PerfectNav

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Risks ·
· Detection and Removal ·
· Research ·

Overview

Summary:

 Adware supplied by eUniverse.com. KeenValue/v1 runs at startup, generates popup ads, and is the original version. KeenValue/Incredifind adds capability, via a second process:
  • monitors web sites visited, so that ads may be targeted;
  • hijacks the hosts file and redirects Netscape searches to incredifind.com;
  • hijacks error pages and address bar searches to incredifind.com, which is then redirected to sirsearch.com;
  • adds an Internet Explorer toolbar providing a search field directed to sirsearch.com.

    'PerfectNav is designed to redirect your URL typing errors to PerfectNav's web page. This software helps keep Kazaa Media Desktop free.' -- http://www.kazaa.com/us/terms.htm

    		•

    Vendor Notes:

    		 from the web site: ' eUniverse is one of the largest entertainment and media networks on the Internet serving over 50 million subscribers each month. ... The Company's core strategy is to provide an ever increasing suite of compelling paid products and services to its user base, thereby continuing to increase the life time value of its users who transact on the network. The Company generates revenues by both selling products and services, while also offering 3rd party advertising on the eUniverse network.
    As a business, the eUniverse Network is supported by our advertising / marketing partners, who partner with us to initiate a long-term relationship with our audience. If the advertising on our site is inappropriate then it creates a negative user experience and becomes ineffective. To that end, we are continuously soliciting the opinion of our audience on this matter and do our best to provide the most appropriate advertising to create this the best experience for everyone involved
    eUniverse (www.euniverse.com) is a network of Web sites (referred to hereafter as the "the eUniverse Network" or "Network" or "Site") providing diversionary entertainment, topical news, information, editorial content and on-line shopping to millions of users and subscribers on a daily basis. The Network recognizes the importance of safeguarding the on-line privacy of its users. The information collected from users of, and subscribers to, the various sites comprising the Network will be used in accordance with the Privacy Policy... However, this Privacy Policy does not cover web sites or web pages that you may access or link to that are outside the Network.'

    Alias:

    		 eUniverse Flowgo toolbar, eUniverse SirSearch, KeenValue.MyFreeCursors, PerfectNav

    See Also:

    		 FavoriteMan. · KeenValue.PerfectNav

    Category:

    Tracking Cookie: Any cookie that is shared among two or more web pages for the purpose of tracking a user's surfing history.

    Adware: Software that displays popup/popunder ads when the primary user interface is not visible or which do not appear to be assocaited with the product.

    Browser Helper Object: (BHO). A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules. A BHO can detect events, create windows to display additional information on a viewed page, monitor messages and actions. Microsoft calls it "a spy we send to infiltrate the browser's land." BHOs are not stopped by personal firewalls, because they are seen by the firewall as your browser itself. Some exploits of this technology search all pages you view in IE and replace banner advertisements with other ads. Some monitor and report on your actions. Some change your home page.

    Downloader: A program designed to retrieve and install additional files, when run. Most will be configured to retrieve from a designated web or FTP site.

    Similar Pests:

    		 Tracking Cookie · Adware · Browser Helper Object · Downloader

    Origins

    Group:

    		 perfectnav.com

    Mailing Address:

    		 eUniverse, Inc., 6060 Center Drive Suite 300, Los Angeles, CA 90045 USA

    Phone:

    		 310.215.1001. Fax: 310.258.2758

    EMail:

    		 support@euniverse.com advertisingemail@euniverse.com

    URL:

    		 http://www.euniverse.com/

    Date of Origin:

    		 October, 2003

    Distribution

    Distribution:

    		 Distributed with software originating at eUniverse sites, including thunderdownloads.com, myfreecursors.com, cursorzone.com, crazymates.com, and mycoolscreen.com. Installed by FavoriteMan, desktop playmates, some MP3 Players, screensavers, online games, and shopping tools. Also bundled with the PowerSearch Toolbar. Bundled with the new MapQuest toolbar from http://mapquest.com. And bundled with the RealPlayer Search Bar.

