EAC Download Warnings

[ve3spd]

Today, I decided to download EAC V0.99 prebeta 5from their site at http://www.exactaudiocopy.de/en/index.php/resources/download/ and opted for the digitalworld.de server.  As download started, I received a warning that file "eac-0.99pb5.exe" had been reported as containing links to sites with viruses and other malware.  I tried a download from one of the proposed alternate sources: Main Download Location Europe with the same results.

I opted to download the file and submitted it to Virus Total where one out of 41 virus scanners--Nod32--reported a variant of Win32/Adware.ADON.  I wrongly speculated that this might be a false positive since only 1 scanner reported it.  Consequently, I installed EAC, which launched on intallation termination.  Immediately, My firewall intercepted an outbound communication by a program calle ebayshortcuts.exe.

Conclusion: "eac-0.99pb5.exe" carries an extra payload. I don't know whether this is intentional or not. If it is, a warning and and an option to bail out would have been nice. I don't know either if this payload is a nasty one.  I did a full disk search for a e-bay; ebay and found a bunch of files containing ebay in the name and deleted them all.

My next step will be to launch a full virus scan.

Any information about this payload would be appreciated.

[Mark P. Fishman-2]

According to the "what's new" page, since January 2008 and 0.99pb4:

"Further I have included a desktop and quick launch bar icon in the
installer which link to eBay. As the advertisements on the homepage
dropped by a great amount over the last year, I decided to try to go
this way. I hope that you can understand my decision! Anyway, the icons
are created only on the installation of EAC and their installation can
be easily prevented by deselecting the eBay component within the EAC
installer. The EAC application itself is still completely free from
advertisement or spyware (and will be)!"

So you ought to have been able to prevent the installation of the eBay
stuff. Was there no such option?

-- Mark F.

ve3spd wrote:

> Today, I decided to download EAC V0.99 prebeta 5from their site at http://www.exactaudiocopy.de/en/index.php/resources/download/ and opted for the digitalworld.de server.  As download started, I received a warning that file "eac-0.99pb5.exe" had been reported as containing links to sites with viruses and other malware.  I tried a download from one of the proposed alternate sources: Main Download Location Europe with the same results.
>
> I opted to download the file and submitted it to Virus Total where one out of 41 virus scanners--Nod32--reported a variant of Win32/Adware.ADON.  I wrongly speculated that this might be a false positive since only 1 scanner reported it.  Consequently, I installed EAC, which launched on intallation termination.  Immediately, My firewall intercepted an outbound communication by a program calle ebayshortcuts.exe.
>
> Conclusion: "eac-0.99pb5.exe" carries an extra payload. I don't know whether this is intentional or not. If it is, a warning and and an option to bail out would have been nice. I don't know either if this payload is a nasty one.  I did a full disk search for a e-bay; ebay and found a bunch of files containing ebay in the name and deleted them all.
>
> My next step will be to launch a full virus scan.
>
> Any information about this payload would be appreciated.
>
>
>
> ------------------------------------
>
> Official Exact Audio Copy web site:  http://www.exactaudiocopy.de/
> Yahoo! Groups Links
>
>
>

--

Ohne Musik wäre das Leben unträglich -- Nietzsche

[Fred Maxwell-2]

ve3spd wrote:

"As download started, I received a warning"

 From what?  Kaspersky Antivirus?  Lavasoft Adaware?  AntiVir Personal  
Edition?  Avast?  ClamAV?  A talking unicorn?  We need a bit more  
information.

"Consequently, I installed EAC, which launched on intallation  
termination. Immediately, My firewall intercepted an outbound  
communication by a program calle ebayshortcuts.exe"

During installation, there was an option check-box for 'eBay Icon',  
which was pre-checked. You left it checked, so eBayShortcuts.exe was  
installed.  If you had unchecked the option box , eBayShortcuts.exe  
would not have been installed.

"I did a full disk search for a e-bay; ebay and found a bunch of files  
containing ebay in the name and deleted them all."

Without knowing anything about what they did?  Without examining the  
date that each was written to your disk?  Maybe you should do a full  
disk search for ".exe" and delete all files that have that string in  
their name.

"Conclusion: "eac-0.99pb5.exe" carries an extra payload."

No, it contains optional add-ons that you can choose not to install.  
It told you it was going to install that.  You left the option  
checked.  It installed it.

"Any information about this payload would be appreciated."

