For users of Spyware Eliminator by Aluria Software

It's time for you to find a new product!

In a surprising and unpopular move, the maker of Spyware Eliminator, Aluria
Software, has announced that they have entered into a partnership with
WhenU.com, a well-known adware company.

There are three separate but related events that have occurred here. First,
presumably Aluria Software has removed Whenu.com's software from the
targeting database of their Spyware Eliminator product. That means that WhenU
software no longer will be flagged for users of Spyware Eliminator. If those
people are among the nearly 90% of "users" who don't even realize WhenU's
software is installed on their computer, they may not know that it is there
until it begins popping up advertisement windows.

The second issue is that Aluria has certified WhenU.com and their software
as "spyware free" with a certification program the company maintains. Aluria
began this program several months ago.

I always have been of the opinion that trying to maintain a list of software
or web sites free of spyware is a lost cause. That list would need to be
updated on a daily basis and might lead to expensive and pointless lawsuits.

Many people disagree that WhenU's software should be certified as "spyware
free". Earlier this year, Ben Edelman published a study showing that WhenU
software transmits the web address of the page a person is visiting when
something on that page triggers a WhenU advertisement.

This behavior was inconsistent with WhenU's privacy policy which stated that
URLs would not be transmitted to any party. Edelman's study was mentioned by
panelist Chris Hoofnagle of the Electronic Privacy Information Center during
the FTC's spyware workshop in April of this year.

Not long after this study was publicized, WhenU.com updated their privacy
policy to be more consistent with the behavior of the software. I think most
people would have preferred that the software's behavior be updated to be
consistent with the privacy policy.

The last issue is one that has caused a blizzard of bad publicity both for
Aluria and WhenU and has led several antispyware groups, including
SpywareInfo.com, to denounce Aluria. Aluria has entered a partnership in
which Aluria Software and WhenU.com will develop software together. These two
companies now are business partners.

WhenU.com now distributes a program called Ucontrol Scanner, powered by
software from Aluria and branded by WhenU, that works as an antispyware
scanner. WhenU and Aluria now are in the questionable position of targeting
competing adware programs.

Also, WhenU has released another program called WhenUSearch Toolbar which
incorporates into it the scanning engine from Aluria Spyware Eliminator. If
Eric Howes will excuse me for quoting him, "It now appears that the Aluria
scanner is actually bundled or integrated into the WhenUSearch Toolbar. In
other words, by removing the WhenUSearch toolbar, other anti-spyware vendors
will effectively be removing a competing anti-spyware product."

Some experts are predicting that this whole situation will lead to lawsuits
for unfair competition.

The first two issues are disturbing enough. Certainly they led to much anger
in the antispyware community and made me question personally whether I wanted
to continue to promote Aluria's software on SpywareInfo. The last issue,
Aluria forming a partnership with WhenU, decided the question for me.

For some time WhenU has been trying to portray itself as a company
undergoing positive changes. Recently their outspoken CEO Avi Naider stepped
down to make way for a new man. WhenU claims to have stopped using ActiveX
installers, the infamous so-called "drive by download" technique. Probably
this was due in large part to the fact that ActiveX installation of software
has become more difficult with the recent security updates to Windows XP.

Aluria says it has based its decision on their belief that WhenU has cleaned
up its act, that it is now one of the good guys. Certainly no one objects to
a company cleaning up its act. There have been several adware or spyware
companies which formerly were labeled as one of the bad guys who reformed
their behavior. The software of most of those companies have been removed as
targets from antispyware scanners. I'll discuss some of those cases later in
this newsletter.

The problem here is that Aluria has gone way too far way too soon. Not that
I am conceding that WhenU has cleaned up its act but, for the sake of
argument, let's say that they have. Let's assume that WhenU has made a
complete reversal of its practices and truly is one of the good guys now.
Even with this change, it is still outrageous for Aluria to form a
partnership with them so soon.

While it is good when a bad company changes their ways, you have to monitor
that company for a while to make sure they stay committed to their change.

New.net (or NewDotNet) was targeted by Lavasoft's Ad-aware back in 2001.
There were several reasons for this, including questionable distribution
policies, lack of disclosure and an uninstaller that simply did not work.

After long, contentious and heated discussions, the software was updated to
address the concerns that people had with it. Not everyone was convinced but
the changes were good enough for Lavasoft. They made the decision to delist
New.net's software - with the understanding that they would be watching it
closely.

About a year later, New.net released new software which clearly was adware
and which people felt was being installed with inadequate disclosure and with
no way to opt-out of installing it. It was a backslide from their earlier
decision to stay on the straight and narrow and may have played a part in
Lavasoft's decision in 2003 to retarget New.net. Apparently the idea came
from New.net's marketing department and was unpopular even within the
company. It was withdrawn quickly and the project was ended.

New.net is a good example of a bad company willing to change its ways. It
also is a good example of why you must continue to keep an eye on the former
bad guys. Had Lavasoft entered into some kind of partnership with New.net,
they would have looked pretty stupid a year later when New.net slid backwards
briefly. What is Aluria going to do if ever the day arrives when WhenU
decides they aren't making enough money and goes back to their old ways?

Aluria's questionable decision has earned them the denouncement of nearly
all of the antispyware community. Aluria has been expelled from ASAP, a group
of antispyware message board sites formed earlier this year in response to
the denial of service attacks on SpywareInfo, TomCoyote and Net-Integration.

Many web sites in the antispyware community are removing Aluria from their
list of recommended spyware cleaners. The Ucontrol Scanner may well end up
being listed as a rogue application on the Spyware Warrior web site. It is
even possible that Aluria may find itself listed there, although I wouldn't
support that decision.

I have made the decision to delist Aluria's software from my list of
recommended software and no longer will promote it here, something which I
have done many times in the past. I also made the decision to revoke Aluria's
access to my private mailing list for antispyware researchers and developers
as well as to the large collection of malware files that I maintain. Given
Aluria's partnership with WhenU, I am unwilling to risk giving WhenU access
to these resources. If that partnership were to end, I probably would
reinstate their access.

The entire situation is very sad. I like Aluria and I like their antispyware
program. I've recommended and promoted it here in this newsletter several
times in the past. I have friends that work there. I've put my own
credibility on the line more than once to defend the company from accusations
of wrongdoing.

My relationship with this company soured quickly after word of the WhenU
partnership came out. I even received a harassing email from their CTO at one
point. I thought it was a prank at first but it turned out that it was really
their CTO writing to insult me and make threats.

It is with profound and sincere regret that I say goodbye to Aluria. Our
long and friendly relationship is over.

Links:
http://pcpitstop.com/spycheck/whenu.asp :: WhenU Survey at PCPitstop
http://www.benedelman.org/spyware/whenu-privacy/ :: WhenU Violates Own
Privacy Policy
https://netfiles.uiuc.edu/ehowes/www/main-nf.htm :: Eric Howes' Privacy Web
Site
http://asap.maddoktor2.com/ :: ASAP
http://www.dslreports.com/forum/rema...3816~mode=flat :: WhenU Enters
the Anti-Spyware Market
http://www.spywareinfo.net/mar26,2004#aluria :: Some bad business at
Aluriasoftware