AOL security tools raise adware questions

[ronjor]

-{ Quote: "Although security experts, including Howes, say that Active Virus Shield does not behave in a malicious fashion or serve up unwanted ads, some are concerned that the product's end user license agreement (EULA) would allow AOL to send spam or serve up adware at some point in the future. "If it actually does any of the things stated in the EULA, we would actually flag it as spyware," said Christina Olson, a project manager with Stopbadware.org" }-
Article (http://www.infoworld.com/article/06/08/18/HNaoladware_1.html)

[Durad]

Eric L. Howes comments on AOL ActivrVirusShield and EULA:

-{ Quote: "AOL Security Tools Raise Adware Questions
Consumer advocates criticize AOL's free Active Virus Shield antivirus software licensing agreement.
Robert McMillan, IDG News Service
Thursday, August 17, 2006 07:00 PM PDT


SAN FRANCISCO -- Just days after posting details of searches made by hundreds of thousands of subscribers, AOL is in hot water again with consumer advocates. This time the issue is with the company's Active Virus Shield anti-virus software, released last week.

At issue is the software's licensing agreement, which authorizes AOL to gather and share data on how the software is being used and permits AOL and its affiliates to send e-mail to users. "If you go through the installation, just as any normal user would, there is not the slightest hint of any advertising functionality or data gathering of any kind," said Eric Howes, director of malware research at anti-spyware vendor Sunbelt Software.

Active Virus Shield uses Kaspersky Lab's well-regarded anti-virus software, and comes with an optional security toolbar that blocks pop-up ads and manages passwords. The software is available for free to anyone who wishes to download it.
Concerns" }-http://www.pcworld.com/article/id,126803-page,1/article.html

[Firecat]

ActiveVirusShield has been out since November 2005. Why is this thing with the EULA only being seen now?

While it is nice to see that it was eventually seen, the fact that it has taken so long is not pleasing. :-\

[phasechange]

has anyone noticed (say using firewall logs or packet sniffing) any unusual network activity?

Fairy

[RejZoR]

Do you all think Kaspersky Lab would IMPLIMENT anything like this in their own product just for AOLs sake? Hnestly they are just way to respected security company to do such a stupid thing. Toolbar is however a completelly different thing...

[Durad]

-{ Quote: "ActiveVirusShield has been out since November 2005. Why is this thing with the EULA only being seen now?" }-

Because at that time it was not used widely.

-{ Quote: "Do you all think Kaspersky Lab would IMPLIMENT anything like this in their own product just for AOLs sake?" }-

It will not be implemented into KAV and AV engine for sure but it could be implemented trought toolbar or any other additional boundled software that could be added in future.

[Mrkvonic]

Hello,
Not surprising really. It's AOL we're talking about, after all.
Mrk

[the Tester]

That's not cool!:thumbd:

There should be a notice before or during install if AOL wants to gather data.

[Don Pelotas]

-{ Quote: "Because at that time it was not used widely.



It will not be implemented into KAV and AV engine for sure but it could be implemented trought toolbar or any other additional boundled software that could be added in future." }-
Durad, for that to happen you would have to have installed the toolbar, which you of course deselect when you install it or you would have to use a new installer that includes what you are trying to suggest.

[Mele20]

JavaCool's Eulalyzer hated that EULA. Extremely long, too complex and a LOT of interesting stuff that rated mostly 6's which is pretty high. I read the EULA and told myself it wasn't that bad unless I installed the toolbar which, of course, I wouldn't, but then after I ran Eulalyzer on it, I was sort of glad that I have never been able to get it work on my computer and AOL has never replied to my request for help. If there is no support and Eulalyzer goes nuts...then why would anyone want it?

[RejZoR]

Hey, i don't care really. It would just be more update bandwidth for us in the end which is better :P

[ggf31416]

This is a part of the current "License and User Agreement and Privacy Policy" in the AOL AVS site:

5. INFORMATION PRACTICES. In this section, we explain how we collect and use certain information that you provide to us when you register with us and use the Software (collectively, "your Information"). Your use of our or our affiliates' other products, or third party offerings, is governed by their own privacy policies.

a. Registration Information: When you register for the Software, you provide us with your e-mail address ("Registration Information"), which may be used to fulfill your requests for products, programs, and services; to communicate with you and respond to your inquiries; and to help offer you periodically our other products, programs, or services that may be of interest. We may share Registration Information in order to jointly present you offers with or on behalf of our business partners, but we do not allow these partners to use your Registration Information for any other purpose. Except for these joint offers, we will only share your Registration Information with third parties to provide products and services you have requested, or when we have your consent. You will have choices on whether or not to opt-out or unsubscribe from receiving further commercial e-mails from us. These opt-out mechanisms do not, however, apply to e-mails relating to your Software, upgrades or updates for the Software, or e-mails confirming or informing you about your transactions with us.

b. Technical Information. Your Information may also include certain technical information gathered or received when you use the Software (collectively, "Technical Information"). Some of the technical information that may be collected or received includes: the type of browser you are using, the type of operating system you are using, the domain name of your Internet service provider, file requests for updates, computer errors arising in connection with use of the Software and Software configuration settings. The Software may also collect information about the malicious programs found on your computer during the scanning process and send the information to our servers for statistical purposes. The Technical Information is used to operate and improve the Software, and for diagnostic purposes.

c. General: Your Information may be accessed and disclosed in response to legal process (for example, a court order, search warrant or subpoena); in other circumstances in which we believe the Software is being used in the commission of a crime; when we have a good faith belief that there is an emergency that poses a threat to the safety of you or another person; or when necessary either to protect our rights or property or for us to render the service you have requested.

d. Agents, Transmission and Storage of Data. We may use agents and contractors in order to help provide the Software and to help operate its corresponding features and services. Your Information may be collected and stored in the United States and other countries.

e. Marketing Preferences. You will be given the option in each marketing e-mail to opt-out of further marketing offers; however, please keep in mind that these preferences do not apply to communications that are directly related to the Software, your registration with us, or the fulfillment of a specific transaction you have requested. Because the choices you make in connection with your APS Product information may not take effect immediately, it is possible you may receive a communication during the period in which your request is being processed.

f. Cookies. We may use cookies, web beacons, or similar technologies in combination with your APS Product information to enhance your experience with the Software; to help authenticate you when you use the Software; to remember your preferences and registration information; and help measure and research the effectiveness of our offerings and e-mail communications (by determining which of our e-mails you open and act upon). If you have any questions or concerns about our information practices, you may contact us at this e-mail address: AVSPrivacy@aol.com.

[kdm31091]

I'm not suprised. Most AOL stuff is some form of spyware and is at the least, bloated.