See this link:  http://tinyurl.com/22c6t

Regards,
   Fred Maxwell

[ve3spd]

Thank you Mark,

I was worried I had picked up a virus.  I feel better now and I am confident that I have removed most of what was added and can keep EAC.

Richard

--- In eac@..., "Mark P. Fishman" <mfishman@...> wrote:

>
> According to the "what's new" page, since January 2008 and 0.99pb4:
>
> "Further I have included a desktop and quick launch bar icon in the
> installer which link to eBay. As the advertisements on the homepage
> dropped by a great amount over the last year, I decided to try to go
> this way. I hope that you can understand my decision! Anyway, the icons
> are created only on the installation of EAC and their installation can
> be easily prevented by deselecting the eBay component within the EAC
> installer. The EAC application itself is still completely free from
> advertisement or spyware (and will be)!"
>
> So you ought to have been able to prevent the installation of the eBay
> stuff. Was there no such option?
>
> -- Mark F.
>
> ve3spd wrote:
> > Today, I decided to download EAC V0.99 prebeta 5from their site at http://www.exactaudiocopy.de/en/index.php/resources/download/ and opted for the digitalworld.de server.  As download started, I received a warning that file "eac-0.99pb5.exe" had been reported as containing links to sites with viruses and other malware.  I tried a download from one of the proposed alternate sources: Main Download Location Europe with the same results.
> >
> > I opted to download the file and submitted it to Virus Total where one out of 41 virus scanners--Nod32--reported a variant of Win32/Adware.ADON.  I wrongly speculated that this might be a false positive since only 1 scanner reported it.  Consequently, I installed EAC, which launched on intallation termination.  Immediately, My firewall intercepted an outbound communication by a program calle ebayshortcuts.exe.
> >
> > Conclusion: "eac-0.99pb5.exe" carries an extra payload. I don't know whether this is intentional or not. If it is, a warning and and an option to bail out would have been nice. I don't know either if this payload is a nasty one.  I did a full disk search for a e-bay; ebay and found a bunch of files containing ebay in the name and deleted them all.
> >
> > My next step will be to launch a full virus scan.
> >
> > Any information about this payload would be appreciated.
> >
> >
> >
> > ------------------------------------
> >
> > Official Exact Audio Copy web site:  http://www.exactaudiocopy.de/
> > Yahoo! Groups Links
> >
> >
> >
>
> --
>
> Ohne Musik wäre das Leben unträglich -- Nietzsche
>

[ve3spd]

Fred, Thank you for your reply.
Q ::: From what?
A ::: A window popped up.  It bore no mention of the application.
  ::: I tought it might have been a new feature in IE 8.
  ::: I was running Avira as an anti-virus.

C ::: I missed the checkbox and apologize to the author for my comment to the effect that a warning would have been nice.

C ::: Yes the dates and the file types were checked.
      Yes only the files I felt were related were deleted.
      It's not rocket science to equate files named
      eBayShortcuts.exe, eBayShortcuts.pf and eBay.lnk with the
      EBAY_SHORTCUTS_1026.EXE blocked by my firewall.
      I also suppressed the %AppData%\AD ON Multimedia and its
      eBay Shortcuts subdirectory.

C ::: A number of registry keys and values were created or modified by the installation but none seemed related to the eBayShortcuts.
 
C ::: I had also checked the Control Panel Add/Remove programs applet but did not find anything related there.

I thank you for your keen interest.  My concerns have been answered.  I really appreciate EAC and it does a superb job!



--- In eac@..., Fred Maxwell <_EAC_moderator@...> wrote:

>
> ve3spd wrote:
>
> "As download started, I received a warning"
>
>  From what?  Kaspersky Antivirus?  Lavasoft Adaware?  AntiVir Personal  
> Edition?  Avast?  ClamAV?  A talking unicorn?  We need a bit more  
> information.
>
> "Consequently, I installed EAC, which launched on intallation  
> termination. Immediately, My firewall intercepted an outbound  
> communication by a program calle ebayshortcuts.exe"
>
> During installation, there was an option check-box for 'eBay Icon',  
> which was pre-checked. You left it checked, so eBayShortcuts.exe was  
> installed.  If you had unchecked the option box , eBayShortcuts.exe  
> would not have been installed.
>
> "I did a full disk search for a e-bay; ebay and found a bunch of files  
> containing ebay in the name and deleted them all."
>
> Without knowing anything about what they did?  Without examining the  
> date that each was written to your disk?  Maybe you should do a full  
> disk search for ".exe" and delete all files that have that string in  
> their name.
>
> "Conclusion: "eac-0.99pb5.exe" carries an extra payload."
>
> No, it contains optional add-ons that you can choose not to install.  
> It told you it was going to install that.  You left the option  
> checked.  It installed it.
>
> "Any information about this payload would be appreciated."
>
> See this link:  http://tinyurl.com/22c6t
>
> Regards,
>    Fred Maxwell
>

