Heads up and beware - some formerly trustworthy sites hosting free/shareware software are bundling more malware with their downloads. I'm not talking about torrents for pirated software or sketchy sites. I'm talking about reputable free software or shareware/donation ware hosted on sites that for many years were considered trustworthy.
Generally these are opt-out installations - pre-checked by default so you have to uncheck them manually. So watch every pop-up box *very* carefully during the installation process. These are sneaky bastards and it's easy to overlook the fine print and pre-checked box giving permission to install the crapware.
After going years with any malware problems on my older PCs (WinXP and earlier) I've encountered two in just a few months with my new Win7 PCs, both obtain from formerly reliable sites/hosts that appear to have sold out against the best interests of potential customers:
- Babylon toolbar - a pesky but fairly innocuous toolbar and browser search redirect;
- Fun Moods & Fun Dial - potentially more hazardous toolbar/browser search redirect and dialer.
- Irfanview - probably a false positive but be cautious anyway.
Regarding Babylon, Fun Moods and Fun Dial, there are plenty of specific complaints and recommended solutions already online so I'll just summarize my experiences. These aren't viruses, but they are bad pookie. Fun Moods/Dial in particular crosses the line from toolbar adware to scamware.
After getting a new Windows 7 PC this year I wanted to add some old favorite programs: the PIRCH98 chat client, which I've used for years on Starchat; and Audiograbber, a CD ripping program that's also very handy for off-air radio recordings. I'd downloaded and installed both several years ago without incident on my older Win98 and WinXP machines.
The first incident occurred a few months ago after downloading and installing PIRCH98, an old school, low resource and very good IRC client that's unfortunately no longer supported. Offhand I don't recall which site I downloaded it from - it may have been oldversion.com, but I can't find my notes from that incident. My brain was on autopilot when I installed it and didn't notice the word "Babylon" until I'd already confirmed the installation. Sure enough, it redirected Firefox from Google to Babylon search by default. Babylon isn't inherently evil - it offers an English-to-Hebrew and Hebrew-English translator among other features, so it might be useful to some folks. But the way it's marketed and installed as a redirect puts it into the crapware category.
Fortunately Babylon was relatively easy to uninstall - again, you'll find instructions online.
Last night I decided to install Audiograbber on my new laptop. It's readily available via the programmer's own site and I'd installed it on the new desktop earlier this year without any problems. Unfortunately it appears that since then the downloader has been bundled with Fun Moods/Fun Dial crapware. Since the site used to be trustworthy I just zipped through the installation steps on autopilot and barely noticed a new pre-checked box giving permission to install the crapware. My mistake.
But this was a really crappy thing for the developer and site owner to do and I will no longer recommend Audiograbber even tho' it's an excellent program. I'm hoping this was not intentional by the developer and perhaps he farmed out the hosting to another party that was responsible for bundling the malware.
Long story short, Fun Moods/Fun Dialer is the sneakiest bastard I've encountered since 2005 when I had to detox a relative's then-new WinXP machine. And I was surprised to see dialer malware in 2012 - last time I saw one of those was in the early 2000s.
Fun Moods/Fun Dial will hijack every browser installed on your PC - IE, Firefox, Chrome, etc. Even Babylon didn't do that. The usual uninstall procedures will not be effective because "Fun" buries itself in the registry and reinstalls every time you reboot. Removing it from the browser is only a temporary fix.
Fortunately Malwarebytes dug "Fun" out of the registry. Unfortunately the freebie version of Malwarebytes didn't play nice with my Lenovo laptop and wouldn't allow a proper reboot. Eventually I had to uninstall Malwarebytes and use a restore point to a couple of days ago. No great loss and I didn't lose any data. This problem with Malwarebytes seems to be an isolated incident - I'd used it successfully on my Acer desktop. I'll shoot a question to Malwarebytes and see what they say. It seems to be a good anti-malware utility, certainly better than McAfee which itself has gotten closer to crapware with endless nag screens.
The Irfanview issue was puzzling. I've used this popular free/share/donorware image utility for years without incident. But recently various anti-malware programs have flagged the installer as being suspicious.
Anyway, be very careful, even with programs and sites that used to be trustworthy. (Note to self: Don't go on autopilot during the installation process!)
Updated 8/11/12 with a few relevant article links:
"The Download.com Debacle: What CNET Needs to Do to Make it Right""CNet's Download.com secretly installs adware with open/free downloads""Popular network tool Nmap in CNET security brouhaha"
Show Posts