    EUniverse.PerfectNav is bundled with the Free Ad Supported version of Kazaa Media Desktop 2.6. Likely to be found in software supplied by eUniverse sites, such as thunderdownloads.com, myfreecursors.com, cursorzone.com and mycoolscreen.com. Reported to be installed by FavoriteMan.

    Prevalence:
  • PerfectNav: 72.9%
    • More Info

    Clot Factor:
  • PerfectNav: 1

    • The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

    Growth:
  • PerfectNav: Insufficient data to report growth
    		•

    Operation

    General:

    		 The KeenValue.exe process is visible in the Windows Task Manager

    Advertising:

    		 Yes. Popups and popup slider windows may be displayed at intervals. Keenvalue/Incredifind will display ads that are targeted based on terms contained in the page you are viewing. Also generates embedded ads and desktop icons that link to ads.

    According to Infobeat, one of KeenValue's distributors, "KEENVALUE delivers ads, software and informational messages ("Advertisements") to you by tracking your interests and behavior patterns based on computer usage. KEENVALUE selects Advertisements based on a number of factors including URLs associated with web pages you visit, search terms you input into search engines, HTML content you view, your IP address, and your local zip code. Often, Advertisements are from websites that are competitive to web sites that you are viewing or have recently viewed. Advertisements are delivered to your computer screen and cannot be independently removed from your computer. You are unable to control or delete Advertisements by deleting cookies or unbundling the software. ... Advertisements are delivered to your computer screen by: · Pop-Up Windows · Pop-Up Slider Windows · Embedded Ads · Desktop icons and installation files that may be placed on your computer for you to link to other products and services. " - http://www.infobeat.com/infobar/terms.html

    Storage Required:
  • PerfectNav: at least 1329 KB
    		•

    Browser Performance:

    		 Likely to slow performance of Internet Explorer.

    ScreenShot:


    RealOne Search Toolbar -- KeenValue/Incredifind

    Risks

    Privacy Issues:

    		 Yes. Using KeenValue, eUniverse anonymously collects the following information:
  • Web sites/pages viewed
  • The amount of time spent at some Web sites
  • Response to the Advertisements displayed
  • Standard web log information including IP address and system settings
  • What software is on your personal computer
  • Your first and last name, country, and five digit ZIP code
  • Your usage characteristics and preferences
    - http://www.infobeat.com/infobar/terms.html (Infobeat distributes KeenValue).

    'Unless a user elects not to receive offers and promotions from Sites within the Network or from third-parties, the Network shares individual information with other reputable organizations including its affiliates, its advertisers, its marketing partners and third-party advertising companies that are interested in marketing to Network users. Demographic information is usually reported in aggregate to third parties who are interested in knowing what type of audience the Network attracts. The Network and its advertisers and marketing partners use this information to ensure that ads, offers and promotions are relevant and of value to users. Advertisers who contract directly with Network Sites are required to confirm that they will comply with the Network's Privacy Policy with respect to information collected through ads displayed on any Network Site. Third-party advertising companies use cookies to measure and improve the effectiveness of their clients' ads. To do this, advertisers may use anonymous information about a user's visit to a Network Site (as well as other websites) including what banner ad was shown, the date and time it was shown, the cookie and the IP address. This information may also be used for online preference marketing purposes.' - http://www.euniverse.com/privacy.cfm

    		•

    Privacy Policy:

    		 from http://www.euniverse.com/privacy.cfm 'The Network collects and stores information that is voluntarily provided when a user signs up for a Site membership, purchases a product, responds to a survey, signs up for a promotion or to receive or send electronic newsletters, greetings and other emails or content such as weekly jokes or enters a contest sponsored by a Network Site. When a membership or a product is purchased, the user provides: name, mailing address, email address, telephone number and credit card number and credit card expiration date in order to complete the transaction. If a user enters a contest or signs up for a promotion, the user provides their name and email address. At various times, users may be asked to voluntarily provide demographic information such as address, age range, gender, occupation, interests or hobbies. Also, in connection with signing up for, or subscribing to, services or features offered across the Network, a user may be requested to provide optional background information to let the Network know generally who Network users are and what their interests may be. ... The eUniverse Network uses cookies to collect and store information. Cookies are small files that the user's web browser places on the user's hard drive for record keeping purposes. Cookies permit the Network to identify the user and to recall from the Network's database the user's email address and other information that the user has voluntarily provided. Third-party advertising companies that may contract with Network Sites also use cookies. ... Unless a user elects not to receive offers and promotions from Sites within the Network or from third-parties, the Network shares individual information with other reputable organizations including its affiliates, its advertisers, its marketing partners and third-party advertising companies that are interested in marketing to Network users. Demographic information is usually reported in aggregate to third parties who are interested in knowing what type of audience the Network attracts. The Network and its advertisers and marketing partners use this information to ensure that ads, offers and promotions are relevant and of value to users. ...

