iGive behaves as malicious spyware

[gsellis]

One of the organizations my kids are associated with just asked everyone to use iGive for their purchases to raise money. Well... while I was trying to figure out why our USB ports weren't working (a mouse may have damage them when it shorted), I kept seeing a process, while a browser was not open, take serious CPU cycles. Investigating, everything I saw cried spyware. Although in Program Files, the names were muxed up to be a little confusing. There was a BHO and a Windows Run entry that the executable would rewrite immediately when deleted. There were multiple instances running and if you killed one, the others would start it again. If you tried to uninstall, it took you to their web to "uninstall" and even clicking agreement, it never did uninstall the BHO or the executables on the local machine. Those keep running even if you uninstalled and restarted. MALWARE is my call. I removed it using Windows PE (safe mode, Bart's PE, or Recovery Console will also work). Deleting the files in the directory will work, but you will need to use RMDIR /S as there appear to be hidden files.

I cannot find on the web any note in their agreement about the software. I did not install the iGive component, so did not read that licensing agreement, but I would suspect that most users will not understand what is involved.