In his article, Austin points out that the Download.com installer, wraps a bunch of crapware in it when trying to install certain programs. But it doesn’t end with just that. CNET allows individual installers with bundled crapware through too.
My Crapware Experience on CNET
Note: In this article I’m throwing around terms like adware, crapware, spyware, junkware…etc. While each term has an “official” definition, let’s not argue semantics. In the end, it’s all the same, extra junk on your computer that you don’t want, and is detrimental to your system and your privacy. I didn’t go as far as allow my system to get infected like Austin did…cheer’s to him for going all the way so you don’t have to! But I’ll give you a synopsis of my experience of getting hassled to download laughable crap. I started my test by picking a programs from the “Most Popular Downloads” list: Free YouTube Downloader.
When I got to the download page, I noticed this CNET Editor’s note letting me know something suspicious was about to happen.
First Attempt to Install Malware on My Computer
I proceeded to click the “CNET Secure Download Now” button – but I never did get CNET’s installer or “download manager” — whatever they call it. When the installer started, I was presented with the “Recommended” method. The Recommended method, of course, would include a Delta Toolbar to make my browsing and searching the internet faster and easier! Oh, and it would also hijack my default search engine, home page, and new tab page…um no thanks!
Well, let’s see what the Advanced install presented me with. Surely something easy to just install the app right? Not quite. First, I had to make sure an uncheck all options of the Delta crapware. Another important thing to point out here, is you have to uncheck each item from the bottom up. If you just uncheck the first box ‘Install Delta Toolbar” does NOT uncheck the other hijack items. But notice, even after unchecking those boxes, it still says “by clicking “Next” you accept the legal terms of Delta Toolbar.” So what is the Delta Toolbar anyway? Well, I did some research and immediately the results were full of links to “How to remove the malware app delta toolbar.” This site gave me the best information on it. The toolbar is created by a company called Babylon LTD. Here’s what it does:
Second Attempt to Pile Crapware on My Computer
It didn’t stop there. Here’s another offer for Safe Saver – another toolbar, search engine and homepage hijack…sigh…Decline. If you’re interested, you can check out the Safe Saver EULA and will quickly discover it will do the same thing the Delta Toolbar does.
Third Try to Install Worthless Software on my PC
Seriously? You’re going to nail me with a third chance to install you’re wonderful crapware? I can’t help but laugh at the fact this “snake-oil” called RegClean Pro claims to increase my computer speed up to 300%!!!! That’s amazing! Almost as amazing as the One Simple Trick we Found on April 1st this year to Fix EVERY Computer Problem Ever!
After the third decline, it started installing “something” but I quickly aborted it before anything could finish. Enough with this already…Hey CNET, 2002 called and it wants its Spyware and Adware back! Well, I guess the company does need to pay for the cost of hosting the files on a server that millions of people download from every day. Oh wait, they have ads for that, and the parent company is CBS Broadcasting, Inc. How much did advertisers pay last year for a 30 second commercial spot during the super bowl? In fairness, the company gives you the choice to opt out of the bundled junkware, but it shouldn’t be so difficult. Interestingly, I found that RegClean Pro is available on Download.com and when you hover over the Download Now button, you’ll see the following message:
You’re told a tiny ad supported download manager will be installed. But it’s not consistent throughout the site. For instance, this is what you see if you hover the mouse over the Download Now button on the YouTube Downloader. “CNET hosts this file and has scanned it to ensure it is virus and spyware free.” This statement, enters a murky and shady gray area. I guess, the statement is true that the program file itself is Spyware free, however, the way CNET allows these installers through with tons of malicious crap means it’s NOT crapware free – far from it.
