Beware the crapware

[Zoidberg]

Heads up and beware - some formerly trustworthy sites hosting free/shareware software are bundling more malware with their downloads.  I'm not talking about torrents for pirated software or sketchy sites.  I'm talking about reputable free software or shareware/donation ware hosted on sites that for many years were considered trustworthy.  

Generally these are opt-out installations - pre-checked by default so you have to uncheck them manually.  So watch every pop-up box *very* carefully during the installation process.  These are sneaky bastards and it's easy to overlook the fine print and pre-checked box giving permission to install the crapware.

After going years with any malware problems on my older PCs (WinXP and earlier) I've encountered two in just a few months with my new Win7 PCs, both obtain from formerly reliable sites/hosts that appear to have sold out against the best interests of potential customers:

• Babylon toolbar - a pesky but fairly innocuous toolbar and browser search redirect;
• Fun Moods & Fun Dial - potentially more hazardous toolbar/browser search redirect and dialer.
  
• Irfanview - probably a false positive but be cautious anyway.

Regarding Babylon, Fun Moods and Fun Dial, there are plenty of specific complaints and recommended solutions already online so I'll just summarize my experiences.  These aren't viruses, but they are bad pookie.  Fun Moods/Dial in particular crosses the line from toolbar adware to scamware.

After getting a new Windows 7 PC this year I wanted to add some old favorite programs: the PIRCH98 chat client, which I've used for years on Starchat; and Audiograbber, a CD ripping program that's also very handy for off-air radio recordings.  I'd downloaded and installed both several years ago without incident on my older Win98 and WinXP machines.

The first incident occurred a few months ago after downloading and installing PIRCH98, an old school, low resource and very good IRC client that's unfortunately no longer supported.  Offhand I don't recall which site I downloaded it from - it may have been oldversion.com, but I can't find my notes from that incident.  My brain was on autopilot when I installed it and didn't notice the word "Babylon" until I'd already confirmed the installation.  Sure enough, it redirected Firefox from Google to Babylon search by default.  Babylon isn't inherently evil - it offers an English-to-Hebrew and Hebrew-English translator among other features, so it might be useful to some folks.  But the way it's marketed and installed as a redirect puts it into the crapware category.

Fortunately Babylon was relatively easy to uninstall - again, you'll find instructions online.  

Last night I decided to install Audiograbber on my new laptop.  It's readily available via the programmer's own site and I'd installed it on the new desktop earlier this year without any problems.  Unfortunately it appears that since then the downloader has been bundled with Fun Moods/Fun Dial crapware.  Since the site used to be trustworthy I just zipped through the installation steps on autopilot and barely noticed a new pre-checked box giving permission to install the crapware.  My mistake.  But this was a really crappy thing for the developer and site owner to do and I will no longer recommend Audiograbber even tho' it's an excellent program.  I'm hoping this was not intentional by the developer and perhaps he farmed out the hosting to another party that was responsible for bundling the malware.

Long story short, Fun Moods/Fun Dialer is the sneakiest bastard I've encountered since 2005 when I had to detox a relative's then-new WinXP machine.  And I was surprised to see dialer malware in 2012 - last time I saw one of those was in the early 2000s.

Fun Moods/Fun Dial will hijack every browser installed on your PC - IE, Firefox, Chrome, etc.  Even Babylon didn't do that.  The usual uninstall procedures will not be effective because "Fun" buries itself in the registry and reinstalls every time you reboot.  Removing it from the browser is only a temporary fix.

Fortunately Malwarebytes dug "Fun" out of the registry.  Unfortunately the freebie version of Malwarebytes didn't play nice with my Lenovo laptop and wouldn't allow a proper reboot.  Eventually I had to uninstall Malwarebytes and use a restore point to a couple of days ago.  No great loss and I didn't lose any data.  This problem with Malwarebytes seems to be an isolated incident - I'd used it successfully on my Acer desktop.  I'll shoot a question to Malwarebytes and see what they say.  It seems to be a good anti-malware utility, certainly better than McAfee which itself has gotten closer to crapware with endless nag screens.

The Irfanview issue was puzzling.  I've used this popular free/share/donorware image utility for years without incident.  But recently various anti-malware programs have flagged the installer as being suspicious.

Anyway, be very careful, even with programs and sites that used to be trustworthy.  (Note to self: Don't go on autopilot during the installation process!)
Updated 8/11/12 with a few relevant article links:

"The Download.com Debacle: What CNET Needs to Do to Make it Right"

"CNet's Download.com secretly installs adware with open/free downloads"

"Popular network tool Nmap in CNET security brouhaha"

[cmradio]

Try XnView instead of Irfanview.

Those toolbars and search redirects are horrible.

When I used Windows, I had a program called AdAware that nuked most of those.

Peace!

[Kage]

What about us Linux users?

[ChrisSmolinski]

FWIW: There's a bunch of "download sites" that grab programs from authors' sites, repackage them (possibly with adware or even worse) and then put them up for download on their site. This is almost always done without the permission of the author. If you're looking for a particular program, it is best to find the actual author site, and download it from there, to reduce the chance this kind of problem.

