The Spyware Warrior Guide to

Adware Installations of 2005

Example 3: KiwiAlpha

     
    The third adware installation to be examined is the KiwiAlpha P2P file-sharing program, which bundles a number of noteworthy advertising software programs, including one that has proved extremely controversial among IT administrators (RelevantKnowledge).

Return to Adware Installations of 2005 index page


    On this page... Summary of Key Findings...

The BullsEye Network
- installer provides no basic description of programs' key
   functionality
- EULA includes objectionable uninstallation restrictions
- uninstaller badgers user into refusing uninstall
- uninstaller opens two deceptive ads at close of uninstall

WhenU
- installer obscures functionality through euphemistic language
- installer uses outdated, erroneous privacy policy
- installer uses keyhole scroll box to display EULA
- uninstaller badgers user into refusing uninstall
- uninstaller attempts to persuade user into reinstalling advertising 
   program through "anti-spyware" program

RelevantKnowledge
- installer provides no basic description of programs' key
   functionality
- installer discloses highly invasive data collection practices
   deep in EULA
- program files hidden in Windows directory
- uninstaller leaves key executable files in Windows directory 


Overview [return to top]
     
    KiwiAlpha is a "free" peer-to-peer (P2P) file sharing program available from the software vendor's download page as well as major download sites:

Nothing on the KiwiAlpha download page alerts the user that advertising software, "adware," will be installed with KiwiAlpha.

When users click the download link, they are prompted to download a traditional setup executable (kiwialphafree.exe) to their hard drives, which they can then run.

     
The Installation [return to top]
     
    The installation of KiwiAlpha starts with KiwiAlpha's own End User License Agreement (EULA).

This EULA is a comparatively short one (only 239 words) and contains no unusual clauses or terms of note. This short, innocuous EULA stands in stark contrast to the EULAs that come next.

     
    Adware # 1: Bargain Buddy (eXact Advertising/BullsEye Network)  [return to top]
     
    The next document put in front of users is a 2600 word EULA for the adware program Bargain Buddy (from eXact Advertising, otherwise known as the BullsEye Network).

This notice screen presents no short, readable description of the software's functionality outside of the EULA, and few users will bother to wade into that legalese-laden document, which does in fact disclose that the software will open advertising on the user's desktop in response to the user's surfing activity:

The eXact Advertising Software, consisting of Bullseye (the “Software”) is offered to you by eXact Advertising, LLC and/or its affiliates (“EXACT”, “we” “us” or “our”). Bullseye delivers relevant contextual information to you in the form of advertisements, promotions and other content based on the URLs and/or search terms you enter when navigating the Internet. These advertisements, promotional messages and other notifications or information may be displayed on your computer screen at any time while you are online. EXACT may display these advertisements in a separate independent window controlled by EXACT on behalf of its advertising clients and not on the Web site that you may be viewing when the advertisement appears. EXACT’s advertising clients may be competitors of the publishers whose Web site you may be viewing or may have recently viewed. Advertisements delivered by EXACT on behalf of its clients are distinguishable from other advertisements because all such advertisements contain one of the following trademarks “Bullseye” Network Offer” or “3rd Party Offer by eXact Advertising” in the title bar of the advertisement. To see representative full-size examples of each type of advertisement that may be displayed along with the frequency with which each type of advertisement may be displayed, go to <http://www.bullseye-network.com/ad.html>, which is incorporated herein by reference and is part of this Agreement. The Software does not store any personally identifiable information that records your browsing behavior. We hold all information collected through your use of the Software pursuant to our privacy policy located at www.exactadvertising.com/privacypolicy.html <http://www.exactadvertising.com/privacypolicy.html> that is part of this Agreement and incorporated herein.

[...]

You agree that you will only uninstall the Software from your computer by following the above instructions and you will not initiate, permit, authorize or assist any third party or application to remove the Software from your computer, or disrupt its operation or the operation of any other user. You agree that EXACT may store a cookie, computer file or other unique identifier on your computer to identify you and automatically repair or reinstall the Software if any third party attempts to delete, disable or modify the Software. 

