Initial PacerD popup, offering "free browser enhancements." Clicking "Yes" once causes the installations described below.

---

Clicking the link in the initial popup yields a lengthy license, first mentioning bundled programs on page four.

---

PacerD adds multiple browser toolbars, as well as desktop icon advertising.

---

PacerD installs additional programs, even beyond those mentioned in PacerD's license.

Users surfing the web (using anything less than the very latest web browsers) often receive popups like that shown at right. Some of these popups are legitimate requests to install software actually required to view the web pages users request -- for example, the newest version of Macromedia Flash, a popular video and animation player. But other popups are mere trickery, seeking to convert users' computers into advertisement display channels for software distributors' own benefit. A single click "Yes" in one such box can bring a user's computer to a virtual stand-still due to the large number of programs added.

This article examines one misleading popup, its methods, its (purported) license agreement, and its effects. Notable characteristics:

• Installation prompt offering "browser enhancements" without mention of advertising, privacy, reliability, or speed effects. Details.
• "License agreement" with confusing title and heading, and unreasonable substantive terms. Details.
• Installation of many programs, including programs not disclosed in the "license." Major performance effects. Difficult removal. Details.

Update (October 2005): Along with the ActiveX popups described in this article, PacerD also attempts to install via security exploits. Video, details, and analysis.

The Installation Prompt

While browsing www.iowrestling.com, an online wrestling site, I received the popup shown in the first image at right. The popup's text reads:

"Do you want to install and run PLEASE CLICK YES to install our free browser enhancements. This file has been signed ... Publisher authenticity verified by Comodo Code Signing CA ..."

With healthy skepticism and appropriate analysis, users may be able to see risks in this request. Who are PacerD and Comodo Code Signing? What is the nature of the "enhancement" they offer?

But a user who sees this official-looking dialog box -- perhaps recognizing it from similar legitimate boxes seen in the past -- may press Yes without realizing the resulting effects. After pressing the Yes button, the user has no further opportunity to cancel or stop the installation, even if the user immediately realizes her mistake.

At least as notable as what the installation prompt says is what it doesn't say. The prompt says nothing about any advertising resulting from pressing Yes, and it also fails to mention any effects on privacy, computer reliability, or computer speed. The prompt even fails to mention that a user wanting more information about the installation can click the blue text to learn more. Some users may recognize the blue formatting as a hyperlink, but the prompt does nothing to alert or remind users of this feature.

The (Purported) License Agreement

If a user sees and clicks on the installation prompt's blue underlining, the user receives a document entitled "sample" (in its HTML TITLE tag) that, according to its first line of text, "contains the license agreement for Pacisoft distributed by PacerD." This heading is importantly deficient. For one, the "sample" title makes it unclear whether the document is in fact claimed to be official and binding. Furthermore, even careful users cannot know the meaning of the reference to "Pacisoft"; the prior popup mentioned a company called PacerD but did not mention "Pacisoft" or any other specific product name.

A user who nonetheless chooses to examine the "license agreement" finds a 1,951-word document, shown in eight on-screen pages.

At page four, the document mentions installation of third-party software, including "desktoptraffic, websearch, peopleonpage, adpowerzone, direct revenue, exact, surfsidekick, [and] 180," and giving the hyperlinks to each of the corresponding license agreements (save for Direct Revenue, which lacks a link).

At page eight, the document claims that disputes must be submitted to arbitration, and that such arbitration must be conducted in the Seychelles (an island in Eastern Africa, northeast of Madagascar).

Other provisions purport to disclaim all warranties, to limit PacerD's liability, and to grant PacerD the right to install other "independent" software at any time.

Effects of Installation

If a user presses Yes once in the popup shown in the first image above, PacerD begins to install numerous advertising programs. Beyond the eight programs disclosed in PacerD's license, in my testing PacerD also installed AdDestroyer, Apropos Media, Elitebar, Shop At Home, TopConverting, and Virtual Bouncer. In addition, while the PacerD license discloses installation of "exact," I actually observed three different eXact Advertising programs installed -- BullsEye, CashBack, and NaviSearch.

