Mind the PUP: Top download portals to avoid

starbuck

Malware Removal Specialist - Administrator
In Memory
Joined
Jul 16, 2014
Messages
1,147
Location
Midlands, England
We recently researched how many potentially unwanted programs (PUPs) come with the 50 most popular applications on Download.com. Since the results were quite disturbing, we decided to look into the habits of other popular download portals to see if they are any better, or whether it’s better to avoid download portals altogether. Most of them claim to have “clean and safe downloads” and many portals express this on their website. However, trusting any download portal at all is becoming a difficult task for most people due to the rapid growth of bundled PUPs and the software reviews on the sites that often don’t seem objective.

We looked into the ten most popular download portals, downloaded their top ten most popular applications to see how many toolbars, adware, homepage hijackers and other PUPs come with them to see how clean and safe they really are.

What are the top 10 applications on each download portal?

First, here is a list of the top 10 most popular downloads per download portal that we used for this article:
  • Download.com – Avast Free Antivirus, AVG Free Antivirus, CCleaner, YAC, KMPlayer, YTD Video Downloader, Advanced System Care Free, DownloadApp, iObit Uninstaller, Free Youtube Downloader
  • Filehippo – Adobe Reader, CCleaner, Mozilla Firefox, Picasa, Java, Recuva, Skype, uTorrent, VLC Media Player, WINRAR
  • Snapfiles – Avast Free Antivirus, CCleaner, Comodo Internet Security Premium, Auslogics Disk Defrag, Eusing Free Registry Cleaner, Freemake Video Converter, GIMP, PDFX Viewer, Recuva, Revo Uninstaller
  • Softonic – Avast Free Antivirus, BSplayer, Mozilla Firefox, Hotspot Shield, Adobe Flash Player, iObit Malware Fighter, Skype, uTorrent, VLC Media Player, YTD Video Downloader
  • Softpedia – Google Chrome, Malwarebytes Antimalware, Nero Free, Orca, Super Simple Video Converter, Picasa, Image Burn, Skype, Unlocker, Yahoo Messenger
  • Tucows – Express Files, Karaoke Player Software, Network Inventory Advisor, Internet Download Manager, Internet Explorer 8, IrFan View, Internet Explorer 9, Outlook Express, PDF Converter, PDF Reader
  • SourceForge – 7Zip, Audacity, Camstudio, DVD Styler, Filezilla, KeePass, Media Player Classic, Process Hacker, Password Safe, VLC Media Player
  • Filehorse – Avast Free Antivirus, Advanced System Care Free, Adobe Reader, AVG Free Antivirus, Java, Moborobo, Skype, iTunes, VLC Media Player, Winamp Media Player
  • Software Informer – Free Download Manager, Avira Free Antivirus, Avast Free Antivirus, Free 3GP Video Converter, Free MP3 Wma Converter, AVG Free Antivirus, Free Sound Recorder, Free Video to JPG Converter, Free DWG Viewer, 123 Solitaire Free
  • Soft32 – Counterstrike, DC++, Mozilla Firefox, Google Chrome, Google Earth, Virtual DJ, Internet Explorer 9, Yahoo Messenger, VLC Media Player, MSN Messenger


Download Portal Mayhem: how many can you safely trust?

We tested all the above mentioned downloads per portal to see how many PUPs come bundled with them. Please note that only PUP programs were counted; potentially unwanted modifications or changes (such as changing the search homepage tab without installing a program) were not. The overall results:

08e061a2c2763469fc882f958154d8e9.png


3f209b02b5332b687fa5e3bf7c071ca4.png


As you can see, nearly every download portal contained at least one or more PUPs. Out of the ten tested download portals, only SourceForge managed to keep their top software PUP-free. The download portals that should be avoided at all costs are: Download.com, Tucows, and Softonic.

Be careful when clicking the big green Download button

The big green “Download Now” button looks pleasantly appealing to the naked eye; however, what is really hidden within it once you click on it? A massive variety of “Download Now” buttons on several of the top download portals and software vendor websites are unsafe to use because they are in fact cleverly disguised PUP installers. Your desired software will be presented to you at the very end of the installation after being presented with tons of junkware offers and PUPs first. A word of warning: the direct download link will most likely be disguised or even hidden, you may find yourself having to carefully search for it. Below are a few example screenshots of installers that describe this very scenario:

d7680d6069e9bdfee4f9d854faf70c92.png


SourceForge may do a good job at keeping their top ten applications PUP-free; however, some PUPs are delivered through optional installs per the freeware vendors choice. Sourceforge provides software developers the option to make cash with their freeware through software bundles, and apparently some software vendors chose to do so as you can see in the above screenshot with the popular Sourceforge application FileZilla.

Soft32 makes no attempt to hide its efforts to push its “smart download manager” which will “smartly” download a plethora of PUPs onto your computer. Once again, the seemingly safe “green” download button betrays a user and the safe direct download link for Avira can be found underneath in very small print. Ironically, PUPs are even bundled with various free antivirus products that are designed to keep your computer free of such threats.

6216b6b07c9f2277af6e7ddc1d7dcbaa.png


This site is so “clever” that it even incorporate the McAfee Secure logo to further ease a users mind about downloading this software using their “smart download manager”.

