Clickfree update installs adware: what are my practical and legal options?

Clickfree makes an external hard drive with built in backup software. Because of its alleged ease of use, they charge an inflated price relative to Seagate, Western Digital and the like. I purchased it with reluctance after Win7 started re-assigning drive letters and playing havoc with Syncback, my old backup software. I wish I had just de-bugged that problem.

During Clickfree’s last automatic update, they installed some adware. Each day it plays a loud and inane one minute advertisement for another of their products. It does this before the backup starts. Tech support won’t tell me how to stop the intrusive advertising from starting every time it backs up. They say I can’t revert back to an older version of the software. When I attempted to roll back with a system restore, it didn’t work. I think the problem is that some of the software is directly on the external hard drive and I never backed up that.

I could not locate too much info on the internet about this issue, but here’s one report.

Practical Options, as I understand them:

  1. Work with the sticky How to protect and clean your computer from malware. The confusing part here is that I want to keep backing up my computer. I just don’t want to listen to a loud one minute ad daily. The backup time occasionally resets itself and I really don’t want it to go off when I’m sleeping. So anti-spyware software should be of limited use in all probability, right?

  2. Scan my directory for a media file and swap in a silent one. I’ve only done this half-heartedly. And they may not have used an obvious media file. Never purchase a product by Clickfree again.

  3. Disconnect the unit and backup the computer to another hard drive. Use Clickfree intermittently. Never purchase a product by Clickfree again.

  4. The unit has a 3 year warranty. My unit has a manufacturing defect: it keeps sending inane advertisements to my speakers. Attempt to replace the unit under warranty, taking care to erase the data before sending it in. Hope the new version does not contain malware. Never purchase a product by Clickfree again.

  5. Post this problem to a really good computer bulletin board. Suggestions?

  6. We now know that Clickfree will install adware without the consumer’s explicit permission. I can imagine worse things that a hypothetical dishonest company could do with access to the consumer’s rootkit. Is there a good program that can link internet traffic to specific files and software authors on the computer?

  7. Disconnect my speakers. I could do this, though it would be awkward. Are there problems with this solution I should consider?

Legal Questions
The EULAs that I have located make no mention of the adware. Tech support has refused to share with me the EULA associated with the update. Is Clickfree breaking the law? When is it permissible to install malware on another’s computer under false pretenses? Do RICO statutes apply? Is this both a criminal and civil issue? Or neither? The company is Canadian: could executives be extradited? How do class actions start up? I’m not familiar with legal issues regarding possible white collar crime.

Are their appropriate legal authorities who should be informed of this? Are there appropriate non-governmental organizations who should be informed? What is the appropriate action that law abiding citizens should take?

EULA’s have a shaky legal ground, but in the US it seems they are not per se unenforceable or unconscionable, though individual examples have been deemed such based on a totality of the circumstances analysis. If you were never shown a copy of the EULA for the update, this would seem like a textbook case where such an EULA (if it actually exists, which is pure speculation on your part), could not be legally binding. EULA’s are based on at least giving you a contract of adhesion/take it or leave it scenario. If even that is lacking, there’s no way you can say there was anything remotely resembling a meeting of the minds, one sided or not. If I could give out software to people without a clear indication of terms, and then come around a few months later and claim, “oh, I didn’t tell you, but there was an EULA attached to my software. The terms require you to pay me $100 a month. Pay up”, I could make millions duping people into downloading my crap and then enforcing onerous and arbitrary terms that I claim “were always in the contract”.

I found these Clickfree EULAs on the web. I don’t know whether they apply to my particular product or not. But FWIW, I can’t find language suggesting that they are permitted to install malware on their customer’s machines without their permission. But IANAL and don’t have experience in such matters.

http://wm40.inbox.com/dnl/Standard%20End%20User%20License%20Agreement%20(EULA).htm.aspxx?_cu=lUSRuHDNMDREJfrDk5DN-_pFuFz_ANGRkikWGHPqvSFRIQ9EkO_qwvnE8LgZG0a2Rl9rIgAuUw-WSAcki1u8oGcY@&PATH=0_5_109&V=1

http://wm40.inbox.com/dnl/End-User%20License%20Agreement.htm.aspxx?_cu=lUSRuHDNMDREJfrDk5DN-_pFuFz_ANGRkikWGHPqvSFRIQ9EkO_qwvnE8LgZG0a2Rl9rIgAuUw-WSAcki1u8oGcY@&PATH=0_5_110&V=1

BoingBoing might be interested in this. They’ve done articles about EULA’s and rootkits in the past (and this one really takes the cake).

Thanks tellyworth!

Incidentally, according to the Computer Desktop Encyclopedia, “If adware is installed in the user’s machine without disclosure, it is considered “spyware.” Such programs are often delivered as part of another download the user actually did want but without any notification. Even if there was mention in the license agreement, there is controversy over what is legitimate adware versus spyware, because it is a known fact hardly anyone reads the software license agreement.”

If I am correct that there is indeed no mention in the license agreement, then it follows from that definition that Clickfree is a spyware company, or at least a company that produces spyware.

Also, I’d submit a tip to The Consumerist. A good public shaming often solves these kinds of shenanigans.

Maybe check out the EFF, see if they have had similar cases before or are willing to take this on: Legal Assistance from EFF | Electronic Frontier Foundation

Update

As a first step I started a thread at bleepingcomputer.com. After a couple of weeks, I found a workaround with their much appreciated help.

You mute the sound. I couldn’t get that solution to work with Clickfree’s advertisement player, but Win7 has a sound utility that controls the audio program by program. Here are instructions:

Look at the bottom right hand side of the screen for the speaker icon. If the speaker icon isn’t displayed, open the list of icons and click “Customize”. Scroll to the menu for the speaker icon and choose accordingly. http://i139.photobucket.com/albums/q288/forgoodmeasureM4M/Customize3b.png

Now you have a speaker icon near the date and time. Here it gets sketchy. In the past, starting up a special Clickfree backup would involve pressing UAC buttons and invariably selections would not stick. See the bleepingcomputer thread for details on failed attempts.

Anyway, I recommend you wait until the daily backup occurs. When it does, click the speaker icon and click “Mixer”. The volume mixer dialog displayed here will appear. Click the speaker under the Clickfree app to mute it. Then you should be done. I don’t know how robust this fix is: in the past, adjusting the program in any way tended to undo the fixes. But this will at least hold me until I put together a superior backup system.


Let me take a moment to review kooboodle, Clickfree and the advisability of purchasing the products of a company that installs adware/spyware/malware on computers without the user’s permission. Clickfree is promoting an online photo sharing system that I have no intention of trying. I think it was introduced this year. At the very least it would be prudent to wait for a formal and noncommercial review of their system. I hope it doesn’t just scan your system and automatically upload all jpgs: that could prove embarrassing for certain users. It’s not just pr0n: do you really want to explain something downloaded on a whim like this for example to your friends?

http://wm40.inbox.com/thumbs/53_130b6b_25d6925_oJ.jpg.thumb
“Whiskey-Tango-Foxtrot!”, they might say. There’s a deeper issue. Security researchers have discovered an exploit that bad guys could take advantage of in the case of dropbox. When putting your data up in the cloud, you really want the company to hire top-notch security professionals and not just wing it. I do not know whether Clickfree has conducted such due diligence. But in my opinion installing adware/malware on your computer without opt-out or warning is not indicative of a company that is overly meticulous.

A few bad reviews for Clickfree have appeared at Amazon. I haven’t looked into other options yet. I’m not sure what to do given my kludge.