H&R Tax Cut installs PDF995 adware

[tim.j.pittman@gmail.com]

When I went back into TaxCut to reprint my tax return from last year.
While in there I found the option to "Save to PDF". Selecting this
option apparently fired the silent installation of PDF995 and it
immediately started acting like a adware infection. It popped up a
window without a close button that stayed in front of all other
applications. It then opened an IE window and went to their website.
If that wasn't bad enough -- it went into a loop and started opening
another pair of these windows every few seconds. I attempted to open
my task manager (process explorer) to locate and kill the processes.
Since PDF995 stayed in front of other windows, it made it very
difficult to locate the process in the process explorer. When I
located it and attempted to kill the glswin995 process that kept
spawning, the process refused to die. I had to force a shutdown. When
I tried logging in under a separate admin account, I found that the
popups started again. I had to start up in safe mode and find the auto-
start using autoruns. It locked the directory so it couldn't be
deleted. It took another reboot to finally allow deletion of the
directory and now I still have remnants in my printers folder that I
still haven't been able to clean up.

This program -- shareware, commercial software or by any other name,
exhibits all of the characteristics of an adware infection. The fact
that there is no uninstall and there was no notice in the installer
informing us that this infection would be installed is further
evidence. After observing it in action I was very surprised to see it
on the shareware pages. Maybe they are trying to go legit, but the
authors built in adware-like characteristics and I would have thought
that H&R Block would have checked them out a little more carefully
before allowing them to piggy-back off of their "good" name.

Oh, and to help you other TaxCut users out -- after installation, go
into the Program Files\TaxCut07 directory and delete the folder named
PDF995. Of course, if you are curious, check out the file names like
autosetup.exe and the "Quiet=1" option in the install.ini file before
you delete the directory. Apparently this adware infection is only
launched when you use the "Save to PDF" option. Instead, use another
product that creates a PDF-printer and just print your returns.

I found this adware infection in TaxCut06 and TaxCut07, but TaxCut05
did not have it.

[tim.j.pittman@gmail.com]

On May 19, 10:12 pm, tim.j.pitt...@gmail.com wrote:
> When I went back into TaxCut to reprint my tax return from last year.
> While in there I found the option to "Save to PDF". Selecting this
> option apparently fired the silent installation of PDF995 and it
> immediately started acting like a adware infection. It popped up a
> window without a close button that stayed in front of all other
> applications. It then opened an IE window and went to their website.
> If that wasn't bad enough -- it went into a loop and started opening
> another pair of these windows every few seconds. I attempted to open
> my task manager (process explorer) to locate and kill the processes.
> Since PDF995 stayed in front of other windows, it made it very
> difficult to locate the process in the process explorer. When I
> located it and attempted to kill the glswin995 process that kept
> spawning, the process refused to die. I had to force a shutdown. When
> I tried logging in under a separate admin account, I found that the
> popups started again. I had to start up in safe mode and find the auto-
> start using autoruns. It locked the directory so it couldn't be
> deleted. It took another reboot to finally allow deletion of the
> directory and now I still have remnants in my printers folder that I
> still haven't been able to clean up.
>
> This program -- shareware, commercial software or by any other name,
> exhibits all of the characteristics of an adware infection. The fact
> that there is no uninstall and there was no notice in the installer
> informing us that this infection would be installed is further
> evidence. After observing it in action I was very surprised to see it
> on the shareware pages. Maybe they are trying to go legit, but the
> authors built in adware-like characteristics and I would have thought
> that H&R Block would have checked them out a little more carefully
> before allowing them to piggy-back off of their "good" name.
>
> Oh, and to help you other TaxCut users out -- after installation, go
> into the Program Files\TaxCut07 directory and delete the folder named
> PDF995. Of course, if you are curious, check out the file names like
> autosetup.exe and the "Quiet=1" option in the install.ini file before
> you delete the directory. Apparently this adware infection is only
> launched when you use the "Save to PDF" option. Instead, use another
> product that creates a PDF-printer and just print your returns.
>
> I found this adware infection in TaxCut06 and TaxCut07, but TaxCut05
> did not have it.

Hmmm, replying to my own post. I found that PDF995 is installed on my
new computer too. It seems to be behaving itself on this machine. The
installation described above is actually what I found on my old
computer where I was running TaxCut06. On my new computer I have
TaxCut07 and it also SILENTLY and still without consent -- installed
PDF995. However, the Add/Remove programs DOES show an uninstall and
does attribute the installation to TaxCut. It has not caused the same
problems this year. Granted, I DID NOT use the print to PDF function
this year and I sure an NOT going to try it after what I experienced
on TaxCut06 on the other computer. Apparently they have fixed the
program somewhat this year.

[David H. Lipman]

From: <tim.j.pittman@gmail.com>

| When I went back into TaxCut to reprint my tax return from last year.
| While in there I found the option to "Save to PDF". Selecting this
| option apparently fired the silent installation of PDF995 and it
| immediately started acting like a adware infection. It popped up a
| window without a close button that stayed in front of all other
| applications. It then opened an IE window and went to their website.
| If that wasn't bad enough -- it went into a loop and started opening
| another pair of these windows every few seconds. I attempted to open
| my task manager (process explorer) to locate and kill the processes.
| Since PDF995 stayed in front of other windows, it made it very
| difficult to locate the process in the process explorer. When I
| located it and attempted to kill the glswin995 process that kept
| spawning, the process refused to die. I had to force a shutdown. When
| I tried logging in under a separate admin account, I found that the
| popups started again. I had to start up in safe mode and find the auto-
| start using autoruns. It locked the directory so it couldn't be
| deleted. It took another reboot to finally allow deletion of the
| directory and now I still have remnants in my printers folder that I
| still haven't been able to clean up.
|
| This program -- shareware, commercial software or by any other name,
| exhibits all of the characteristics of an adware infection. The fact
| that there is no uninstall and there was no notice in the installer
| informing us that this infection would be installed is further
| evidence. After observing it in action I was very surprised to see it
| on the shareware pages. Maybe they are trying to go legit, but the
| authors built in adware-like characteristics and I would have thought
| that H&R Block would have checked them out a little more carefully
| before allowing them to piggy-back off of their "good" name.
|
| Oh, and to help you other TaxCut users out -- after installation, go
| into the Program Files\TaxCut07 directory and delete the folder named
| PDF995. Of course, if you are curious, check out the file names like
| autosetup.exe and the "Quiet=1" option in the install.ini file before
| you delete the directory. Apparently this adware infection is only
| launched when you use the "Save to PDF" option. Instead, use another
| product that creates a PDF-printer and just print your returns.
|
| I found this adware infection in TaxCut06 and TaxCut07, but TaxCut05
| did not have it.

I don't think the inclusion of the PDF creation software would classify as Ad-ware or
spyware or in any matter malware.

More like including nagware (PDF995) with a paid-for product.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp