[PLUG] Comcast spyware alert (re-send)

[beldon@speakeasy.org]

Hey all! I'm forwarding this letter I sent to ArsTechnica about Comcast's latest shameless buggery. Please spread the news. [Tony, I know you don't use Comcast, but you may know others who do.]
DO NOT INSTALL COMCAST'S SOFTWARE.
- Vince
=====
I recently received instructions to download Comcast software to switch my e-mail account over to mail.comcast.net. Being a bit suspicious because of a report from a friend that the software hung on copying MSVCRT.DLL [Microsoft Visual C++ runtimes? Didn't sound like a simple settings configurator to me!] to his machine, I downloaded the software and allowed it to extract files to C:\CHSI\, but aborted on the License Agreement page and proceeded to examine what they had in store for me. 
What I found was chilling and infuriating. It's bad enough they cut my bandwidth in half (I checked before and after the switch with www.bandwidthplace.com) and raised my rates from ~$40 to ~$50 per month, but now they're trying to muck with my system and install spyware to monitor my activities. 
Their installer software was created by BroadJump. I went to their page at http://www.broadjump.com/index_flash.html and read their Overview which made me very nervous. QUOTE: "BroadJump has brought to market a proven engine for generating revenue from the point of installation forward in ways never before possible. Instead of simply offering a "fat pipe," service providers are now capable of profitably delivering the specific goods and services their subscribers most want and need." A look at their products and services confirms it: their ChannelDirect and Virtual Truck products sound a lot like spyware and targeted advertising to me! 
A quick read of the License.txt document that accompanies the install is likewise disturbing. To paraphrase: "This document is covered by Texas Law so if you want to sue us, you have to do it in Texas. You can't sue us anyway, because by clicking the Accept button you agree to waive all your legal rights. This software changes your network settings and installs network-related software. We gather personal info and send it to BroadJump and Comcast and can do whatever we please with it." 
The install itself puts down core system DLLs like MFC42.DLL, COMCTL32.DLL, MSVCRT.DLL, etc. which some people will recognize as critical DLLs that you're better off not messing with unless you really know what you're doing. It installs a whole slew of custom DLLs as well, plus several virtual device drivers (VXD files) with worrisome names like BJIPAddr.vxd and DevMngr.vxd. 
My next step is to backup my machine with Norton Ghost and install the software, using InCtrl5 to monitor the install and using ZoneAlarm to trap unauthorized outgoing packets. Maybe even use SysInternals FileMon, PMon, and RegMon utilities to track its runtime activities in even more detail. I urge other Ars readers to do the same.

______________________________________________________________________
Philadelphia Linux Users Group       -      http://www.phillylinux.org
Announcements-http://lists.phillylinux.org/mail/listinfo/plug-announce
General Discussion  -  http://lists.phillylinux.org/mail/listinfo/plug