[Fred Maxwell-2]

ve3spd:

I'm sorry that my reply had a somewhat harsh tone, but Andre has  
worked very hard for many years on Exact Audio Copy, generously making  
it available at no charge to all of us.  The suggestion that he might  
have intentionally included some kind of nefarious "payload" was one  
that I felt should be answered in no uncertain terms.

For the benefit of people who inadvertently installed  
ebayshortcuts.exe, I will mention that I have seen positive references  
to the freeware Revo Uninstaller (http://www.revouninstaller.com/).

All of that said, I believe that Andre's decision to include  
ebayshortcuts.exe with Exact Audio Copy was not a good one.  While it  
does not appear to be overtly malicious, it is unlikely to be a  
welcome addition to anyone's computer.  Perhaps if he were to receive  
a few more donations from appreciative users of EAC, he could remove  
this adware that gives him a small income stream.

To that end, I am including a link so that those who benefit from  
Andre's work can show their appreciation with a Paypal donation:

http://www.exactaudiocopy.de/en/index.php/resources/registration/

You can also directly send a payment via PayPal to the email address webmaster@...
.

Regards,
   Fred Maxwell

On Sep 28, 2009, at 10:02 PM, ve3spd wrote:

> Fred, Thank you for your reply.
> Q ::: From what?
> A ::: A window popped up. It bore no mention of the application.
> ::: I tought it might have been a new feature in IE 8.
> ::: I was running Avira as an anti-virus.
>
> C ::: I missed the checkbox and apologize to the author for my  
> comment to the effect that a warning would have been nice.
>
> C ::: Yes the dates and the file types were checked.
> Yes only the files I felt were related were deleted.
> It's not rocket science to equate files named
> eBayShortcuts.exe, eBayShortcuts.pf and eBay.lnk with the
> EBAY_SHORTCUTS_1026.EXE blocked by my firewall.
> I also suppressed the %AppData%\AD ON Multimedia and its
> eBay Shortcuts subdirectory.
>
> C ::: A number of registry keys and values were created or modified  
> by the installation but none seemed related to the eBayShortcuts.
>
> C ::: I had also checked the Control Panel Add/Remove programs  
> applet but did not find anything related there.
>
> I thank you for your keen interest. My concerns have been answered.  
> I really appreciate EAC and it does a superb job!
>
> --- In eac@..., Fred Maxwell <_EAC_moderator@...> wrote:
> >
> > ve3spd wrote:
> >
> > "As download started, I received a warning"
> >
> > From what? Kaspersky Antivirus? Lavasoft Adaware? AntiVir Personal
> > Edition? Avast? ClamAV? A talking unicorn? We need a bit more
> > information.
> >
> > "Consequently, I installed EAC, which launched on intallation
> > termination. Immediately, My firewall intercepted an outbound
> > communication by a program calle ebayshortcuts.exe"
> >
> > During installation, there was an option check-box for 'eBay Icon',
> > which was pre-checked. You left it checked, so eBayShortcuts.exe was
> > installed. If you had unchecked the option box , eBayShortcuts.exe
> > would not have been installed.
> >
> > "I did a full disk search for a e-bay; ebay and found a bunch of  
> files
> > containing ebay in the name and deleted them all."
> >
> > Without knowing anything about what they did? Without examining the
> > date that each was written to your disk? Maybe you should do a full
> > disk search for ".exe" and delete all files that have that string in
> > their name.
> >
> > "Conclusion: "eac-0.99pb5.exe" carries an extra payload."
> >
> > No, it contains optional add-ons that you can choose not to install.
> > It told you it was going to install that. You left the option
> > checked. It installed it.
> >
> > "Any information about this payload would be appreciated."
> >
> > See this link: http://tinyurl.com/22c6t
> >
> > Regards,
> > Fred Maxwell
> >
>

[Mark P. Fishman-2]

Fred -- THANK YOU.

I try to register and support the shareware and freeware that I find to
be useful and that I use a lot. EAC is one of those programs. (ISObuster
is another, as is CDwave.)

