On May 19, 10:12 pm, tim.j.pitt...@gmail.com wrote:
> When I went back into TaxCut to reprint my tax return from last year.
> While in there I found the option to "Save to PDF". Selecting this
> option apparently fired the silent installation of PDF995 and it
> immediately started acting like a adware infection. It popped up a
> window without a close button that stayed in front of all other
> applications. It then opened an IE window and went to their website.
> If that wasn't bad enough -- it went into a loop and started opening
> another pair of these windows every few seconds. I attempted to open
> my task manager (process explorer) to locate and kill the processes.
> Since PDF995 stayed in front of other windows, it made it very
> difficult to locate the process in the process explorer. When I
> located it and attempted to kill the glswin995 process that kept
> spawning, the process refused to die. I had to force a shutdown. When
> I tried logging in under a separate admin account, I found that the
> popups started again. I had to start up in safe mode and find the auto-
> start using autoruns. It locked the directory so it couldn't be
> deleted. It took another reboot to finally allow deletion of the
> directory and now I still have remnants in my printers folder that I
> still haven't been able to clean up.
>
> This program -- shareware, commercial software or by any other name,
> exhibits all of the characteristics of an adware infection. The fact
> that there is no uninstall and there was no notice in the installer
> informing us that this infection would be installed is further
> evidence. After observing it in action I was very surprised to see it
> on the shareware pages. Maybe they are trying to go legit, but the
> authors built in adware-like characteristics and I would have thought
> that H&R Block would have checked them out a little more carefully
> before allowing them to piggy-back off of their "good" name.
>
> Oh, and to help you other TaxCut users out -- after installation, go
> into the Program Files\TaxCut07 directory and delete the folder named
> PDF995. Of course, if you are curious, check out the file names like
> autosetup.exe and the "Quiet=1" option in the install.ini file before
> you delete the directory. Apparently this adware infection is only
> launched when you use the "Save to PDF" option. Instead, use another
> product that creates a PDF-printer and just print your returns.
>
> I found this adware infection in TaxCut06 and TaxCut07, but TaxCut05
> did not have it.

Hmmm, replying to my own post. I found that PDF995 is installed on my
new computer too. It seems to be behaving itself on this machine. The
installation described above is actually what I found on my old
computer where I was running TaxCut06. On my new computer I have
TaxCut07 and it also SILENTLY and still without consent -- installed
PDF995. However, the Add/Remove programs DOES show an uninstall and
does attribute the installation to TaxCut. It has not caused the same
problems this year. Granted, I DID NOT use the print to PDF function
this year and I sure an NOT going to try it after what I experienced
on TaxCut06 on the other computer. Apparently they have fixed the
program somewhat this year.