Still later in that EULA is a remarkably restrictive clause (see above) that prohibits users from resorting to third-party applications such as anti-spyware programs to remove eXact's software from their systems. This sort of license clause should have been disclosed in a much more forthright fashion -- as it stands, few users will ever see it.

This EULA also contains a link to eXact Advertising's Privacy Policy, which details still further the data collection performed in order to serve advertising on the user's desktop:

Third Party Ads. 

We may use other third-party advertising companies to serve ads when you visit or use our Web sites. These companies may use information (not including your name, address, e-mail address or telephone number) about your visits to this and other Web sites in order to provide advertisements on this site and other sites about goods and services that may be of interest to you. 

EXACT may collect any or all of the following types of information: (a) traffic or clickstream data, (b) cookies, (c) Internet Protocol ("IP") addresses, or (d) contact information and other personally identifying information. EXACT's collection and use of each type of data is described below, as well as the ways (if any) in which the data may be shared with third parties. (a) Traffic or Clickstream Data. Data about traffic and usage is not personally identifying or identifiable, and is not supplemented or combined with personally identifying or identifiable information. EXACT may share information it collects with certain selected third parties, but only in aggregated, anonymous form. 

Despite the fact that many users would be concerned about this invasive data collection, this too is never forthrightly disclosed to the user in the Bargain Buddy notice screen. The user is simply presented with a EULA and asked to agree to its terms. 

     
    Adware # 2: WhenU Weathercast & SaveNow  [return to top]
     
    The WhenU notice screen for Weathercast and SaveNow does represent a minor improvement over the Bargain Buddy notice screen, though it too has significant problems. This notice screen does provide a kind of description of the software to be installed, but text describing the SaveNow advertising application resorts to sterilized euphemisms ("contextually relevant offers") instead of using straightforward, unvarnished language:

Of more concern is the claim that

SaveNow protects your privacy! It
requires NO personal information
and doesn't collect or send your
browsing activity anywhere.

As will become apparent shortly, this claim simply isn't true.

Also a problem is the keyhole scroll box used to present the SaveNow EULA and Privacy Policy. These documents disclose important details regarding the "contextually relevant offers," which is in fact pop-up advertising that appears on the user's desktop -- functionality that many users would regard as objectionable:

Functionality

The SaveNow Bundle (“SaveNow”) shows you relevant coupon offers, contextual information and services as you surf the Web. SaveNow attempts to display offers at the moment when they are most relevant to you. Offers and information are displayed in the form of interstitials (“pop-up ads”) and various other ad formats. 

The SaveNow software selects which ads and offers to display to individual users based on several factors, including: URLs associated with web pages visited by the user, search terms typed by the user into search engines, the HTML content of the web pages viewed by the user, and the local zip code of the user. SaveNow ads and offers are delivered in a separate, independent window controlled by WhenU.com, are not endorsed or affiliated with anyone other than WhenU.com and may in fact be competitive with some of the sites visited by the user while online.

SaveNow enables users to receive advertising-supported versions of many popular software applications for free. The SaveNow Bundle includes a Save!-supported version of WeatherCast. Use of Save! is required to continue to use WeatherCast for free. To uninstall Save!, you must uninstall all Save!-supported software.

[...]

PRIVACY STATEMENT

By downloading the SaveNow software, you give permission to WhenU.com to display relevant contextual information and offers. The SaveNow software selects which ads and offers to display to individual users based on several factors, including: URLs associated with web pages visited by the user, search terms typed by the user into search engines, HTML content of the web pages viewed by the user and the local zip code of the user.

The software protects users’ privacy by uploading a database of content in small chunks to individual desktops and then determining on the desktop whether or not to retrieve information from WhenU.com or third-party servers. To protect user privacy, the same database of content is sent to all desktops. Decisions regarding which ads to retrieve to an individual desktop are all processed on the user’s desktop - and isolated from WhenU.com servers. User privacy is also protected in the following manner:

1) Personally identifiable information is NOT required in order to use the software and WhenU.com does NOT know the identity of individual users of the software
2) As the user surfs the Internet, URLS visited by the user (i.e. the user’s “clickstream data”) are NOT transmitted to WhenU.com or any third party server 
3) WhenU.com does NOT assemble personally-identifiable browsing profiles of users
4) WhenU.com does NOT assemble anonymous machine-identifiable browsing profiles of individual users
5) WhenU.com does NOT track which ads and offers are seen or clicked on by individual machines - analysis and tracking is done in the aggregate

Each individual desktop is assigned an anonymous, unique machine ID. This machine ID is used ONLY to enable WhenU.com to count unique, active desktops in the network. The machine ID is NOT used to determine which ads to serve individual users or to create browsing profiles of users. When ads are displayed by the software, impressions and clickthroughs are reported to WhenU.com servers. To protect user privacy and prevent WhenU.com or any third party from assembling user profiles, the unique machine ID is NOT included in the impression and clickthrough reports sent by the desktop to WhenU.com servers.

The Privacy Policy (see above) does appear to back up the claim that the software doesn't "collect or send" the user's "browsing activity anywhere." Even the online version of the SaveNow Privacy Policy reinforces this claim:

By downloading SaveNow, you give permission to WhenU to display relevant information and offers while you browse the Web. SaveNow ads, which slide up in front of or behind your browser, are always branded SaveNow and tell you they are coming from software - not Websites. SaveNow results are based on the terms you type into search engines, the Websites you visit and the Web content you view.

The Software protects your privacy by uploading a database of content to your desktop and then determining on the desktop whether or not to retrieve information from WhenU or third-party servers. To protect your privacy, the same database of content is sent to all desktops. Decisions regarding which ads to retrieve to your desktop are all processed on your desktop and isolated from WhenU servers.

Your privacy is also protected in the following manner:

1. Personally identifiable information is NOT required in order to use the Software;
2. URLs you visit (i.e. "clickstream data") are NOT transmitted to WhenU or any third party server;
3. WhenU does NOT assemble personally-identifiable browsing profiles of you;
4. WhenU does NOT assemble anonymous machine-identifiable browsing profiles of you;
5. WhenU does NOT track which ads and offers are seen or clicked on by you -- analysis and tracking is done in the aggregate. 

Each desktop is assigned an anonymous, unique machine ID. This machine ID is used ONLY to enable WhenU to count unique, active desktops in the network. The machine ID is NOT used to determine which ads to serve individual users or to create browsing profiles of users. When ads are displayed by the Software, impressions and clickthroughs are reported to WhenU servers. To protect your privacy and prevent WhenU or any third party from assembling user profiles, the unique machine ID is NOT included in the impression and clickthrough reports sent by the desktop to WhenU servers.

In fact, the SaveNow notice screen and Privacy Policy are erroneous. Indeed, both versions of the Privacy Policy (the version bundled with KiwiAlpha and the online version) are outdated. Those outdated policies state flatly that "URLS visited by the user (i.e. the user's "clickstream data") are NOT transmitted to WhenU.com or any third party server." As Ben Edelman has demonstrated with packet logs from WhenU network traffic, some URLs visited by users are transmitted to WhenU.com, making this absolute denial false. 

In response to Edelman's public criticism, WhenU revised its Toolbar Privacy Policy to make clear that a "log of all the sites you visit" is not transmitted, while admitting that some URLs are transmitted when "ads are requested and/or displayed by the Toolbar." The updated Browser Toolbar Privacy Policy available online from WhenU's web site reads:

WhenUSearch Browser Toolbar Privacy Statement

By downloading the Desktop Toolbar ("the Toolbar"), you give permission to WhenU.com, Inc. ("WhenU") to display relevant contextual information and offers. The Toolbar selects which ads and offers to show you based on several factors, including: which webpages you visit, search terms you use while searching online, your local zip and/or country code, and content of the webpages you view. The Toolbar displays contextual ads and offers in the form of rotating text links accessible from within the application.

The Toolbar protects your privacy by uploading a database of content in small chunks to your desktop and then determining on your desktop whether to retrieve information from WhenU or third-party servers. To protect your privacy, the same database of content is sent to all desktops. Decisions regarding which advertising and offers to retrieve are processed on your computer desktop. In this way, WhenU is able to deliver to you relevant coupons, information and advertisements without establishing any profile about you (even anonymously) on WhenU servers.

