Spyware, viruses, & security forum: Screensaver on Download.com contains Adware/Malware

If you find a program available on Cnet's download.com that contains malware or is otherwise harmful to your computer, you can submit an alert to the download.com technical department by clicking here. Provided you give them the required information, they should then reevaluate the software and determine if it meets the download.com standards. If it doesn't, it will be removed from the site until the developer corrects the issues.

Hope this helps.

try this link:

http://cnet.custhelp.com/cgi-bin/cnet.cfg/php/enduser/std_alp.php?p_sid=-RT18hki&p_lva=&p_li=&p_new_search=&p_accessibility=0&p_srch=&p_sort_by=&p_gridsort=&p_row_cnt=167&p_prods=&p_cats=&p_pv=&p_cv=&p_search_type=answers.search_fnl&p_nav=&p_li=&p_page_head=1&p_page=1&p_page_foot=1

You have to LOG IN !!

You then only have to look for "Download.com"

Thanks for your help... After much searching, I found the right page (they don't make it easy do they?) before your last post. I did file a report and they already got back to me on this.

What cracks me up is that this screensaver was featured in the "Dispatch"... LOL I would think they would check this stuff out before they advertise it.

Thanks for your help!

John

I was first alerted to this through a friend of mine's newsletter "Cliff Notes Newsletter", in his latest edition:
http://freewarewiki.com/ClifsCurrentNewsletter

He sites SiteAdvisors review of the download.com links for the software, along with his own results:

http://www.siteadvisor.com/sites/screensavers.com
http://www.siteadvisor.com/sites/easyscreensavers.com
http://www.siteadvisor.com/sites/smileycentral.com

You can contact Cliff through the site for addition info...

As for CNet's response:

Hi John,

Thank you for taking the time to write us and thanks for the heads up.

I'll forward your comments onto our processing team who will investigate your claim and take action as appropriate. To help ensure that CNET Download.com Library has the most up-to-date information and is functioning the way we intended, we download, install, and test products submitted to our library to verify that they meet our extensive list of submission requirements. Occasionally certain problems may slip by and so we really appreciate all the help we can get ensuring that our library is trusted, safe, and secure.

Sincerely,

Arturo
Customer Service
CNET Membership & Loyalty

This came just a few hours after I submitted it...I have to admit that is great customer service!

John

Thank you for your help!

I "think", the "Cnet bug" has bitten

I reported this to the Download.com team --if it comes up

positive it will be removed.

Thanks for bringing this to our attention.

-Lee

http://reviews.cnet.com/5208-6132-0.html?forumID=32&threadID=212932&messageID=2270368

I scanned the screensaver with several security programs and most declared it harmless, and after installation no damage was done nor was any malware found. As a result, I e-mailed Ewido Networks yesterday since they were the first to detect "Dropper.Agent.hl" in the installer, and asked them to review the identification.

This morning I received a response stating that it was indeed a false positive, and that the screensaver did not contain any malware. Ewido updated their signatures a little over an hour ago to correct this issue and Ewido/AVG Anti-spyware no longer identifies it as posing a threat.

Given this revision, I'm sending an e-mail to the download.com team asking that they re-evaluate this download based on the updated definitions/signatures in hopes that they will clear it for resubmission to download.com.

If any other malware scanners (aside from Ewido) are identifying the "Gorgeous Fall Foliage Screensaver" as malware please name them here so that the screensaver may be re-evaluated by the respective companies and the signatures/definitions may be revised as necessary.

Thanks!
John

I can't go into the details, but the particular trojan (Dropper.Agent.hl) that Ewido detected in the screensaver downloaded from download.com was indeed a false positive, confirmed and addressed by Ewido Networks. Other considerations, though, have come into play. That's all I can say.

John