{"id":3994,"date":"2012-03-08T11:29:18","date_gmt":"2012-03-08T16:29:18","guid":{"rendered":"http:\/\/thundercloud.net\/infoave\/new\/?p=3994"},"modified":"2012-03-08T11:39:33","modified_gmt":"2012-03-08T16:39:33","slug":"interactive-corp-iac-uses-the-bible-to-lure-users-into-installing-malware","status":"publish","type":"post","link":"https:\/\/www.thundercloud.net\/infoave\/new\/interactive-corp-iac-uses-the-bible-to-lure-users-into-installing-malware\/","title":{"rendered":"Interactive Corp. (IAC) Uses The Bible To Lure Users Into Installing Malware"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-thumbnail wp-image-3995\" title=\"IAC USES THE BIBLE TO LURE USERS INTO INSTALLING MALWARE\" src=\"http:\/\/thundercloud.net\/infoave\/new\/wp-content\/uploads\/2012\/03\/aspy-150x150.jpg\" alt=\"IAC USES THE BIBLE TO LURE USERS INTO INSTALLING MALWARE\" width=\"150\" height=\"150\" \/>Interactive Corp&#8217;s (IAC) FunWebProducts has consistently denied their bundle of software (FunWebProducts) \u00a0is spyware or adware. We&#8217;re not going to argue what it is. What we can tell you is this: products from Interactive&#8217;s FunWebProducts has caused many users \u00a0serious computer problems.<\/p>\n<p>We have repaired a lot of computers helping PC users via our <span style=\"text-decoration: underline;\"><a href=\"http:\/\/thundercloud.net\/direct\/\">Cloudeight Direct Computer Care<\/a><\/span> service. We \u00a0can tell you from our own experience &#8211; FunWebProducts causes many computer problems. Aside from hijacking your searches and your browser&#8217;s start page, FunWebProducts spawns pop-ups which seemingly appear out of nowhere, and it&#8217;s hard for computer users to find out exactly where they&#8217;re coming from.<\/p>\n<p>FunWebProducts makes numerous changes to your computers registry as well as to other files and folders. And if all that wasn&#8217;t bad enough, when users install this collection of software, they, by default give permission to the software to &#8220;check for and download updates&#8221; (this happens without the user&#8217;s specific knowledge or consent). Users aren&#8217;t aware that these &#8220;updates&#8221; can mean updates or it can mean that more programs will be added to their computer. The FunWebProducts bundle currently contains more than a dozen applications &#8211; and you get them all when you install any one of the FunWebProducts&#8217; program.<\/p>\n<p>Webfetti, Zwinky, Smiley Central, Cursor Mania, Popular Screensavers, My Fun Cards among others. But one not mentioned which is the backbone of the FunWebProducts bundle is MyWebSearch (toolbar).  And very few people know that the company behind FunWebProduct also owns Ask. com (Ask.com toolbar is installed by many freeware bundles), iWon, Excite, Evite, Bloglines, MyWay, and others.<\/p>\n<p>Regardless what users download, whether it is Zwinky, Cursor Mania, Smiley Central, etc., they get the MyWebSearch Toolbar &#8211; and all of the following (this was obtained from the <a href=\"http:\/\/info.zwinky.com\/zwinkyinfo\/eula.jhtml\">privacy policy for Zwinky <\/a>,\u00a0and it&#8217;s the same policy you will see if you downloaded any of the other programs):<\/p>\n<p>&#8220;&#8230;Features of the MyWebSearch Toolbar<\/p>\n<p>By downloading the MyWebSearch toolbar, you will be installing a toolbar in your Internet browser (and any supported email functions and instant messenger functions) with the following features:<\/p>\n<p>SEARCH BOX: This is a search box located within the toolbar that will help you search the Internet with search results from Ask.com.<br \/>\nSEARCH ASSISTANT: This provides relevant links and results when you make a search request in your browser address bar or if your browser address (DNS) request is invalid, misspelled or incorrectly formatted.<br \/>\nWEBFETTI:This feature enables you to customize a social networking profile page with layouts, graphics, custom cursors, music and video.<br \/>\nZWINKY: This feature allows you to create and modify avatar characters, and use them in a social networking environment. If you use Windows XP, the ZWINKY feature will also automatically provide you with an icon that will appear in your Windows XP system tray at the bottom right of your desktop. Use of the Zwinky feature is subject to separate terms of use at http:\/\/info.zwinky.com\/zwinkyinfo\/tos.jhtml.<br \/>\nSMILEY CENTRAL: This allows you to insert smiley face emoticons and other graphics into your web-mail, Outlook, Outlook Express and instant messages.<br \/>\nPOPULAR SCREENSAVERS: This provides you with photos and images that can be added to the user&#8217;s screensaver or PC desktop wallpaper. Also includes the ability to add personal digital photos.<br \/>\nMY FUN CARDS: This provides access to free electronic greeting cards that you can personalize on the Web and send to any email address.<br \/>\nCURSOR MANIA: Free computer mouse cursors that allow the user to change the look of his\/her default cursor to something more fun and expressive.