Your privacy is also protected in the following manner:

1) Your personally-identifiable information is not required in order to use the Toolbar. WhenU does not know your individual identity and does not attempt to discern it in any way.
2) As you surf the Internet, your "clickstream data" (i.e. a log of all the sites you visit) is not transmitted to WhenU or any third party server. (Although impressions and click-throughs that contain indicia of browsing activity are transmitted each time an ad is served, as described below, these communications are never linked to personally identifiable information and are otherwise carefully designed to protect your privacy.)
3) WhenU does not assemble any personally-identifiable browsing profiles of you or your individual machine.
4) WhenU does not assemble any anonymous machine-identifiable browsing profile of you or your machine.
5) WhenU does not track which ads and offers you see as an individual user — all of our analysis and tracking of ads is done in the aggregate.

The Toolbar does send back certain information from your desktop in order to count the number of users in our network and optimize the performance and relevancy of the ads. For example, when an offer is displayed to you in the Toolbar and whenever you click on such an offer, the Toolbar sends WhenU a communication that may include information about the webpage you were viewing before you saw or clicked on a particular ad. WhenU has intentionally designed these communications back to WhenU to be highly protective of user privacy, in the following ways:

(a) Each individual desktop is assigned an anonymous, unique machine ID. This machine ID is used only to enable WhenU to count unique, active desktops in the network. The machine ID is not used to determine which ads to serve individual users or to create browsing profiles of users.

(b) When ads are requested and/or displayed by the Toolbar, impressions and click-throughs, including the factor (e.g., the URL, the keyword, or the search term, or some combination thereof) that caused the ad to be displayed are reported to WhenU. Because the Toolbar's advanced functionality is designed to display ads whenever contextually-relevant activity is detected, a continuous series of impressions and click-throughs may be transmitted to WhenU.com's servers as you surf the Internet. To protect your privacy and prevent WhenU or any third party from assembling individual user profiles or knowing which Web sites you visit, your unique machine ID is intentionally excluded from any communications sent back to WhenU that may include a URL or such other browsing-specific information.

WhenU has failed to make this change to all of its posted Privacy Policies, however, and even distributes outdated versions of its Privacy Policies with third-party applications such as KiwiAlpha, thus giving the false impression that no URLs whatsoever are transmitted by the application.

As noted earlier, though, most users will not be inclined to read the bundled Privacy Policy, much less the revised online version for the Browser Toolbar. They will simply click through the WhenU notice screen, unaware of what they have in fact consented to.

At the end of the KiwiAlpha installation process users are asked to choose between a "Standard" version of Weathercast and a "Plus" version, which requires a small payment. This would be yet another opportunity to alert users to the advertising functionality of WhenU's advertising application (required to sponsor use of the free "Standard" version), but no mention of the functionality is made anywhere.

WhenU also opens a welcome page with more information about SaveNow. This information is somewhat more straightforward -- but this information comes well after the application has already been installed to the user's PC.

While WhenU does offer more information and disclosure to users, most users will likely click through the SaveNow notice screen without fully understanding the functionality of the software they have consented to.

     
    Adware # 3: RelevantKnowledge  [return to top]
     
    The next notice screen is yet another EULA-only disclosure, this time for RelevantKnowledge, which offers users no simple description of the software, requiring them to wade through a remarkably dense 5000 word EULA.

The terms contained in this RelevantKnowledge EULA are critical, as this document discloses a remarkably invasive set of data collection, transmission, and sharing practices -- so invasive, in fact, that the EULA text deserves to be quoted at length:

What information is collected?

