AFP Testing Highlights contain basic, less detailed information from our full blown testing. All content is original and supporting documentation is on file.
How much money would it take for you to trash someone’s computer? Hopefully most would answer, “There’s not enough money in the world!” In reality, there are people out there who will do just that for thirty cents. Yes, you heard me right. They will most likely ruin someone’s computer for a mere thirty cents. If you happen to live outside of the US, then they will do it for as little as two cents. Step into the world of DollarRevenue……………
My focus of research is sorting out how money is made by the various adware applications. I ‘sniff’ at the money trail, so to speak. However, you need the apps to test them. I learned a long time ago that applications could behave differently when installed from the adware company’s official site or a version from the wild. So I periodically go hunting in the wild. I thought I would share this particular hunting experience.
I was hunting for one particular application. While I did capture that one app, I caught quite a bit more. My adventure starts on a web page promising a free video of two celebrities engaging in a bit of errrrmmm…extracurricular activities. There are very clear instructions to “Click on the image above to run the movie.” One click from the promise of watching celebrity sex and all hell breaks loose on the end user’s computer. First, there is no video. When you click to watch the movie, you get the windows prompt asking do you want to Save or Run the .exe file. The promise of watching celeb sex continues with the file named “anna_enrique_lovemaking”. When you run the file (in the hopes of watching the movie), nothing happens. I have to wonder how many people click and run the file more than once trying to see the movie. At least nothing appears to happen. The file isn’t a movie but in reality is an installer for DollarRevenue.
What is DollarRevenue? It is a bundler. Bundlers aren’t adware themselves (although some bundlers may have an adware part in their programming as well). What they do is ‘bundle’ several installations for different adware applications into one file. By running the one bundler program, all the adware applications they are ‘bundling’ are installed. The adware/spyware/malware companies pay DollarRevenue to install their software for them. In turn, DollarRevenue pays distributors (I refuse to call them affiliates because they give the term affiliates a bad name) thirty cents every time their bundler application is installed. In this case, the owner of the celeb video site was paid thirty cents when I ran the file, which was supposed to be a video.
Now the real nightmare begins for anyone running the supposed movie clip. DollarRevenue’s bundler application immediately gets busy installing numerous adware programs in rapid succession. At no point do I receive a Window’s prompt that a program is attempting to install. I never receive any type of EULA (end user’s license agreement) for any of the programs installing (including DollarRevenue). At no time was any type of installation wizard launched providing me with the option of terminating the installation. In fact, there is programming in the DollarRevenue installation files to ensure the bundled adware installs ‘silently’. This is what I call stealth installations.
The only indication that something unsavory is happening to my computer is the immediate bombardment of prompts I started receiving from ZoneAlarm that numerous (and I mean numerous) files were attempting to access the Internet. For those who may think that ZoneAlarm caught the adware and prevented a problem, think again. Because the prompts only come when a file on the computer is trying to access another computer somewhere out in cyberland. That means that the file is already installed on your computer. To add even more insult to injury, some of the applications installed by DollarRevenue were bundlers themselves. This means that they in turn immediately began installing all their own bundled adware applications. In some cases, DollarRevenue had already installed these adware programs. I call the phenomenon of bundlers installing bundlers which install bundlers the “trickle to a waterfall” effect.
Within just a couple of minutes of the first adware app installing, I began receiving numerous pop up ads. This is probably the first sign for most end users that they made a critical bad click and something has gone terribly wrong. Some of the adware installed deliver three and four pop ups at a time. In less than 5 minutes from clicking on the “Run” button to watch the movie clip, I’m getting bombarded with pop ups while numerous files are trying to access the Internet at the same time, large quantities of data is being downloaded onto my computer by all the different adware and more programs are trying to install themselves. The inevitable begins to happen. My system resources begin to max out and the computer becomes sluggish. The signs and symptoms of system overload and melt down begin to manifest. Browser windows will not close. Task Manager will not open. I’m getting run time error messages for different adware. And no, I don’t normally have a completely black desktop. I allow this to go on for about thirty minutes. By this time, my Operating System is very unstable and for all practical purposes unresponsive. It took quite a bit of patience just to shut the computer down using Windows shutdown process. Adware was still attempting to install on the computer (half an hour later) when I shut the computer down. So what did I get instead of my expected movie? I got at least twenty-one adware applications. I say at least because I’m still reviewing all the installation logs and sorting out who installed what. So it’s 21 applications that I’ve verified. There are definitely more that did install or attempted to install (failed installs as the systems became more unstable). None installed with consent or any type of notification. And there is no way the end user will have a viable functioning computer with 21 adware applications installed on it. Reformat the hard drive comes to mind. I know, I know…adware keeps the Internet free and brings value to the end user’s online experience. So we’ve been told. From a researcher’s perspective, this was a somewhat efficient venture. One stop shopping for lots of baddies to test. For 99.999999% of everybody else clicking on that link, I would imagine it’s a living nightmare. As I mentioned, my research focus is determining how adware applications generate their revenue and the impact this has on online advertising and marketing. That will be my follow-up post to this installation story.
