Balloons are for Clowns...and Spyware
by Chris Boyd, Wayne Porter
A recent find by Roger Karlsson highlighted a large Adware bundle from Lookousoft.net, which is covered here by Sunbelt Software. The software in question
(a modified version of "Hangman") installs
numerous pieces of advertising software without consent or displaying a EULA of any kind. All you see is a typical installer page -
Once the install is complete, the adware begins to install itself onto the end-user's PC, with numerous files including 180 Search Assistant, Internet Optimizer and Media Gateway, along with some other entries named Pokapoka79, WinTask Ad and cvwnqzap.exe.
Searchmiracle Toolbar, currently in hot water with the FTC, is also included, and because the toolbar is unbranded, the end-user will naturally wish to check the help files, to see who it is from. However, when selecting the help file option, the end-user is presented
with a "Page not found" link.
Worse still, using the "uninstall" link from the toolbar pops up a "thank you" message - but the toolbar does not actually uninistall, remaining on the system.
As we can see from the above screenshot, with the obvious exception of taskmgr.exe (which we are using to view running processes), the files installed from this bundle place a potentially considerable load on a mid-range PC, especially if other applications are running when the install takes place.
And why, you might ask, is Internet Explorer taking up 45,312k of memory usage?
The answer is right
noted this article is Copyright © 2017
by FaceTime Communications, Inc. This article may not be resold,
reprinted, or redistributed for compensation of any kind without
prior written permission from FaceTime
Communications, Inc. For reprint or media inquires please contact
us with the phrase "Spyware
Guide Articles" in the subject line and we will by happy
to assist you. Links to this article from other websites are appreciated
and encouraged. Users are also encouraged to utilize our RSS
system to provide unique content and extracts for their site.
Read other articles (back to