Page 1 of 2 12 LastLast
Results 1 to 10 of 14

Thread: Please advise on Nielsen NetRatings

  1. #1
    Junior Member
    Join Date
    Mar 2009
    Posts
    8

    Question Please advise on Nielsen NetRatings

    Hi, I'm looking for someone to advise me on a program called Nielsen Netratings (or Netmeter). What is this program? Is it malicious? Undesirable? Safe? I've searched the web and found nothing more detailed than various reports of "this is a suspicious process" or "this is a safe process". Can you tell me any more about what this program does?

    Here's my situation: a family member installed this program (or tried to) earlier today. She allowed the addition of a global startup entry. Later, I logged on and the program tried to add two more startup entries, which I blocked with Spybot. Despite this, the program already had three processes running as seen in the task manager. I killed the processes and removed the original startup entry.

    Anyway, my question is... where should I go from here? Should I allow the program to run? I was going to uninstall it, but the program is conspicuously absent from the add/remove programs list...

    Has any damage been done by this program being allowed to run previously? Am I just being overly paranoid? Please let me know if you need more information or an HJT log. My HJT results look OK to me, (no change compared to results before installation) but I'm no expert.

    Here are the entries in my Spybot S&D log file:

    3/4/2009 9:40:03 AM Allowed (based on user decision) value "NielsenOnline" (new data: "C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe") added in System Startup global entry!
    3/4/2009 4:54:41 PM Denied (based on user decision) value "NetMeter" (new data: "C:\Program Files\NetRatingsNetmeter\NetMeter\NielsenOnline.exe") added in System Startup global entry!
    3/4/2009 4:54:43 PM Denied (based on user decision) value "NetMeterInstall" (new data: "rundll32.exe "C:\Program Files\NetRatingsNetmeter\NetMeter\nmobsvr.dll",InstallComponent") added in System Startup global entry!
    3/4/2009 4:56:19 PM Allowed (based on user decision) value "NielsenOnline" (new data: "") deleted in System Startup global entry!

  2. #2
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi xx521xx,

    Nielsen Netratings and Netmeter are two different things. Netmeter is a bandwidth monitor. The other sounds like something bundled as a third party add-on to monitor web sites visited or something like that, probably not anything useful. You can post your add/remove programs list using hjt, like this:

    Iam in linux now and doing this from (bad) memory, should be close;

    Start hjt, click on 'open misc tools section'
    click on 'uninstall manager'
    click on 'uninstall list'

    something like that anyway. You can copy/paste the list in your reply.
    How Can I Reduce My Risk?

  3. #3
    Junior Member
    Join Date
    Mar 2009
    Posts
    8

    Default

    Thanks for the reply. When I searched for info on NielsenOnline.exe, I only found results relating to NetRatings, but I guess Nielsen has multiple programs out there using the same filename.

    Here is my rather lengthy uninstall list. Two notes: I know CouponBar is considered adware, but I have a family member that uses it. Also, Homescan is another Nielsen program and is also used by a family member.
    Last edited by shelf life; 2009-03-11 at 02:22. Reason: removed uninstall list

  4. #4
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi xx521xx,

    I dont see anything in the list. After a closer look it looks like Netmeter is part of the 'package' You say you have hjt installed? Please scan and post a hjt log for me.
    How Can I Reduce My Risk?

  5. #5
    Junior Member
    Join Date
    Mar 2009
    Posts
    8

    Default

    Sure thing.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:56:54 PM, on 3/7/2009

    End of file - 10990 bytes
    Last edited by shelf life; 2009-03-11 at 02:22. Reason: removed hjt log

  6. #6
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi,

    Dont see anything relating to it in the log. I doubt its any worse than CouponBar thats installed. I am surprised its not listed in the add/remove programs panel. Take a look in these two folders:

    C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe"
    See if you see a uninstall icon, may also be called unwise.exe or unins000.exe.

    and also this one
    C:\Program Files\NetRatingsNetmeter\NetMeter\NielsenOnline.exe"
    How Can I Reduce My Risk?

  7. #7
    Junior Member
    Join Date
    Mar 2009
    Posts
    8

    Default

    Well, I don't see any obvious uninstaller in either folder. There is apparently an installer in each one. These are the EXEs I found in those folders:

    C:\Program Files\NetRatingsNetmeter\NetMeter\NeilsenOnline.exe
    C:\Program Files\NetRatingsNetmeter\NetMeter\NeilsenOnlineInstall.exe
    C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
    C:\Program Files\NetRatingsNetSight\NetSight\nsmgrutil.exe
    C:\Program Files\NetRatingsNetSight\NetSight\NSSetup.exe
    C:\Program Files\NetRatingsNetSight\NetSight\download\npiptool.exe
    C:\Program Files\NetRatingsNetSight\NetSight\download\npshtool.exe
    C:\Program Files\NetRatingsNetSight\NetSight\download\nsstmt.exe
    C:\Program Files\NetRatingsNetSight\NetSight\meter1\npiptool.exe
    C:\Program Files\NetRatingsNetSight\NetSight\meter1\npshtool.exe
    C:\Program Files\NetRatingsNetSight\NetSight\meter1\nsstmt.exe

  8. #8
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    thanks for the info. Does Spybot flag these items after a scan? If so I would let Spybot remove them. A last resort would be to manually delete the folders from C:/Program files.
    How Can I Reduce My Risk?

  9. #9
    Junior Member
    Join Date
    Mar 2009
    Posts
    8

    Default

    Spybot doesn't detect any malware when I use it to scan those folders. Neither do AntiVir or MalwareBytes' Anti-Malware. I uploaded some of those files to VirusTotal, and some of them had detections from a few anti-malware programs. It was mostly heuristic detections, but there was one file specifically flagged by a single anti-malware program as "Riskware.AdTool.NeilsenOn.W32" (not 100% sure that was the exact name, but it was close).

    On a somewhat-related note, you mentioned that it might not be any worse than CouponBar, but what is it that makes CouponBar a threat? As far as I know, it's disliked because it adds a toolbar to IE and doesn't remove all its files when uninstalled. Is there anything else I should know about it?

  10. #10
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi xx521xx,

    CouponBar a threat?
    I suppose its due to the information they can collect about you based on your web habits. It may not be classified as "spyware" but a nice collection (profile) of information could be collected using cookies, web beacons, sites visited, ads clicked on etc

    there privacy policy:
    http://www.coupons.com/corp/source/u...olicy.asp?vf=y

    "Consumer Profiling and Tracking Cookies "
    http://www.worldprivacyforum.org/cookieoptout.html

    Since Spybot and Malwarebytes dosnt flag either one as malware you can leave it if you want. Since its not flagged or in the add/remove programs panel the only resort I see is to manually delete the NetMeter and Netsight folders from C;/Program Files. Up to you.
    How Can I Reduce My Risk?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •