Hi Morgwen. I think you have some good points. We try to investigate all our bundled software carefully. But these vendors don't include source code, so at some point we have to just trust their word. I was under the impression that clicktilluwin just installed an icon. Other vendors--BearShare, Kazaa, and Grokster--were burned by this as well.

In the future, we hope to stick with a small number of trusted vendors. We are also becoming increasingly vigilant. For example, when LimeWire users reported seeing Aureate on their systems we investigated carefully. In this case it turned out that it was a false alarm caused by the cache of the Cydoor ad delivery system. We would have NEVER installed Aureate.