November 14th, 2005
More Enternet Media, their deceptive practices continue
Last week the FTC announced their complaint against Enternet Media for distributing spyware. The charges include using deceptive installation practices, deceptive representations of software code, unfair installation of software code, furnishing to others code that interferes with consumers’ use of their computers and failure to disclose presence and nature of bundled software. An affiliate, Nicholas Albert, was also named as a defendant. A temporary restraining order was issued to stop Enternet Media and all named defendants from the following activities:
publishing, disseminating, distributing, installing, or downloading software code that interferes with consumers’ computer use, including but not limited to softare code that:
tracks consumers’ Internet activity;
changes consumers’ preferred Internet homepage settings;
inserts a new toolbar onto consumers’ Internet browsers;
inserts a large side "frame" or "window" onto consumers’
browser windows that in turn displays advertisements;
displays numerous "pop up" advertisements on consumers;
computer screens, even when consumers’ Internet browsers are closed
Apparently some folks associated with Enternet Media didn’t get the message because spyware expert and owner of Kephyr.com, Roger Karlsson, emailed me on Saturday about an installation he had just witnessed showing none other than Enternet Media’s software being installed with no notice or consent. Roger has a write up about it at his site with excellent documentation including a video (Windows Media file) showing the installation of SearchMiracle/Elitebar from a game site, lookoutsoft.net. A HijackThis log is also posted showing this entry O4 - HKLM\..\Run: [System service79] C:\WINDOWS\etb\pokapoka79.exe. Pokapoka79.exe is a known file from the SearchMiracle/Elitebar infection. Roger noted that he first documented this installation in June.
Alex Eckelberry of SunbeltBLOG tested the same website and blogged about it here. Alex posted screenshots and noted that his installation included not only the SearchMiracle/Elitebar infection, but he also got what he called an "instant mess" including 180searchAssistant and Internet Optimizer. Ugh. All with absolutely NO notice and NO consent. Way to go, guys. Alex’s suggestion — an email to the folks at lookoutsoft.net from their contact page.