Conclusion: Stay Away From Download Sites
Unfortunately bundling this junkware is an industry wide practice. The public doesn’t seem to want to pay a fair price for a piece of software, so developers, if they want to make money, need to bundle in this adware crap into their installers. You’ll find similar practices on other download sites such as Softpedia, Filehippo, and others. Even if download sites don’t have a specific malware infested installer, they the sites have “Download Here”, “Start Download” type buttons all over, making it extremely confusing for less experienced users to get what they want, and not a bunch of other crap that they don’t. For example, here’s the fine print when installing something from Filehippo:
This is why we always recommend to either download your software directly from the developer (even though there you can experience the same bundled crap) — or install from Ninite.com — this service automatically opts you out of any toolbars or other crap an installer tries to sneak on. And always pay attention to what you’re installing folks. Don’t just blindly click Next > Next > Agree >Install. To be clear, neither groovyPost or myself has an issue with the writers, or CNET in general. In fact I enjoy several articles from respected journalist who work at the site and other properties of CBS broadcasting, Inc. However, this practice of wrapping pure crapware in its installer package, and allowing developers to bundle spyware and other malware in their software installers, is a horrible practice for it’s readers. Especially since the company claims everything on Download.com is malware free. Note: I reached out to CNET to get a response as to why it includes crapware on its Download.com page, and am awaiting a response. When and if they do reply, I will certainly include it here. Update 7/22/2013 1:32pm CST: I’ve tried to reach several different reps in the company, and so far, this is the only canned response I have gotten: Well, first of all, I have gone through and looked at several different programs offered on Download.com, and most of them simply don’t have the “Direct Download Link” just the big green button — which has crapware, as Austin pointed out in his article. Second, even if you do see the direct link, if the developer has their program wrapped in a crapware installer, you still have to deal with it. You do have a couple of options to download without using the CNET Download.com Installer – you can either click the Direct Download Link for Installer Enabled items, or, if you have a CNET account, completely disable the Installer for the whole site. Read more about those options here: http://t.cnet.com/15t7hv0 For more detailed information on the CNET Download.com Installer, please visit the following resource: http://t.cnet.com/SB3tiC Regards, Jen CNET Customer Help Now, I have not created a CNET account, and found an option to disable the installer for the whole site. That is next on my list we continue to investigate. If you’re not comfortable doing that, or don’t want to go to that extreme, check out my article on how to completely remove software: https://www.groovypost.com/howto/windows-completely-uninstall-software/ Also, you might want to run programs like Malwarebyte’s, CCleaner, and SuperAntiSpyware. In the future, I will never hit Next > Next > Agree >Install again. We all need to be diligent in making the right choices with this type of stuff, and let companies who practice this behavior know we’re not happy with it! Thank you Brian. I never comment but I felt I just had to thank you for this post THANKS for your efforts. Let us know when/if CNET responds with anything other than “canned” gibberish i.e. “the only way to say less is to talk more” The following are types of software we will not accept: …(other criteria) … Software that diverts or modifies end users’ default browsers, search-engine home pages, providers, security, or privacy-protection settings. Her article is at http://howto.cnet.com/8301-11310_39-57405342-285/how-to-download-videos-from-youtube-vimeo-and-more/ if anyone cares But yes, that is a hilarious story! Anyone else have an account and experience the same results as this? Lightspeed to today, In our quest for getting what we want yesterday, we click “…already!” and then find we have all this stuff that we didn’t know where it came from. The lesson is, be observant when installing software. Know what you want to install before downloading it and take your time, as you know the computer probably will….Be sure to read the prompts. If you aren’t sure about a program, write it down, say no and move on. After it downloads, you can research the “it sounds like it might be interesting” program/app for possible download/install later. Your advice is good and would protect the user/downloader if both sides played “fair and honest”. PROBLEM is only you and the people using your advice are playing “fair and honest” CNET/ Download.com is being neither “fair and/or honest” Two really devious and downright DISHONEST examples are listed. 1. You click “Decline” or “No do not install” the crap ware. CNET/Download.com ignores your request and installs even though you explicitly said NO. 2. You run the CNET/Download.com uninstaller, thinking/trusting it works like the name says and all other installers. WRONG, only some files that you can see in the directory (and that do not make a difference) are removed. The crapware and other files that track you and slow down your computer are left in place. For all we know, additional hidden crapware/ tracker files might also be installed; running the uninstall had give CNET/Download.com access to your computer. (Note – some uninstallers do leave behind empty folders that have to be removed, but they are not harmful). 