From: <tim.j.pittman@gmail.com>

| When I went back into TaxCut to reprint my tax return from last year.
| While in there I found the option to "Save to PDF". Selecting this
| option apparently fired the silent installation of PDF995 and it
| immediately started acting like a adware infection. It popped up a
| window without a close button that stayed in front of all other
| applications. It then opened an IE window and went to their website.
| If that wasn't bad enough -- it went into a loop and started opening
| another pair of these windows every few seconds. I attempted to open
| my task manager (process explorer) to locate and kill the processes.
| Since PDF995 stayed in front of other windows, it made it very
| difficult to locate the process in the process explorer. When I
| located it and attempted to kill the glswin995 process that kept
| spawning, the process refused to die. I had to force a shutdown. When
| I tried logging in under a separate admin account, I found that the
| popups started again. I had to start up in safe mode and find the auto-
| start using autoruns. It locked the directory so it couldn't be
| deleted. It took another reboot to finally allow deletion of the
| directory and now I still have remnants in my printers folder that I
| still haven't been able to clean up.
|
| This program -- shareware, commercial software or by any other name,
| exhibits all of the characteristics of an adware infection. The fact
| that there is no uninstall and there was no notice in the installer
| informing us that this infection would be installed is further
| evidence. After observing it in action I was very surprised to see it
| on the shareware pages. Maybe they are trying to go legit, but the
| authors built in adware-like characteristics and I would have thought
| that H&R Block would have checked them out a little more carefully
| before allowing them to piggy-back off of their "good" name.
|
| Oh, and to help you other TaxCut users out -- after installation, go
| into the Program Files\TaxCut07 directory and delete the folder named
| PDF995. Of course, if you are curious, check out the file names like
| autosetup.exe and the "Quiet=1" option in the install.ini file before
| you delete the directory. Apparently this adware infection is only
| launched when you use the "Save to PDF" option. Instead, use another
| product that creates a PDF-printer and just print your returns.
|
| I found this adware infection in TaxCut06 and TaxCut07, but TaxCut05
| did not have it.

I don't think the inclusion of the PDF creation software would classify as Ad-ware or
spyware or in any matter malware.

More like including nagware (PDF995) with a paid-for product.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp