javacool
May 4th, 2003, 05:27 PM
SPYWARE ALERT: MyFreeCursors.com - KeenValue
Last Updated: May 4, 2003
Background: MyFreeCursors.com offers an “easy cursor change service”. By clicking on a cursor that a user wants, the site will attempt to download and run an installer using ActiveX. This installer not only installs the cursor, but may install the following three applications:
n-CASE
iGetNet
KeenValue
The focus of this advisory is the KeenValue program.
Details: The hard-to-find privacy policy, located (among many places) at myfreecursors.com/privacy/ , details some alarming characteristics of the KeenValue program. Supposedly, KeenValue "provides you with the ability to obtain advertiser-supported versions of software applications (valued at up to $30) free-of-charge or at a reduced cost"… but take a look at the following sections of the "privacy policy" / terms of use:
-{ Quote: "Delivery of KeenValue Advertising
Advertisements are delivered to your computer screen by:
•***Pop-Up Windows
•***Pop-Up Slider Windows
•***Embedded Ads
•***Desktop icons and installation files that may be placed on your computer for you to link to other products and services. " }-
So it displays ads. What else is new?
Well according to the "privacy disclosure statement" portion of the document, KeenValue collects the following information:
•***Web sites/pages viewed
•***The amount of time spent at some Web sites
•***Response to the Advertisements displayed
•***Standard web log information including IP address and system settings
•***What software is on your personal computer
•***Your first and last name, country, and five digit ZIP code
•***Your usage characteristics and preferences
Not only that, but the privacy policy actually states KeenValue may READ THE CONTENTS OF THIRD-PARTY COOKIES STORED ON YOUR MACHINE, and may also INSTALL "certain rich media player applications, browser plug-ins, virtual machines, and runtime environments" without your knowledge.
Known Distribution Sites: KeenValue may be installed through downloads from any of the following sites:
myfreecursors.com
thunderdownloads.com
crazymates.com
There may also be many other methods of distribution that are not yet known. It is highly recommended that users stay away from the above sites.
Protection: A database update was released today (5/04/2003) for SpywareBlaster (http://www.wilderssecurity.net/spywareblaster.html) that covers 16 variants of KeenValue. Adding the sites listed above to the restricted zone in Internet Explorer should also help prevent the installation of KeenValue (blocking them using the hosts file is another recommended method).
Responsible Parties: It seems as though eUniverse, Inc. (euniverse.com) is responsible for KeenValue, as well as the ThunderDownloads site, and possibly the MyFreeCursors site (all of the downloads there are digitally signed by eUniverse).
Best regards,
-Javacool
Last Updated: May 4, 2003
Background: MyFreeCursors.com offers an “easy cursor change service”. By clicking on a cursor that a user wants, the site will attempt to download and run an installer using ActiveX. This installer not only installs the cursor, but may install the following three applications:
n-CASE
iGetNet
KeenValue
The focus of this advisory is the KeenValue program.
Details: The hard-to-find privacy policy, located (among many places) at myfreecursors.com/privacy/ , details some alarming characteristics of the KeenValue program. Supposedly, KeenValue "provides you with the ability to obtain advertiser-supported versions of software applications (valued at up to $30) free-of-charge or at a reduced cost"… but take a look at the following sections of the "privacy policy" / terms of use:
-{ Quote: "Delivery of KeenValue Advertising
Advertisements are delivered to your computer screen by:
•***Pop-Up Windows
•***Pop-Up Slider Windows
•***Embedded Ads
•***Desktop icons and installation files that may be placed on your computer for you to link to other products and services. " }-
So it displays ads. What else is new?
Well according to the "privacy disclosure statement" portion of the document, KeenValue collects the following information:
•***Web sites/pages viewed
•***The amount of time spent at some Web sites
•***Response to the Advertisements displayed
•***Standard web log information including IP address and system settings
•***What software is on your personal computer
•***Your first and last name, country, and five digit ZIP code
•***Your usage characteristics and preferences
Not only that, but the privacy policy actually states KeenValue may READ THE CONTENTS OF THIRD-PARTY COOKIES STORED ON YOUR MACHINE, and may also INSTALL "certain rich media player applications, browser plug-ins, virtual machines, and runtime environments" without your knowledge.
Known Distribution Sites: KeenValue may be installed through downloads from any of the following sites:
myfreecursors.com
thunderdownloads.com
crazymates.com
There may also be many other methods of distribution that are not yet known. It is highly recommended that users stay away from the above sites.
Protection: A database update was released today (5/04/2003) for SpywareBlaster (http://www.wilderssecurity.net/spywareblaster.html) that covers 16 variants of KeenValue. Adding the sites listed above to the restricted zone in Internet Explorer should also help prevent the installation of KeenValue (blocking them using the hosts file is another recommended method).
Responsible Parties: It seems as though eUniverse, Inc. (euniverse.com) is responsible for KeenValue, as well as the ThunderDownloads site, and possibly the MyFreeCursors site (all of the downloads there are digitally signed by eUniverse).
Best regards,
-Javacool