--------------------------
Media-Motor/VVSN Video # 2
--------------------------

(Nov. 24, 2005)

As the video opens, I demonstrate that the test system is free of spyware and adware.

At 00:28, I surf to cnn.com, which shows the current day and time.

At 1:02, I surf to www.4w-wrestling.com.

At 1:50, I encounter an ActiveX install prompt for a "free Joystick Screensaver" from "Media Motor." I 
click through to the EULA, which contains no mention of any additional software, save a discrete link 
to "our partners Agreements" at the very bottom, which no regular user would ever see let alone click 
through. The additional "partners Agreements" page not only mentions software that will not be 
installed (180Solutions) but fails to mention software that will be installed (E2Give, imGiant, 
Internet Optimizer, Webhancer, WhenU Save!).

At 2:23, I click through the ActiveXx install prompt from Media Motor.

At 2:39, I begin inspecting the real time Snoop Analyzer URL log, which reveals that software from 
Prutect.com (E2Give), get-mirar.com, net-nucleus.com (Mirar), movies-etc.com (Internet Optimizer), 
Whenu.com, and media-motor.net are in the process of being installed. Note that I have not seen any 
notice or a EULA for the vast majority of this software.

At 3:32, I encounter an ActiveX install prompt for IE-Plugin, which I refuse.

At 3:39, I encounter an install prompt for a "Free Browser Enhancement" from Pacimedia, which I also 
refuse.

At 3:49, I encounter a second install prompt for software from Pacimedia (Pacerd), which I also refuse.

At 4:21, a "thank you" page from WhenU opens on my desktop.

At 5:37, I open Windows Explorer and begin inspecting the contents of the hard drive. In the \Program 
Files folder I find new folders for imGiant, Save, e2Give, Internet Optimizer, and Webhancer.

At 5:56, I inspect the \imGiant folder, which shows installers for WhenU (VVSN.EXE, WHENUINSTALL.EXE, 
WHENUNSTALL.EXE).

At 6:08, I inspect the contents of the \Save directory.

At 6:29, I inspect the contents of the \Windows directory, which shows a number of new executables and 
libraries.

At 7:02, I open the "Add/Remove Programs" Control Panel applet, where I find new uninstall entries for 
a number of recently installed programs.

At 7:50, I generate a HijackThis log, which reveals a number of new running processes, as well as 
numerous other changes and additions to the system.

At 9:31, a pop-up spawned by one of the locally installed adware programs opens on my desktop.

At 12:24, the video ends.