Please advise on Nielsen NetRatings

[xx521xx]

Hi, I'm looking for someone to advise me on a program called Nielsen Netratings (or Netmeter). What is this program? Is it malicious? Undesirable? Safe? I've searched the web and found nothing more detailed than various reports of "this is a suspicious process" or "this is a safe process". Can you tell me any more about what this program does?

Here's my situation: a family member installed this program (or tried to) earlier today. She allowed the addition of a global startup entry. Later, I logged on and the program tried to add two more startup entries, which I blocked with Spybot. Despite this, the program already had three processes running as seen in the task manager. I killed the processes and removed the original startup entry.

Anyway, my question is... where should I go from here? Should I allow the program to run? I was going to uninstall it, but the program is conspicuously absent from the add/remove programs list...

Has any damage been done by this program being allowed to run previously? Am I just being overly paranoid? Please let me know if you need more information or an HJT log. My HJT results look OK to me, (no change compared to results before installation) but I'm no expert.

Here are the entries in my Spybot S&D log file:

3/4/2009 9:40:03 AM Allowed (based on user decision) value "NielsenOnline" (new data: "C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe") added in System Startup global entry!
3/4/2009 4:54:41 PM Denied (based on user decision) value "NetMeter" (new data: "C:\Program Files\NetRatingsNetmeter\NetMeter\NielsenOnline.exe") added in System Startup global entry!
3/4/2009 4:54:43 PM Denied (based on user decision) value "NetMeterInstall" (new data: "rundll32.exe "C:\Program Files\NetRatingsNetmeter\NetMeter\nmobsvr.dll",InstallComponent") added in System Startup global entry!
3/4/2009 4:56:19 PM Allowed (based on user decision) value "NielsenOnline" (new data: "") deleted in System Startup global entry!

[shelf life]

hi xx521xx,

Nielsen Netratings and Netmeter are two different things. Netmeter is a bandwidth monitor. The other sounds like something bundled as a third party add-on to monitor web sites visited or something like that, probably not anything useful. You can post your add/remove programs list using hjt, like this:

Iam in linux now and doing this from (bad) memory, should be close;

Start hjt, click on 'open misc tools section'
click on 'uninstall manager'
click on 'uninstall list'

something like that anyway. You can copy/paste the list in your reply.

[xx521xx]

Thanks for the reply. When I searched for info on NielsenOnline.exe, I only found results relating to NetRatings, but I guess Nielsen has multiple programs out there using the same filename.

Here is my rather lengthy uninstall list. Two notes: I know CouponBar is considered adware, but I have a family member that uses it. Also, Homescan is another Nielsen program and is also used by a family member.

[shelf life]

hi xx521xx,

I dont see anything in the list. After a closer look it looks like Netmeter is part of the 'package' You say you have hjt installed? Please scan and post a hjt log for me.

[xx521xx]

Sure thing.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:56:54 PM, on 3/7/2009

End of file - 10990 bytes

[shelf life]

hi,

Dont see anything relating to it in the log. I doubt its any worse than CouponBar thats installed. I am surprised its not listed in the add/remove programs panel. Take a look in these two folders:

C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe"
See if you see a uninstall icon, may also be called unwise.exe or unins000.exe.

and also this one
C:\Program Files\NetRatingsNetmeter\NetMeter\NielsenOnline.exe"

[xx521xx]

Well, I don't see any obvious uninstaller in either folder. There is apparently an installer in each one. These are the EXEs I found in those folders:

C:\Program Files\NetRatingsNetmeter\NetMeter\NeilsenOnline.exe
C:\Program Files\NetRatingsNetmeter\NetMeter\NeilsenOnlineInstall.exe
C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
C:\Program Files\NetRatingsNetSight\NetSight\nsmgrutil.exe
C:\Program Files\NetRatingsNetSight\NetSight\NSSetup.exe
C:\Program Files\NetRatingsNetSight\NetSight\download\npiptool.exe
C:\Program Files\NetRatingsNetSight\NetSight\download\npshtool.exe
C:\Program Files\NetRatingsNetSight\NetSight\download\nsstmt.exe
C:\Program Files\NetRatingsNetSight\NetSight\meter1\npiptool.exe
C:\Program Files\NetRatingsNetSight\NetSight\meter1\npshtool.exe
C:\Program Files\NetRatingsNetSight\NetSight\meter1\nsstmt.exe

[shelf life]

thanks for the info. Does Spybot flag these items after a scan? If so I would let Spybot remove them. A last resort would be to manually delete the folders from C:/Program files.

[xx521xx]

Spybot doesn't detect any malware when I use it to scan those folders. Neither do AntiVir or MalwareBytes' Anti-Malware. I uploaded some of those files to VirusTotal, and some of them had detections from a few anti-malware programs. It was mostly heuristic detections, but there was one file specifically flagged by a single anti-malware program as "Riskware.AdTool.NeilsenOn.W32" (not 100% sure that was the exact name, but it was close).

On a somewhat-related note, you mentioned that it might not be any worse than CouponBar, but what is it that makes CouponBar a threat? As far as I know, it's disliked because it adds a toolbar to IE and doesn't remove all its files when uninstalled. Is there anything else I should know about it?

[shelf life]

hi xx521xx,

CouponBar a threat?

I suppose its due to the information they can collect about you based on your web habits. It may not be classified as "spyware" but a nice collection (profile) of information could be collected using cookies, web beacons, sites visited, ads clicked on etc

there privacy policy:
http://www.coupons.com/corp/source/u...olicy.asp?vf=y

"Consumer Profiling and Tracking Cookies "
http://www.worldprivacyforum.org/cookieoptout.html

Since Spybot and Malwarebytes dosnt flag either one as malware you can leave it if you want. Since its not flagged or in the add/remove programs panel the only resort I see is to manually delete the NetMeter and Netsight folders from C;/Program Files. Up to you.