Once you accept this User License Agreement, and configure your computer to use this service, you will be given the opportunity to participate in a variety of survey opportunities. You will be notified about these opportunities by e-mail and by pop-up surveys. If available, we will obtain your contact information and some basic demographic information about you from companies that help introduce our service to you. In addition, our service may collect additional information about your household's Internet behavior, and that of any other computers used by members of your household, that you have configured to use this service. We may also collect certain basic hardware, software and computer configuration information about the computer that is connected to our service including such data as the speed of the computer processor, its memory capacities, and Internet connection speed. This information is then combined with your survey responses and other participant data collected to create an understanding of Internet e-commerce. This service monitors your Internet surfing, by routing your Internet activities through our service and logging information about the web pages that you visit and the actions that you take, such as the purchases and transactions you make. This service can only monitor the Internet behavior and activity of your household's configured computers. As a participant, you therefore control which computers this service is available on. This service monitors all of your Internet behavior, including both the normal web browsing you perform, and also the activity you may have through secure sessions, such as when filling a shopping basket or filling out an application form that may include personal financial or health information. This service's proprietary and patent pending technology allows us to see the details of secure pages while protecting such content from parties other than the site to which you are connected. We monitor not only the Internet connections of our users so we can accurately and anonymously model the browsing habits of Internet users, but also their shopping, registration, and other interactions as well. Although we generally monitor your Internet behavior, this service does not analyze the content of or keep any instant messages you send, nor do we analyze or use the contents of any of your e-mail messages, except as a quality assurance check against and method for, verifying your contact information and information on the surfing and buying behavior of participants.

How is the information collected?

After you configure your computer to use this service, you will be notified about a variety of survey opportunities by e-mail and by pop-up surveys. In addition to the monitoring of your Internet behavior, we may ask you for certain basic demographic information about you and your household so we can better understand the Internet behavior you engage in, which we monitor through our patent pending technology. We may also combine the information that you provide us with additional information such as credit or prescription information that we obtain from third parties such as consumer preference reporting companies, credit reporting agencies, and prescription benefits managers. When we do combine the information that you provide us with information about you from third parties, we would undertake that process using secure and confidential matching procedures. As part of these procedures, we would provide only the personal information necessary to perform a match and, at the same time, restrict the third party's use of the information we provide to undertaking a match with this service and, on a limited and infrequent basis, assisting us in statistically reporting and making projections about current and future Internet usage and online commerce. After this process is completed, the third party must destroy all records we made available. Please note that in all cases, this service does not share or sell your name or the personal information that we receive from you for direct marketing purposes. Moreover, we do not provide our commercial customers with any personally identifiable information about participants unless specifically authorized by you.

To allow us to confidentially monitor your Internet activity, you must configure your computer so that your household's Internet communications are routed through our high-performance service. This routing is only done on the machines you actually configure for this service. Please note: we require that you provide this Agreement to members of your Household and other users of your computer(s) and obtain their consent to the routing and monitoring of their Internet activity by this service subject to the terms of this Agreement.

How is the collected information used?

Just as television-rating services monitor the viewing habits of a selected number of TV viewers to make projections as to what the entire TV viewing audience is watching, this service applies similar concepts to the Internet. This service uses the Internet activity and demographic information of our participants, and their survey responses, to statistically report and make projections about current and future Internet user behavior and, more generally, to extrapolate data about potential economic trends. This service essentially enables companies to tap the pulse of Internet users' preferences and provides a voice for Internet users to impact the future of Internet usage and e-commerce activities. When we provide predictive reports and projections about economic trends to our customers, or use such reports internally, the analysis is performed on aggregated or bundled information. We do not provide our commercial customers with any personally identifiable information about participants. In fact, our customers benefit from the aggregation or grouping of information because this type of data can be refined to more accurately reflect and predict trends, developments and Internet users’ behavior.

For certain commercial customers, we may provide anonymized individual-level information. We make this data available so that these customers may enhance their own understanding of Internet usage and online commerce. In making such information available, we do not provide these customers with personally identifiable information such as names, addresses, and e-mail addresses.

Our customers use the information received to (i) modify online services and offerings; (ii) make more effective use of online data to understand both online and offline commercial behavior; and (iii) discern general economic trends and the business performance of specific entities for a wide range of business purposes including, but not limited to, identifying financial investment opportunities and understanding the value and interest in certain business enterprises. Our customers are able to make more informed decisions about their Internet and general business based upon understanding behavioral trends, buying patterns or other aspects of Internet usage and electronic commerce behavior.

There are some limited cases in which we share personally identifiable information with third parties. Specifically, we provide personally identifiable information to third parties for the purpose of conducting the secure and confidential matches discussed more fully above.