    Security Issues:

    		 Yes. An update feature can silently download and run arbitrary code as directed by KeenValue's controlling servers. "To improve KEENVALUE's features or functions, from time to time, we update KEENVALUE and/or install technologies, such as certain rich media player applications, browser plug-ins, virtual machines, and runtime environments (collectively "Enhancement Technologies"). Your installation of KEENVALUE and acceptance of this Agreement indicates your acceptance of any future updates or upgrades." - http://www.infobeat.com/infobar/terms.html

    Stability Issues:

    		 Yes. Keenvalue.exe may not close properly during Windows shutdown. In XP, KeenValue will often trigger error reporting to Microsoft.

    Detection and Removal

    Automatic Removal:

    PestPatrol detects this.

    PestPatrol removes this.

    Manual Removal:

    		 There is no uninstaller listed in "Add/Remove Programs" for EUniverse.PerfectNav. For other variants, begin by choosing "KeenValue", then "Remove" in Control Panel's Add/Remove Programs. Repeat for "PowerSearch toolbar for IE" This will not fully remove KeenValue, but its a start.

    After removing files, directories, and registry entries as described below, restore your search settings (Internet Options->Programs->Reset Web Settings), and remove the Hosts file hijack: open the System folder (which is inside the Windows folder, and called 'System32' on Windows NT, 2000 and XP), go to 'drivers'->'etc', and load the file 'hosts' (with no file extension) into a text editor. Delete the following line and save.
    12.129.205.209 search.netscape.com

    An uninstaller may be found at http://www.incredifind.com/downloads/incredifinduninstall.exe

    If you have KeenValue/Incredifind, you might have RealPlayer installed, along with the RealPlayer SearchBar. Here is advice from Real about how to remove this:
    To Remove RealOne Player:

    1. Click the Start button, point to Search, and click Find Files or Folders.
    2. Type .r1pclean.exe (r1(one)pclean) in the search box and click Search Now.
    2a. This may be found at C:\Program Files\Real\RealOne Player\Setup\.r1pclean.exe
    3. When Windows locates the file, double-click it. A MS-DOS window appears with a warning.
    4. Press the Y key and then press ENTER to uninstall.
    5. You will be asked if you want to keep your media database or not; for a complete uninstall press the N key to delete the media database. See Deleting the Database below for more information.
    6. If RealOne Music software is also installed, you will be asked if you want to leave all the registry keys associated with RealOne Music and leave the MCS database files. Press the N key to delete them.
    RealOne Player will now uninstall from your computer.

    Deleting the Database
    The media database keeps track of all your music files and playlists. Deleting it will not delete your music files, but you will have to recreate all your playlists again. You should only delete the database if it is corrupt and the cause of the problem.
    7. Go to the C:\Program Files\Common Files\ and delete the Real folder.
    Reinstall your RealNetworks Programs.
    Stop Running Processes:

    Kill these running processes with Task Manager:

    Unregister DLLs:

    Unregister these DLLs with Regsvr32, then reboot:

    Remove Files:

    Remove these files (if present) with Windows Explorer:

    Research

    File Analyses:

    More Info:
  • http://www.infobeat.com/infobar/terms.html
  • AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
    		•

    Research By:
  • Andrew Clover
  • PestPatrol's Pest Research Center
    		•

    Last Revised:

    		 April 04, 2005