It's nice to have the paypal links for EAC.

-- Mark F.

Fred Maxwell wrote:

> ve3spd:
>
> I'm sorry that my reply had a somewhat harsh tone, but Andre has  
> worked very hard for many years on Exact Audio Copy, generously making  
> it available at no charge to all of us.  The suggestion that he might  
> have intentionally included some kind of nefarious "payload" was one  
> that I felt should be answered in no uncertain terms.
>
> For the benefit of people who inadvertently installed  
> ebayshortcuts.exe, I will mention that I have seen positive references  
> to the freeware Revo Uninstaller (http://www.revouninstaller.com/).
>
> All of that said, I believe that Andre's decision to include  
> ebayshortcuts.exe with Exact Audio Copy was not a good one.  While it  
> does not appear to be overtly malicious, it is unlikely to be a  
> welcome addition to anyone's computer.  Perhaps if he were to receive  
> a few more donations from appreciative users of EAC, he could remove  
> this adware that gives him a small income stream.
>
> To that end, I am including a link so that those who benefit from  
> Andre's work can show their appreciation with a Paypal donation:
>
> http://www.exactaudiocopy.de/en/index.php/resources/registration/
>
> You can also directly send a payment via PayPal to the email address webmaster@...
> .
>
> Regards,
>    Fred Maxwell
>
> On Sep 28, 2009, at 10:02 PM, ve3spd wrote:
>
>> Fred, Thank you for your reply.
>> Q ::: From what?
>> A ::: A window popped up. It bore no mention of the application.
>> ::: I tought it might have been a new feature in IE 8.
>> ::: I was running Avira as an anti-virus.
>>
>> C ::: I missed the checkbox and apologize to the author for my  
>> comment to the effect that a warning would have been nice.
>>
>> C ::: Yes the dates and the file types were checked.
>> Yes only the files I felt were related were deleted.
>> It's not rocket science to equate files named
>> eBayShortcuts.exe, eBayShortcuts.pf and eBay.lnk with the
>> EBAY_SHORTCUTS_1026.EXE blocked by my firewall.
>> I also suppressed the %AppData%\AD ON Multimedia and its
>> eBay Shortcuts subdirectory.
>>
>> C ::: A number of registry keys and values were created or modified  
>> by the installation but none seemed related to the eBayShortcuts.
>>
>> C ::: I had also checked the Control Panel Add/Remove programs  
>> applet but did not find anything related there.
>>
>> I thank you for your keen interest. My concerns have been answered.  
>> I really appreciate EAC and it does a superb job!
>>
>> --- In eac@..., Fred Maxwell <_EAC_moderator@...> wrote:
>>> ve3spd wrote:
>>>
>>> "As download started, I received a warning"
>>>
>>> From what? Kaspersky Antivirus? Lavasoft Adaware? AntiVir Personal
>>> Edition? Avast? ClamAV? A talking unicorn? We need a bit more
>>> information.
>>>
>>> "Consequently, I installed EAC, which launched on intallation
>>> termination. Immediately, My firewall intercepted an outbound
>>> communication by a program calle ebayshortcuts.exe"
>>>
>>> During installation, there was an option check-box for 'eBay Icon',
>>> which was pre-checked. You left it checked, so eBayShortcuts.exe was
>>> installed. If you had unchecked the option box , eBayShortcuts.exe
>>> would not have been installed.
>>>
>>> "I did a full disk search for a e-bay; ebay and found a bunch of  
>> files
>>> containing ebay in the name and deleted them all."
>>>
>>> Without knowing anything about what they did? Without examining the
>>> date that each was written to your disk? Maybe you should do a full
>>> disk search for ".exe" and delete all files that have that string in
>>> their name.
>>>
>>> "Conclusion: "eac-0.99pb5.exe" carries an extra payload."
>>>
>>> No, it contains optional add-ons that you can choose not to install.
>>> It told you it was going to install that. You left the option
>>> checked. It installed it.
>>>
>>> "Any information about this payload would be appreciated."
>>>
>>> See this link: http://tinyurl.com/22c6t
>>>
>>> Regards,
>>> Fred Maxwell
>>>
>
>
>
>
> ------------------------------------
>
> Official Exact Audio Copy web site:  http://www.exactaudiocopy.de/
> Yahoo! Groups Links
>
>
>

--

Ohne Musik wäre das Leben unträglich -- Nietzsche