists for OfferCompanion.

And, once again, the user must jump through several hoops in order to remove this Claria application.


 

There are still two programs to remove, one of which lacks an uninstaller, and the other of which was not disclosed during installation.
     
    Adware # 6: ATP  [return to top]
     
    There is yet another advertising program to be uninstalled that was not disclosed during installation: Addictive Technologies & Partners (AT Partners). Only the most observant users would notice the new "Add/Remove Programs" entry for the cryptically named "ATP":

In fact, this is an uninstaller for a Browser Helper Object (BHO) from Addictive Technologies (ATPartners.dll) that was installed to the Windows \SYSTEM32 directory -- a location where most users would never notice it -- with no notice whatsoever. Most users would never figure out on their own that this program had been installed. Still fewer would understand the origin of the "ATP" entry in "Add/Remove Programs."

The uninstaller does remove the software, provided users know enough to use it.
     
    Adware # 7: ClearSearch  [return to top]
     
    One last program remains on the system: ClearSearch -- the program for which users saw only a EULA during installation. As poor as the installation process for that program is, the uninstallation is even worse, because no uninstaller whatsoever is added to "Add/Remove Programs."

While there is no uninstaller, there are several randomly named ClearSearch executable processes (including two instances of the same executable file)  that are launched every time users start Windows:

C:\Program Files\u0g0bng6\60131240.exe
C:\Program Files\u0g0bng6\u0g0bng6.exe
C:\Program Files\u0g0bng6\u0g0bng6.exe

These ClearSearch executables are plainly visible in the Windows Task Manager:

Note that not only are the files themselves randomly named, but their installation directory (C:\Program Files\u0g0bng6\) is also randomly named, presumably to thwart or discourage uninstallation.

To remove ClearSearch and all of its associated files and Registry keys, most users will be forced to resort to an anti-spyware application. 
     
Conclusion [return to top]
     
    Although this package of software programs might initially appear to be user-friendly, in fact, it is deeply flawed. While it is simple enough to install this collection of applications, the installation does not provide users with the information they need in order to make informed choices about the advertising software programs that accompany the host desktop theme. Still worse, some of the adware programs installed are not even disclosed to the user during installation. Finally, the uninstallers offered for many of these programs are either objectionable in some way or just plain non-existent.
     
   

Return to Adware Installations of 2005 index page
     

© Copyright 2005 Eric L. Howes