Saturday, August 13, 2011

The strange case of StartNow malware

Yesterday, after I downloaded WinRAR (from Cnet, here), I found that I had also installed something called StartNow, a toolbar for my browsers that also changed my home page on both Chrome and Firefox.

StartNow installed immediately after WinRAR
 I did some searches and found that this has happened to others.

What is strange about this case?  A few things.  First, both CNET and WinRAR have a decent reputation. Second, the StartNow malware makes no attempt to hide. The program even has an "uninstall" option that seems to work.  I carried out standard removal of the extension/addon, changed the homepage back and removed StartNow using their own uninstall option.  Unlike other malware sites, startnow has their own web site ( and a support page that tells you how to remove their software (here).  Now that I've done so, everything seems fine (but I  do wonder if the other shoe might fall soon).  StartNow looks like a case of people who made a product that does something useful (although I still have no clue what that might be), who crossed the line into MalWare but don't realize they have done so.

Labels: ,


Post a Comment

<< Home