3 All though not mentioned in the article and follow up, just selecting or clicking o DOWNLOAD button on a CNET/Download.com site started installing crapware on my computer. This was even before the next screen appeared giving me the choice to accept or decline the crapware. My realtime AV & maleware program immediately blocked two attempts to install known maleware (crapware). So, CNET/Download.com is truly not to be trusted and has joined the DARK SIDE. Leave CNET/Download.com alone and if enough people do they might get the message. You ought to head over to our Ask the Readers poll for this wek — it’s about where you download your software crap and junkware free! Here’s the link: https://www.groovypost.com/unplugged/ask-readers-where-you-download-pc-software-from/ Thanks again for your due diligence on this subject — if you’d like to do a guest post addressing your frustration on it all, and including the research you’ve shared — shoot me an email we’d love to feature your thoughts in a nicely laid out article — as not everyone reads comments. Thank! Thanks! It happened to me, and I spent hours cleaning up the mess it left behind. It would do you good (and everyone else) to read it & look carefully at the screen shots. https://www.groovypost.com/howto/avoid-computer-bloatware-from-cnet-download-com-crapware/ The “lesson” you mention is old news now. The scumbags have a workaround. strange, that it took so long for it to hit GP… Ben Millions of people get applications from there all the time, and Austin first showed how to avoid it. If you can: https://www.groovypost.com/howto/avoid-computer-bloatware-from-cnet-download-com-crapware/ Then I wanted to just confirm it, try to add more details on it, and included a reply from their customer serve — which is obviously a canned response, as well as totally inaccurate. Thanks for the history. Reading the comments does say CNET/Download.com was doing the same devious, evil tricks two years ago, maybe not to the same extent as today. Maybe it was the start of CNET/Download.com long journey to the far reaches of the DARK SIDE. The following excerpt is an attempt by CNET/Download.com to justify their action using corporate double speak and a rebuttal by UltraVNC. Read the entire article. Be interesting to compare any reply from CNET/Download.com to what they said two years ago Bottom line: CNET/Download.com words and statements CAN IN NO WAY BE TRUSTED. THEY ARE DISHONEST, UNSCROUPULOUS, LIARS. Download.com is also devious designed to take advantage of users. excerpt from: http://forum.ultravnc.info/viewtopic.php?f=6&t=28692&sid=0e8bf6c3a4f88426c2d1cfce26e1d047 Re: Do NOT Use CNet / Download.com – Spyware ! Postby Peter.Butler.DLcom » 2011-10-17 19:35 Hello there, UltraVNC community. After receiving and reading a large amount of feedback about the new Download.com Installer, we’ve identified three main sources of questions and confusion:
- The security and safety of the Download.com Installer software itself 2. The security and quality of the included offers in the the Download.com Installer 3. Download.com’s rationale for using the Installer
- The Download.com Installer does not include any spyware or malware, nor do any of the offers included in the Download.com Installer. The Download.com Installer is optional and does not install anything to your computer, nor leave behind any components when deleted. We have worked with security publishers to ensure that the Download.com Installer conforms with the necessary standards of security. There are a very few products that identify the Download.com Installer as malware; we believe those results are false-positive detections, and we are working hard to correct those problems by providing access to the Installer to security publishers and tweaking it as necessary to meet their guidelines.
- The Download.com staff vets every offer included in the Download.com Installer to make sure that they all meet our standards of acceptability. We have reacted quickly to negative comments about offers from our users, and we will continue to do so. Additionally, we are actively working with our network of software publishers so that we can continue to add new, quality offers to the Installer flow.
- The Download.com Installer is designed to make installing software easier for our users, and to grow our business so that we may continue to invest in new, more efficient means of distributing software around the world. Research and user feedback indicates that many people who download software don’t or can’t install it. One consistent installer logo for all software from Download.com allows users to easily find and launch the software that they have downloaded. The Download.com logo and installer also demonstrate that the software has been fully tested and found secure. Thank you for the feedback thus far. We are very interested in what our users and developers have to say, and we look forward to hearing more as we iterate on this new feature. Cheers, Peter Butler Senior Catalog Manager Download.com Peter.Butler.DLcom Special guest Special guest Posts: 1Joined: 2011-10-17 19:14 Top ——————————————————————————– Re: Do NOT Use CNet / Download.com – Spyware ! Postby B » 2011-10-17 19:52 Ludicrous! “The Download.com Installer is optional and does not install anything to your computer, nor leave behind any components when deleted.” The “installer” doesn’t INSTALL anything? It’s “optional” but you can’t get the program you want without running it? What kind of new level of corporate nonsense is this? I’m sure you’re aware that the terms spyware and adware long ago became inexorably intertwined (security professionals see little or no difference). CNet’s installer’s reason for existence is to deliver adware, and thus the installer itself is reasonably called Spyware. Nearly every program CNET offered (or has ever offered) for download ALREADY INCLUDED its own installer. You are fooling absolutely no one. There is absolutely no VALID reason to do what you’ve done, other than your apparent desire to destroy your spam. But thanks for stopping by and trying to stem the bad press resulting from your hostile actions against your previous user base. I expect your recent download stats are reflective of your new spyware status? B Super-Mod Super-Mod Posts: 2363Joined: 2009-09-09 14:05 Top ——————————————————————————– Re: Do NOT Use CNet / Download.com – Spyware ! Postby Oliver » 2011-10-17 21:12 B wrote:I’m sure you’re aware that the terms spyware and adware long ago became inexorably intertwined (security professionals see little or no difference). CNet’s installer’s reason for existence is to deliver adware, and thus the installer itself is reasonably called Spyware. True, but from my time at Lavasoft I can tell you that tagging something one or the other usually means walking a very fine line. Unlike with “real malware” (with which I deal at FRISK nowadays) spyware and adware are in a grey area. @Peter: Peter.Butler.DLcom wrote:1. The Download.com Installer does not include any spyware or malware, nor do any of the offers included in the