Upon startup, this program downloads a file called "monitor.txt" from http://web.onetel.com/~tghewett1/monitor.txt. That file is now gone, but at the time of the original review being written the file contained the following entries:

wendell@moultrie.com 0 -
diamondjr1@aol.com 1 -
roshi@aol.com 0 -
bigdee762002@yahoo.com 0 -
fcpeditor2@mac.com 0 -
marigov@gmail.com 1 -
minervini@charter.net 0 -
orders@militariacourses.com 0 -
carmen@amana-key.com.br 2 http://web.onetel.com/~tghewett1/find.sh
antonio.miccoli1@tin.it 1 -
kagi-reg@henninger.com 0 -
gmunger@triad.rr.com 0 -
burke@silly.com 0 -
scott@third-row.com 0 -

What is interesting is that for certain users, the vendor can execute arbitrary scripts on their machines. For example, if we check the contents of find.sh as shown above, we see the following:

#! /bin/tcsh

find "/Volumes/MacOS 9.2.2" -name *DVBackup* -print > /dev/console

This script searches a users machine for the vendor's product. He could conceivably execute or install any type of software.

To verify any of the information I have provided please contact me, or just run this software and monitor (without making any changes to the software) your internet connection.