Webhancer

[Guest]

Hi,

Why does Microsoft AntiSpyware set the recommend action for Webhancer to
"ignore"?

WebHancer is a program that monitors web sites being viewed and sends the
collected data back to webHancer’s servers. You could call me crazy but i
would say that Webhancer is SPYWARE!

Why does Microsoft yet again (remember Claria, WhenU...) ignore such a threat?

 

[Guest]

Hi David,

This downgrade was done aound the same time as Claria was set to ignore,
Webhancer does send information back to their servers so Its right that
Microsoft detects them in the scan which it is at present although like you
say its now set to ignore.

Playing Devils Advocate abit here but there may be a legal issue why
Microsoft are worried about setting it to Remove, If webHancer Corp display
clear Terms of Service or End User Licence Agreements (Even on any bundled
installs) before installation and once installed still provide a easy way for
the user to fully remove the files then it may justify it being set to
Ignore. They do collect details on the web sites viewed but if the user
agrees to install WebHancer then it is done with consent.

You can view their privacy policy here:

http://www.webhancer.com/privacy/

I know most people would say that if the Spyware scanner shows a threat as
ignore then the novice user will leave it in place and I appreciate that view
but on the results page it will still show "webHancer (Spyware)" so Id like
to think most users who use Antispyware would then take a closer look at the
program and decide if they use it and if not then change it to Remove and let
Microsoft Antispyware remove it.

Webhancer can be removed using the Add/Remove Programs screen by removing
either of these:

WebHancer Survey Companion or WebHancer Customer Companion

So I agree it is Spyware and even Microsoft would agree with that as they
will detect it in the scan and label it as Spyware, but if they provide the
user will full details of what it is before installation and then provide a
easy way to uninstall it should the user change their mind at a later date
then I can understand why it has been set to ignore.

 

[Eric L. Howes]

Andy:

Webhancer is frequently foisted on users in circumstances where notice and
disclosure is poor to non-existent.

One example: Webhancer is installed through by "Media Motor," which uses an
ActiveX install sprung on users on confusing circumstances at third-party
web sites (esp. crackz sites). See here for an example:

http://netrn.net/spywareblog/archives/2005/11/24/and-lose-the-balloons/

Note that the ActiveX Security Warning box uses a completely inadequate and
arguably deceptive description of the software to be installed. Still worse,
users must click through to the main Joysticks Network EULA to learn that
advertising will be included in some of the software to be installed, then
scroll to the bottom of the EULA and click AGAIN to get to a supplementary
collection of EULAs from included third-party adware. As noted in my
narration of one of those videos, the presence of Webhancer is disclosed
nowehere, and yet it is still installed:

http://www.spywarewarrior.com/elh/mm-vvsn_1124.txt

Even if Webhancer had been included in that supplementary EULA, that would
have been inadequate notice because the Federal Trade Commission is already
on the record in several cases that burying key terms in a EULA does not
suffice for notice and disclosure.

That's but one example Webhancer installation. Here's another:

http://netrn.net/spywareblog/archives/2005/11/29/anti-spyware-zealot-rants-about-180solutions/

The above documents Webhancer (among many other adware programs) installed
through a security exploit at a cracks site. Note that both of these example
installs were captured in the past few weeks.

The bottom line here is that the mere presence of a EULA somewhere on the
Net that the user could theoretically access is no excuse for the unethical
and even illegal installation practices that have been used to deliver
Webhancer to users' desktops.

If Microsoft has "downgraded" Webhancer, that was an extremely
ill-considered decision -- certainly not one that benefits Microsoft's
customers and users in any way.

Best,

Eric L. Howes

 

[Guest]

Hi Eric,

Thanks for adding your views on this, I should of checked your site before
posting, Id not seen WebHancer installed silently or with little warning
recently so thought maybe they had cleaned up and deserved the downgrade.
I've seen their program SpeedRank and its setup is clear about whats
installing so assumed they were less of a threat these days, your post shows
they are just as bad as the other scum and are clearly taking advantage of
people, hopefully someone from Microsoft will consider changing the
downgrading at some stage after seeing your pages on them.

I understand what you mean about crack/serial & warez sites they will cause
alot of problems without any warning and its especially bad when you show its
happening on wrestling type sites as that will bring into most family homes.

I was on one a few days ago which downloads alot of trojans and spyware if
you press any button on the main page by using ActiveX & exploit scripts, the
sites directory that loads them has over 100 infected files and half are
installers for other infections like the Spysheriff desktop warning installs,
Kill AV trojans, look2me etc..,

The directory is offline now showing page cannot be displayed and
unavailable but the installers are still there to download so they are
probably still tring to infect everyone who visits without strong protection
installed, if WebHancer is involved with these types of sites then they
should be removed as a threat and hard to understand why it was downgraded to
Ignore them.

Thanks again for explaining about WebHancer, It makes it impossible to
defend after reading your pages and watching the video's so Id leave that for
them
hopefully they would consider changing it at some stage or maybe post more
info on why it was set to Ignore.

All The Best

Andy