Download.com Installer. The Download.com Installer is optional and does not install anything to your computer, nor leave behind any components when deleted. Optional but default, right? I just tried to download WinDirStat of which I am the current maintainer and I couldn’t really find an option to get the download without your installer. The next release of WDS, for example, will be signed with my own Authenticode cert and therefore a wrapper rather disguises that information, don’t you think? Peter.Butler.DLcom wrote:3. The Download.com Installer is designed to make installing software easier for our users, and to grow our business so that we may continue to invest in new, more efficient means of distributing software around the world. Peter.Butler.DLcom wrote:Research and user feedback indicates that many people who download software don’t or can’t install it. From feedback of WDS users I concur. The problem, more often than not, seems to be PEBKAC. Peter.Butler.DLcom wrote:One consistent installer logo for all software from Download.com allows users to easily find and launch the software that they have downloaded. The Download.com logo and installer also demonstrate that the software has been fully tested and found secure. This actually does make sense to me, however, wouldn’t something along the lines of the Ubuntu software center just for Windows be a better choice? Because from what I see your installer doesn’t really solve a problem for adept users, only for those who are insecure. Adept users would probably love a package manager of a kind where they would get update/upgrade notifications for their favorite software instead of having to do that in every single piece of software. I for one would love it. The package management on Debian/Ubuntu is one of those major advantages those systems have over Windows and nothing is in sight that would change the situation for the better (on Windows) … Edit: @B: the installers from CNET are signed. So they are kind of betting their reputation that the contained software is clean. Kevin, Thanks for your feedback; we have shared your comments with the appropriate site managers. As you may already be aware, you do have a couple of options to download without using the CNET Download.com Installer – you can either click the Direct Download Link for Installer Enabled items, or, if you have a CNET account, completely disable the Installer for the whole site. Read more about those options here: http://t.cnet.com/15t7hv0 For more detailed information on the CNET Download.com Installer, please visit the following resource: http://t.cnet.com/SB3tiC why buy, when the original is already freeware?
anyone who can’t successfully navigate their little minefield without stepping on one probably shouldn’t be installing software on their computers anyway. Here I do have to agree with you… I agree with you both – people should read – like that article. Too bad the author of this article didn’t include more of a summary of Austin’s article, which might have prevented some of the condescending comments. Both of these are things that Austin did that may or may not have created part of this. On the surface it seems impossible that if he declined Sweet Peas and aborted the install himself that any part of it should have taken place. However in a lot of these situations clicking back through a box or two can often reset the previous box to the default choice and you don’t notice this while clicking back and forth. So in his efforts to capture screenshots for his article, is it possible clicking from box to box caused the first box to change to a default setting he didn’t want? I think there is that slight possibility, simply because I used it today and had a different experience than he did. YMMV. Fun stuff on the internet today. ;) Thanks. I am very careful with CNET (and everything too as SOFTPEDIA is no better). What I got was DEALPLY, MY PC BACKUP and the ASK toolbar AGAIN!!!! (I honestly did say no to the only choice I got, and the rest was all automated) – I was several fee from the keyboard, watching what appeared to be “ads” flit by in the installer (they were the other software it was installing). :( So, I saw a few very rapid things go across the CNET download manger window which looked like banner ads. It turns out they were telling me what extra software they were foisting on me. I never got to say “no” & there wer not any other links or buttons to click. It did it all automatically. Two clicks (clicking “download” and opting out of something) got me a zip files of drivers, and 3 extra pieces of software which were automatically installed on my PC . I tried lots of way to kill ASK. They did not work. Microsoft standard “uninstall” no longer works & neither does the ASK uninstall, or deleting the ASK “Program Files” directory, or removing the registry entries that have references to it. I read one site where SYS ADMIN swears that ask even changes the the system restore points on the PCs in his place of business, those that got infected where he works. As a result trying to restore form a stable point, brought back all the crap he spent the last 3 days getting rid of (like he had done nothing at all – and it was an OLD restore point too). I used several pieces of anti-malware software to try and get rid of it, and although each anti-malware software application “claimed” to have killed the “Ask toolbar” the only one that DID was MALWAREBYTES antimalware, which I had to get from a site other than that of the manufacturer because MALWAREBYTES hosts their official free download on the CNET store!They link to CNET! I wasn’t about to get yet MORE unwanted software that I have no choice about installing. This time it really was all automatic. I did not even get any deceptive install/download screens for those other applications, which I had to very cautiously “DECLINE” I also got the “zero access root kit” from CNET I have an app listed on download.com, I’ve sent them an email to cnet-installer@cbsinteractive.com kindly asking for installer to be removed and they answered with positive reply on the same day. It’s updated in 2014 which resulted in them putting the dreaded installer but now it’s gone. I told them I can’t put up their download button on my sites if there’s 3rd party software shipped which I have no control of. Comment Name * Email *
Δ Save my name and email and send me emails as new comments are made to this post.