It's a real problem, especially when these sites appear higher in search engine ranking than the actual author site, so you find them first.

[Zoidberg]

FWIW: There's a bunch of "download sites" that grab programs from authors' sites, repackage them (possibly with adware or even worse) and then put them up for download on their site. This is almost always done without the permission of the author. If you're looking for a particular program, it is best to find the actual author site, and download it from there, to reduce the chance this kind of problem.

It's a real problem, especially when these sites appear higher in search engine ranking than the actual author site, so you find them first.

Yup, that's why I always go to the developer's site first.  In this case, the most recent copy of Audiograbber I downloaded directly through the developer's site was bundled with Fun Moods/Fun Dial.  That's what really ticked me off.

It seems to be a recent change.  I downloaded Audiograbber from the developer's site a few months ago and it wasn't bundled with crapware at the time.

Cnet has for years been considered a trustworthy site for downloading freeware, shareware and trial versions.  But they're also bundling somewhat less obnoxious toolbars and other low value crapware.

Regarding Babylon search/toolbar, I don't recall whether I downloaded the copy of PIRCH98 it was bundled with from oldversion, sourceforge, tucows or another site that used to be considered trustworthy.

[cmradio]

What about us Linux users?

We look at threads like these and gloat

Peace!

[Zoidberg]

Dang penguinhedz.

[Zoidberg]

Add another to the "not recommended" list:

AVG Secure Search and Toolbar. 

These are being bundled with downloads from trustworthy sites.  It is necessary to volunteer to install these AVG utilities so these are not sneaky malware.

However I regret to say that AVG has sunk pretty low in value.  I was very satisfied with AVG on my older PCs.  AVG anti-malware worked and uninstalled cleanly.

Unfortunately AVG Toolbar offers little or nothing of value - typical of most toolbars which seldom deliver much of use and tend to just create browser clutter.  I had the same problem with Winamp toolbar - it didn't seem to work well with the web streams I wanted to hear, so it was just clutter.  But at least the Winamp toolbar uninstalled cleanly, no tricks.

AVG Secure Search is basically a net-nanny wrapper around Google.  It duplicates the site ratings of stuff like WOT, McAfee and others.  Annoyingly, Secure Search disables useful features such as auto-complete and preview.  While disabling those might help keep web rookies safe, it's mostly annoying.  And it cannot be customized to minimize intrusiveness.

Note that the best Firefox add-ons like NoScript and Ad Block Plus offer plenty of customization to suit the user while not completely disabling useful web features.  AVG Secure Search is far from competitive with those add-ons.

Worse, the uninstall process for AVG Secure Search is a mess.  Unlike every trustworthy Firefox add-on, using the standard disable/uninstall process will not clear out AVG Secure Search.  Every time I'd restart the browser, it would ignore my default preferences (Google or other) and reset the home page to AVG Secure Search.

The Windows uninstall process was only partially effective.  I had to use extra steps provided by AVG to completely remove AVG Secure Search.

AVG used to offer great value in anti-malware software but they're mostly an aggravation now.  Malwarebytes and others offer much better value and standard clean uninstalls.

[Fansome]

Several years ago I decided to uninstall Winamp, due to adware issues, as I recall. The uninstall process seemed to go smoothly, however, I soon discovered that did not change the system file type associations; trying to open an mp3 file, for instance, would result in an error, since Windows would try to open the file with the non-existent Winamp application. It took me hours to completely clean all Winamp references from the registry and other parts of the OS. I'll never use it again, although I suppose it's possible that nowadays it's better behaved.

[Zoidberg]

I've had good luck with the stand-alone version of Winamp for several years.  Never tried to uninstall it so I haven't experienced that particular problem.  It seems to play well with other audio players/recorders, as long as the file associations are set the way I want.  The Winamp toolbar didn't quite work the way I wanted and uninstalling it was easy.

The worst audio player I can recall was Real Player.

[Pigmeat]

Real Player was terrible. Dell used to stick you with it when you bought their machines.

AVG started acting more like a virus on me than a piece of software designed to sniff 'em out. Pain in the ass to get rid of, similar to Al's struggles with Winamp.

[ChrisSmolinski]

Real Player was terrible. Dell used to stick you with it when you bought their machines.

AVG started acting more like a virus on me than a piece of software designed to sniff 'em out. Pain in the ass to get rid of, similar to Al's struggles with Winamp.

Wait until PCs start coming with pre-loaded SDR software.

[John Poet]

I've never had any problems with Winamp... but I'm still using an older version of it which I refuse to update.  I've also not allowed any internet connections through it to my PC-- just to prevent any bandwidth leakage more than anything else.

The associations were tricky for awhile, until I figured out how I wanted them set up-- to play all .wav, mp3 or CD files, and nothing else.

[Pigmeat]

Real Player was terrible. Dell used to stick you with it when you bought their machines.

AVG started acting more like a virus on me than a piece of software designed to sniff 'em out. Pain in the ass to get rid of, similar to Al's struggles with Winamp.

Wait until PCs start coming with pre-loaded SDR software.

You just made Al's comb-over stand straight up,Chris.