This was received here at Lockergnome recently. For obvious reasons, I will forgo including the name of the sender. But it has me curious - could this be a simple matter of confusing an instance of one application with another or can others out there duplicate this as well? Here is the email:

It is almost 4:00 AM and I just finished a spyware battle that was the scariest thing (from a privacy standpoint) that I’ve seen in…well maybe forever.

As far as I can tell, Adobe Acrobat Reader version 8 has spyware in it that causes data to be sent from a PC to www.dhs.gov. Yes, I know that sounds crazy, but I was sitting here watching it happen with my own eyes.

Here’s how I discovered this. Maybe you can replicate it also? I saved a copy of the Acrobat Reader install file from work (Army related work) and went to install it on my home PC. This PC has Comodo firewall and a DNS caching program from Analog X called FastCache.

I first noticed that my browsing was slow and then stopped completely with page timeouts. I next noticed that even though I was not downloading any pages there was still data flowing through my LAN connection. I opened up Comodo’s “Activity” then “Connections” log. It showed that Fast cache was sending data OUT to my external router. I right clicked on fast cache to view its log of connections and there were literally thousands of log entries pointing to  www.dhs.gov It sent out about 45 Megs before I thought to just right click on the Comodo icon and terminate the connection by setting it to “block all” connections.

I had never had this problem before and as soon as I uninstalled Adobe Acrobat the problem disappeared. I should have taken some screenshots but I was too busy trying to stop it.

Needless to say, this computer now has Foxit PDF reader installed!

Now, I may not be a security expert. But if the government was going to be snoop, it would more likely be something like the FBI’s Carnivore program and it would be to some hard to track IP address, not a clearly identifiable website. In other words, the Fed is much smoother than this.

What’s interesting, is that something else may be running on this person’s machine, giving the appearance that data is being sent this way, which does not have any sort of clear reasoning as to why from what I can tell. So I have to ask. Tinfoil hats aside, has anyone heard of a spyware program that does this sort of thing? Because let me tell you, this is unlike anything I have ever heard of, that’s for sure.

[tags]security, spyware, privacy[/tags]