I ran the latest AW update (level 688) this morning and was unpleasantly surprised to see it run two Gator Gain spyware processes. These programs run while the update is processing and terminate when it finishes. They appear to be making internet connections while running. This occured on both home and work machines. I will post more info on where these programs are connecting when I have time to do the research. Below is a short description of the Gator Gain functions from the Webroot web site.

ADWARE Description:

Name:
Gator (GAIN)

Author:
Claria Corporation

Category:
Adware

Threat Assessment:
Medium




Description:

Gator (GAIN) is an adware program that has the ability to display banner advertisements based on your Web surfing habits.

Characteristics:

The Gator Advertising and Information Network (GAIN) has been reported to insert banner advertisements over the existing banner ads on a Web site. The program also has the ability to track the Web sites you visit and banners you click. The marketing information gathered allows Gator to display ads that are based upon your Web surfing habits.

Method of Infection:

Gator is bundled with numerous free software programs, including the popular file-sharing program Kazaa.

The Auction Wizard 2000 installer does not install Gator or any other spyware. All of our development computers have been checked. No trace of Gator has been found on any of them.

-- The Auction Wizard Team

If you wish, I can email the two executables and two data files produced when the update is run. Let me know.

GAIN isn't a trojan or a virus - it's something that the author has to put deliberately into their code - it's actually a licensed product from Gator.com, and Gator basically pays software publishers a portion of the ad revenue. So Thom would know if he's subscribed to GAIN.

It sounds as if some other program on your system is installing these files. According to the GAIN faq, you should have a program group called "gain" - and if you select "about gain", it should list the program(s) it is "supporting". That should tell you what application is actually using the adware. From my experience, even if you delete all of the gain adware files, so long as you keep running the gain-supported programs, either the adware files will re-appear or the application will fail to run.

Here is that faq:
http://www.gainpublishing.com/help/gainfaq.html

Also, what are the filenames being created on your system?

Rich