<br \/>\nFUN BUDDY ICONS: Free icons that can be added to an instant messenger client.<br \/>\nHISTORY SWATTER: This allows you to delete easily computer cookies, URL history, temporary cache, and other stored browser files.<br \/>\nPOP SWATTER: Free tool that swats pop-up ads before they appear. Includes a &#8220;Safe List&#8221; to allow pop-ups from user-specified web pages.<br \/>\nSMOTOS: This enables you to post, upload, share, download and store images, and allows you to send such images to email addresses of your choice.<br \/>\nMY INFO: This provides one-click access to news, sports, weather, finances, horoscope, movie listings, lottery results and more, which appear in a thin window to the immediate left of your main browser window.<br \/>\nMY MAIL NOTIFIER: This allows you to use animated characters to alert you to new web mail messages.<br \/>\nMY MAIL SIGNATURE: This allows you to create signature designs to place in the footer of outgoing email messages.<br \/>\nMY MAIL STAMP: This allows you to insert digital stamp designs into outgoing emails.<br \/>\nMY MAIL STATIONERY: This provides you with background images, colors and themes to enhance the look of outgoing email messages.<\/p>\n<p>In addition, an Easy Installer will be downloaded to install this software. It does not install any other software and is automatically deleted the first time you turn off your computer after installation of the above-described products.<\/p>\n<p>You will also have access to websites related with the software described above, (the &#8220;Websites&#8221;).<\/p>\n<p>THE TOOLBAR AND ALL ITS FEATURES LISTED ABOVE ARE FREE&#8230;&#8221;<\/p>\n<p>All those programs download and install with the so-called &#8220;Easy Installer&#8221;.<\/p>\n<p>But there&#8217;s one product that IAC\/FunWebProducts distributes that we were not aware of until yesterday. It&#8217;s called DailyBibleStudy toolbar. We found out about it after scheduling an appointment with a lady who was constantly being bombarded by popup every time she opened Windows Live Mail and sometimes her browser.<\/p>\n<p>The first thing we did &#8211; is what we alway do when we help someone with their computer &#8212; we looked at their process, RAM, and services. We saw nothing going on in the processes or services &#8212; and this lady&#8217;s computer had plenty of RAM. We did notice that she had DailyBibleStudy running in several process and in her computer&#8217;s running services. Because we assumed that no one would stoop so low as to use the Bible to install malware on a computer &#8212; we never suspected DailyBibleGuide or DailyBibleStudy.<\/p>\n<p>Still we couldn&#8217;t explain the popups that appeared when she opened Windows Live Mail. We knew there had to be adware or spyware or malware lurking &#8212; but we saw nothing unusual going on in her computer&#8217;s processes or services. We&#8217;ve repaired so many computers by now we can usually tell by looking at processes and services if malware is the problem. But other than DailyBibleStudy and DailyBibleGuide &#8211; we saw nothing out of the ordinary. What kind of scumbag company would lure users into installing malware using The Bible? IAC\/FunWebProducts &#8211; that&#8217;s who.<\/p>\n<p>We ran Malwarebytes on our customer&#8217;s computer &#8212; and this is a copy of the scan log from Malwarebytes:<\/p>\n<p>Malwarebytes Anti-Malware 1.60.1.1000<br \/>\nwww.malwarebytes.org<\/p>\n<p>Database version: v2012.03.07.03<\/p>\n<p>Windows 7 Service Pack 1 x64 NTFS<br \/>\nInternet Explorer 8.0.7601.17514<\/p>\n<p>3\/7\/2012 9:12:25 AM<br \/>\nmbam-log-2012-03-07 (09-31-25).txt<\/p>\n<p>Scan type: Quick scan<br \/>\nScan options enabled: Memory | Startup | Registry | File System | Heuristics\/Extra | Heuristics\/Shuriken | PUP | PUM<br \/>\nScan options disabled: P2P<br \/>\nObjects scanned: 303867<br \/>\nTime elapsed: 13 minute(s), 18 second(s)<\/p>\n<p>Memory Processes Detected: 2<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vbrmon.exe (Adware.MyWebSearch) -&gt; 3104 -&gt; No action taken.<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vbrmon.exe (Adware.MyWebSearch) -&gt; 7424 -&gt; No action taken.<\/p>\n<p>Memory Modules Detected: 1<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vbrstub.dll (Adware.MyWebSearch) -&gt; No action taken.<\/p>\n<p>Registry Keys Detected: 13<br \/>\nHKLM\\SYSTEM\\CurrentControlSet\\Services\\DailyBibleGuideService (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCR\\CLSID\\{0631bff0-6846-48ca-982d-d62d7f376e97} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\{0631BFF0-6846-48CA-982D-D62D7F376E97} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\{0631BFF0-6846-48CA-982D-D62D7F376E97} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{0631BFF0-6846-48CA-982D-D62D7F376E97} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCR\\CLSID\\{2a942ab7-2073-49bc-a7e1-77e93835889a} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\{2A942AB7-2073-49BC-A7E1-77E93835889A} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{2A942AB7-2073-49BC-A7E1-77E93835889A} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DailyBibleGuidebar Uninstall (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCR\\CLSID\\{beea7fa9-d1f4-49a2-9b1f-6fb7a2d9bc2a} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects\\{BEEA7FA9-D1F4-49A2-9B1F-6FB7A2D9BC2A} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ext\\Settings\\{BEEA7FA9-D1F4-49A2-9B1F-6FB7A2D9BC2A} (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nHKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\{BEEA7FA9-D1F4-49A2-9B1F-6FB7A2D9BC2A} (Adware.MyWebSearch) -&gt; No action taken.