We also share your contact information with those third parties who help us deliver this service to you. These parties are required to only use the information we provide for this limited purpose. This includes companies that service and administer incentive programs on behalf of this service (for example, we simply have to give them your name and address to award you a prize). When we do provide your contact information to these service providers, we establish strict controls and enforce those controls through legal agreements that restrict the use of your participant information to the functions necessary for us to deliver our service to you. In sum, our service providers may only use the information we provide to benefit you, this participant, and to serve this service. They are strictly prohibited from making any other use of the information and may not release it to anyone else unless you authorize it.

[...]

What are my obligations as a service participant?

This service provides you with the opportunity to participate in a variety of surveys for cash or sweepstakes prizes and other benefits. In exchange for these services, you agree to
* Allow this service to collect and use information obtained from you and related to you and your household's Internet use as described in this Agreement;
* Allow this service to combine the information that you provide with information such as credit or prescription information from third parties such as consumer preference reporting companies, credit reporting agencies, and prescription benefits managers, which is done using secure and confidential data matching procedures;
* Provide complete and accurate information about yourself and your household if requested during registration for this service, which you agree to update and/or confirm upon request by this service, and allow this service to obtain contact information and basic demographic information about you from companies that help introduce our service to you, if such information is available;
* Make reasonable efforts to configure all of the computers having Internet access that are used at home by anyone in your household to use this service and, where allowed by company policy, on all such computers having Internet access that are used at work by anyone in your household, and make reasonable efforts to insure that those who use such computers are aware of our service;
* Accept automatic software upgrades or changes to your system settings provided by this service for the sole purpose of ensuring compatibility between your computer system and this service; receive administrative e-mails informing you about upgrades, disruptions to our service, or issues related to basic service functions, providing notification to sweepstakes winners, about special participant opportunities, request updated demographic information or information regarding usage of the service and other issues; and participate in surveys delivered to you by this service;
* Allow this service to acquire basic configuration information about the computer connected to our service such as Internet connection speed, hard disk size, RAM and other information about the PC which we use to diagnose and improve the service and which we report to others in an aggregated and anonymized form;
* Allow this service to verify the accuracy of your e-mail address for purposes of inviting you to participate in surveys; and
* Regularly visit and review the Agreement posted on this website, so that you are aware of any changes made to the Agreement.

You agree not to [...]

* Attempt to defeat or circumvent the browser configuration or routing of the Internet communication through this service, it being your responsibility to undertake the modification to, or cancellation of, this services as instructed in this Agreement or as expressly instructed by an authorized service representative.

Careful readers will notice that even within this lengthy EULA the most objectionable terms are buried within the middle of long, dense paragraphs, which few readers will bother to penetrate. Most readers simply won't get past the first few paragraphs, and it takes little savvy to recognize that this EULA-only form of notice was likely crafted explicitly to discourage the majority of users from looking too carefully or discovering the true functionality of this software.

     
    Summary

Quite a lot of advertising software is installed to users' PCs by the KiwiAlpha bundle, yet almost none of it is described to users outside of the dense legalese of EULA and Privacy Policy texts. The one vendor that does deign to offer a more basic description of its software resorts to euphemistic language and false claims to avoid fully disclosing software functionality that many users would find objectionable.

     
The Uninstallation [return to top]
     
    As is so often the case with adware bundles, it is quite easy to install this group of applications, provided the user doesn't ask too many questions. The user simply keeps clicking "Next" or "I Agree," and the software is swiftly installed to the user's PC. Quite the opposite is true, however, of the uninstallation of this software bundle, which requires users to jump through multiple hoops in order to remove all of the previously installed programs. 
     
    Host Program (KiwiAlpha)  [return to top]
     
    The host program, KiwiAlpha, is relatively easy to find in the "Add/Remove Programs" Control Panel applet. 

The uninstaller works as expected, removing all significant traces of KiwiAlpha from the hard drive and Windows Registry. Few is any of the adware programs will go quite as easily.

     
    Adware # 1: The BullsEye Network  [return to top]
     
    The adware program from eXact Advertising was identified during installation as "Bargain Buddy," but the user will find no such entry in "Add/Remove Programs." Instead, the user must look for an entry named "The BullsEye Network" (a name which is previously used only in the EULA for Bargain Buddy).

