SPYWARE ALERT: MyFreeCursors.com - KeenValue

SPYWARE ALERT: MyFreeCursors.com - KeenValue

Last Updated: May 4, 2003

Background: MyFreeCursors.com offers an “easy cursor change service”. By clicking on a cursor that a user wants, the site will attempt to download and run an installer using ActiveX. This installer not only installs the cursor, but may install the following three applications:
n-CASE
iGetNet
KeenValue

The focus of this advisory is the KeenValue program.

Details: The hard-to-find privacy policy, located (among many places) at myfreecursors.com/privacy/ , details some alarming characteristics of the KeenValue program. Supposedly, KeenValue "provides you with the ability to obtain advertiser-supported versions of software applications (valued at up to $30) free-of-charge or at a reduced cost"… but take a look at the following sections of the "privacy policy" / terms of use:

So it displays ads. What else is new?

Well according to the "privacy disclosure statement" portion of the document, KeenValue collects the following information:

•   Web sites/pages viewed
•   The amount of time spent at some Web sites
•   Response to the Advertisements displayed
•   Standard web log information including IP address and system settings
•   What software is on your personal computer
•   Your first and last name, country, and five digit ZIP code
•   Your usage characteristics and preferences

Not only that, but the privacy policy actually states KeenValue may READ THE CONTENTS OF THIRD-PARTY COOKIES STORED ON YOUR MACHINE, and may also INSTALL "certain rich media player applications, browser plug-ins, virtual machines, and runtime environments" without your knowledge.

Known Distribution Sites: KeenValue may be installed through downloads from any of the following sites:
myfreecursors.com
thunderdownloads.com
crazymates.com

There may also be many other methods of distribution that are not yet known. It is highly recommended that users stay away from the above sites.

Protection: A database update was released today (5/04/2003) for SpywareBlaster that covers 16 variants of KeenValue. Adding the sites listed above to the restricted zone in Internet Explorer should also help prevent the installation of KeenValue (blocking them using the hosts file is another recommended method).

Responsible Parties: It seems as though eUniverse, Inc. (euniverse.com) is responsible for KeenValue, as well as the ThunderDownloads site, and possibly the MyFreeCursors site (all of the downloads there are digitally signed by eUniverse).

Best regards,

-Javacool

 

The latest information on this particular program can always be found at:

http://www.wilderssecurity.net/specialinfo/keenvalue.html

Best regards,

-Javacool

 

I downloaded MyFreeCursors.com and did not know that other programs would be added such as Keenvalue, and I think it was a popup program. My question is how can I keep my cursors with out the other programs as they are very interfering and I do not want them can you help me through what ever process it may take to accomplish this. The only thing I can think is to remove all programs.......thank you in advance

 

Hi jeannie,

Please go to http://www.tomcoyote.org/hjt/, and download 'Hijack This!'.
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log as a .txt file, and copy and paste its contents into your next post.

Most of what it lists will be harmless, so do not fix anything yet.

Regards,

Pieter