All told, in my testing the single press of the "Yes" button caused the creation of 1,274 registry keys, 2,175 registry entries, 56 folders, and 711 files. PacerD also added two new web browser toolbars, and six advertisement icons on my Windows desktop.

After installation of PacerD, browsing the web became effectively impossible due to the large number of add-ons and their numerous popup ads, delays, crashes, and other interruptions.

Although installation required only a single click of a single "Yes" button, removing the many resulting programs is far harder. Some of the programs have uninstallers in Control Panel -- each of which must be separately activated and completed. Others can only be removed manually or with third-party removal tools. In my testing, even the removal tools that get the best reviews couldn't immediately clear the entire infection.

See also Webhelper4u's analysis of a similar infection from PacerD.

Who's Responsible?

Users unhappy with PacerD may wonder who to blame. Some possibilities:

• Iowrestling. Since the misleading installations at issue began when a user browsed iowrestling.com, some users may focus on that site -- the site most obviously causing the installations. Sophisticated users may not be surprised to learn that an online entertainment site uses these installation methods. But in prior work, I have found that even reputable companies come to spread such software from web pages in their control. See my February 2005 documentation of similar installations occurring at Google's Blogspot. I have also seen similar methods on sites clearly targeted at children. (Example.)
• PacerD. PacerD itself is also a natural candidate for blame. PacerD directly controls the installations; PacerD is uniquely able to install less software or no software at all, or to provide additional information or disclosures prior to installation. But who is PacerD? Pacerd.com's whois data gives an address in the Seychelles -- though also a voicemail phone number in Seattle and a web server in Russia. The Pacerd.com web site gives no meaningful information about PacerD's ownership or location. So users angry at PacerD may be unable to figure out precisely where to complain.
• Comodo Code Signing. PacerD is able to show its software installation prompt only thanks to having a code-signing certificate, which it received from the Comodo Code Signing certificate authority. Comodo's terms of service require that its customers use certificates only for "authorized and legal purposes," but it is unclear what steps Comodo takes to assure such use or to investigate apparent wrongdoing. I have previously criticized poor enforcement by VeriSign in its issuance of similar certificates, though there are some indications that VeriSign is improving enforcement, thereby driving would-be bad-actors to other certificate authorities. Ultimately, Microsoft's configuration of Internet Explorer browsers determines what certificate authorities IE accepts; if Microsoft found Comodo's practices deficient, Microsoft could update IE to terminate Comodo's ability to certify entities like PacerD.
• The software providers. Since PacerD receives installation commissions for the programs it installs, the companies funding PacerD are the primary causes of PacerD's existence and prevalence. These companies include 180solutions, Direct Revenue, and eXact Advertising -- three advertising software companies that have previously received major venture capital funding. (See my list of investors supporting such companies.) If these and similar companies refused to pay installation commissions to PacerD (and others who use similar methods), PacerD's revenue source would disappear. But in practice, these companies seem to be indiscriminate in their selection of distribution partners. See my examples of 180solutions recruiting partners by unsolicited commercial email. See also my video of installations through security holes.
• Mamma Media. Finally, PacerD reaches users via its relationships with advertising networks. PacerD does not have a relationship with Iowrestling.com directly. Instead, PacerD reaches Iowrestling users via the Mamma Media Solutions / targetnet.com advertising network. According to Mamma Media's contact page, their offices are in Montreal, Quebec, and their corporate profile indicatesthat they are traded on Nasdaq's Small Cap market (symbol: MAMA). PacerD is far from the only problematic ad I've seen sent through Mamma Media. In fact, I've repeatedly seen two different Mamma Media ads that use security exploits to install large bundles of software on users' computers, without first requiring that users press "Yes."

Last Updated: April 25, 2005 - Sign up for notification of major updates and related work.