Instead of performing a straightforward removal of the software, the BullsEye uninstaller first badgers the user into keeping the software with two screens that talk up the benefits of the software. The first of those screens uses a confusingly worded prompt: "Do you want to discontinue the uninstall process?" (the correct answer to continue uninstalling is "No," where most users would expect to click "Yes" to continue uninstalling).


 

After users twice elect to continue with uninstall, the BullsEye uninstaller requires users to jump through yet another hoop: a survey about the software itself.

Even after the survey is completed and the uninstallation is performed, the BullsEye uninstaller opens a web page that spawns two deceptive advertisements (see below) for other software products. 

  • The first, larger ad window points to an anti-spyware application named MyCleanerPC
  • The second, smaller dialog-shaped window points users to a purported anti-spam program, 
    which turns out to be Hotbar, yet another adware program

These two advertisements are deceptive because they are presented at a point where many users will be suspicious of unwanted software on their computers (having just uninstalled an adware program) and because the ads are presented in windows that vaguely resemble system messages of some sort.

After users cancel out and close these ad windows, they can finally move on to removing the remainder of the software bundled with KiwiAlpha.

     
    Adware # 2: RelevantKnowledge  [return to top]
     
    Users will find an entry in "Add/Remove Programs" for RelevantKnowledge.

This uninstaller is somewhat puzzling, because it provides no notice to users that the uninstall is complete -- the RelevantKnowledge entry simply disappears from "Add/Remove Programs." Close inspection of the PC reveals that most of the configuration changes made by RelevantKnowledge have been removed, however, two executable files remain in the Windows \SYSTEM32 directory:

C:\WINNT\SYSTEM32\rk.bin
C:\WINNT\SYSTEM32\rk.exe

Why these two files are left behind is unknown, but most users will remain completely unaware of them, hidden as they are deep in the Windows directory.

     
    Adware # 3: WeatherCast  [return to top]
     
    To remove WhenU's software, users must seek out and use not one but two different entries in "Add/Remove Programs" (by contrast, the installer offers the two WhenU programs as a bundle). 

First to go is WeatherCast, which acts as a kind of host program for WhenU's advertising software (SaveNow). The entry for it is relatively easy to find.

Like the BullsEye uninstaller, though, this WeatherCast uninstaller attempts to talk the user out of removing the program.


 

And the uninstaller confirms the user's choice several times (see above).

The uninstaller for WhenU WeatherCast does work reasonably well, though it opens a survey page at the end of installation:

This survey page attempts to persuade users to reinstall WhenU's advertising software in the guise of an anti-spyware application (UControl).

     
    Adware # 4: SaveNow  [return to top]
     
    Once WeatherCast has been uninstalled, WhenU SaveNow can be removed as well by using the "Add/Remove Programs" entry for this advertising application.

As with the WeatherCast and BullsEye uninstallers, the SaveNow uninstaller throws several obstacles in front of users, attempting to dissuade them from removing the software. 


 

And as with the BullsEye uninstaller, users are confronted with a confusingly worded prompt (see above).

The uninstaller does eventually perform a reasonably complete removal of the software, provided the user clicks all the right buttons in the run-up to the actual uninstallation.

     
Conclusion [return to top]
     
    The KiwiAlpha adware bundle is quite representative of other adware bundles currently in distribution. It bundles multiple adware programs, and most of these adware applications aren't presented to users during installation in a reasonably understandable fashion. In most cases, a dense EULA is simply put before users, who are asked to agree to terms that most will never see or fully understand. In the one case where a more understandable description of the software is presented, the installer text resorts to slippery euphemisms to avoid alerting users to the true functionality of the software (advertising). The Privacy Policy presented to users for that advertising application also contains a clause that makes false claims about the data collection and transmission practices of the software.

The uninstallers for these applications are all problematic in one way or another. Some badger the user into refusing the uninstall. Others perform incomplete removals or even spawn more advertising. 

All told, this adware bundle employs a number of devices on the front end to ease users into consenting to the installation of software they won't fully understand while employing other devices on the back end to impede the voluntary uninstallation of the software.

     
   

Return to Adware Installations of 2005 index page

     

© Copyright 2005 Eric L. Howes