<\/p>\n<p>Registry Values Detected: 4<br \/>\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|DailyBibleGuide Browser Plugin Loader (Adware.MyWebSearch) -&gt; Data: C:\\PROGRA~2\\DAILYB~2\\bar\\1.bin\\2vbrmon.exe -&gt; No action taken.<br \/>\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|DailyBibleGuide Search Scope Monitor (Adware.MyWebSearch) -&gt; Data: &#8220;C:\\PROGRA~2\\DAILYB~2\\bar\\1.bin\\2vsrchmn.exe&#8221; \/m=2 \/w \/h -&gt; No action taken.<br \/>\nHKCU\\SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser|{2A942AB7-2073-49BC-A7E1-77E93835889A} (Adware.MyWebSearch) -&gt; Data: \u00b7*\u201d*s \u00bcI\u00a7\u00e1w\u00e985\u02c6\u0161 -&gt; No action taken.<br \/>\nHKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar|{2A942AB7-2073-49BC-A7E1-77E93835889A} (Adware.MyWebSearch) -&gt; Data:  -&gt; No action taken.<\/p>\n<p>Registry Data Items Detected: 0<br \/>\n(No malicious items detected)<\/p>\n<p>Folders Detected: 0<br \/>\n(No malicious items detected)<\/p>\n<p>Files Detected: 6<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vbrstub.dll (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vbarsvc.exe (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vbrmon.exe (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vSrchMn.exe (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vSrcAs.dll (Adware.MyWebSearch) -&gt; No action taken.<br \/>\nC:\\Program Files (x86)\\DailyBibleGuide\\bar\\1.bin\\2vbar.dll (Adware.MyWebSearch) -&gt; No action taken.<\/p>\n<p>(end)<\/p>\n<p>To see where this DailyBibleGuide (it shows up as DailyBibleGuide and DailyBibleStudyGuide when installed &#8211; but goes by a different name on the Web) comes from &#8211; <a href=\"http:\/\/www.bibletriviatime.com\/index.jhtml\"><span style=\"text-decoration: underline;\">visit this site<\/span><\/a>. (PLEASE DO NOT DOWNLOAD IT!)<\/p>\n<p>We were shocked when we saw the scan. We found it unbelievable &#8211; and in unbelievably poor taste that a large American corporation would stoop to this low of level to lure unsuspecting Christian users into installing this malware. It&#8217;s bad enough using flashing, talking smileys and cutesy graphics to induce young people to install a collection of malware &#8211; but using The Bible &#8211; a sacred book &#8211; to induce Christians into installing malware takes the prize.<\/p>\n<p>We&#8217;re still shocked that The Bible is being used this way by a company like IAC. We&#8217;ve repaired over 200 computers and we&#8217;ve seen the problems IAC&#8217;s FunWebProducts, MyWebSearch and its other software causes. There should be a law against this kind of software &#8212; and this kind of trickery.  We&#8217;ve seen the damage and the problems IAC&#8217;s software bundles can cause.<\/p>\n<p>IAC and its affiliated companies should be ashamed of using The Bible as a lure to encourage Christians to download its malware.<\/p>\n<p>What do you think? Can \u00a0Interactive Corp (IAC) sink any lower than this?<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Interactive Corp&#8217;s (IAC) FunWebProducts has consistently denied their bundle of software (FunWebProducts) \u00a0is spyware or adware. We&#8217;re not going to argue what it is. What we can tell you is this: products from Interactive&#8217;s FunWebProducts has caused many users \u00a0serious computer problems. We have repaired a lot of computers helping PC users via our Cloudeight Direct Computer Care\u2026 <span class=\"read-more\"><a href=\"https:\/\/www.thundercloud.net\/infoave\/new\/interactive-corp-iac-uses-the-bible-to-lure-users-into-installing-malware\/\">Read More &raquo;<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":3995,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1655,1462,1656,1654,10],"tags":[],"_links":{"self":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/3994"}],"collection":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/comments?post=3994"}],"version-history":[{"count":3,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/3994\/revisions"}],"predecessor-version":[{"id":3997,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/3994\/revisions\/3997"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/media\/3995"}],"wp:attachment":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/media?parent=3994"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/categories?post=3994"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/tags?post=3994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}