Lastly, Software Informer not only hosts a PUP downloader; but, actually warns the user that it “might” contain adware or suspicious components. This is a clear giveaway that you are about to be presented with several unwanted offers and maybe even more before the real installation even begins. Another seemingly suspicious factor that can be taken into consideration is the color coding of the download button. The “download anyway” button is actually presented to the user in an orange type color which is a clear indication that you might want to use caution before clicking it.

f49cb5d247b509985a4cba19e56d059a.png


Below the PUP downloader, you can actually see several other options. Within the three options, you can find a “Download latest version” button which will present you with a direct vendor download link. Always use the direct vendor download when possible to ensure that your computer will remain PUP- free.

Top 5 commonly found PUPs across all download portals

Many download portals appear to bundle similar potentially unwanted programs. Some of the below listed PUPs may seem harmless; however, they are bundled in applications unknowingly to the user, and in addition could pose privacy concerns or potential security holes.

PUP ............... Portals it was found on
Dropbox ...........Download.com, Snapfiles, Filehorse, Software Informer
AVG SafeGuard Toolbar ..Download.com, Snapfiles, Softonic, Filehorse, Software Informer
Spigot ............Download.com, Filehorse, Software Informer, Soft32
Search Protect ....Download.com, Tucows, Filehippo, Softonic
Pro PC Cleaner ....Download.com, Tucows, Softonic

Out of all the similar PUPs, Dropbox and AVG SafeGuard Toolbar are the most common bundled programs across all download portals. Dropbox is seemingly bundled with a plethora of free antivirus software. Spigot and Pro PC Cleaner were most widely distributed on Download.com. Search Protect was found a multitude of times, often bundled with Spigot.



Source:
http://blog.emsisoft.com/2015/03/11...icker150312&utm_campaign=newsbox_ticker150312
 
Any tests done on Major Geeks that you know of?
Not that I know of.
Maybe Major Geeks wasn't included in the test because it isn't as bad as the others.
Downloading from the Authors site (if possible) is always the best option..... at least we all agree on that.
Let's hope everyone starts to take notice.
 
Download.com’s Top 50 downloads: what comes with them?

31 out of 50 tested Download.com applications bundle PUPs


Application ...... Potentially Unwanted Program


1. Avast Free Antivirus ...........
Dropbox
2. KMPlayer ......................
Spigot browser extensions - shopping aid, newtab Aid, slick savings, Ebay
shopping assistant, search protect, offers to change homepage and search
engine to Yahoo during installation, Pro PC Cleaner, and Wajam
3. AVG Free Antivirus .............
AVG SafeGuard - changes homepage and search engine to AVG secure search,
web tuneup
4. YAC (Yet Another Cleaner) ......
Considered to be a PUP itself
5. CCleaner ......................
Chrome
6. Advanced System Care ...........
Driver Booster, iObit Uninstaller
7. Free Youtube Download ..........
Skype, PC Reviver
8. YTD Video Downloader ...........
Spigot browser extensions - slick savings, browser Error assistant, Ebay shopping
assistant, search protect, offers to change home and startup pages to Yahoo
during installation, and GeniusBox
9. iObit Uninstaller ..............
Advanced System Care
10. Download App ..................
Spigot browser extensions - shopping new tab aid, slick savings, Ebay shopping
assistant, search protect, offers to change homepage and search engine to
Yahoo during installation, and Pro PC Cleaner
11. 3DP Chip ......................
nProtect, SpeedUpMyPC 2015
12. GOM Media Player ..............
Skype, Clean Water
13. Virtual DJ 8
14. Malwarebytes Anti-Malware
15. PhotoScape
....................
Google Drive, PC Mechanic
16. Start Menu 8
17. Driver Booster
................
iObit Malware Fighter
18. VLC Media Player
19. Ad Aware Free Antivirus
.......
Ad Aware Web Companion - changes home page and search engine to secure
search
20. Minitool Partition Wizard
21. Irfan View
22. mHotspot
......................
Tuneup Utilities, PC Mechanic, Safer Browser, Clean Water, Driver Max
23. Panda Free Antivirus ..........
anda Security Toolbar - changes default homepage and search engine to
Yahoo
24. Hotspot Shield ................
changes default homepage and search engine to HotSpot web search, installs
Hotspot shield toolbar during installation
25. Mozilla Firefox
26. SlimDrivers
...................
MyPC Backup
27. uTorrent ......................
OWSLA Bundle , Skype
28. Virtual DJ 7
29. Any Video Converter
...........
offers to change homepage and search engine to Yahoo during installation,
Spigot browser extensions - shopping aid, new tab aid, slick savings, Ebay
shopping assistant, search protect, and Pro PC Cleaner
30. AdwCleaner
31. PrimoPDF
......................
Open Candy
32. DriverMax .....................
Open Candy, Safer Browser, Tuneup Utilities
33. Daemon Tools Lite .............
Spigot browser extensions - shopping aid, new tab aid, slick savings, Ebay
shopping assistant, search protect, offers to change homepage and search
engine to Yahoo during installation, Pro PC Cleaner, iCinema, and Bo Browser
34. UMPlayer
35. Screencast - O - Matic
36. iObit Malware Fighter
.........
MyPC Backup, Advanced System Care Ultimate
37. Spybot Search and Destroy
38. FastStone Imager Viewer
39. Google Chrome
40. VLC Media Player (64 Bit)
41. 7Zip
42. Kingo Android Root
...........
Spigot browser extensions - shopping aid, new tab, slick savings, Ebay shopping
assistant , search protect, offers to change homepage and search engine to
Yahoo during installation, and Pro PC Cleaner
43. Format Factory ................
Spigot browser extensions - shopping aid, new tab, slick savings, Ebay shopping
assistant, search protect, and Pro PC Cleaner
44. Media Player Codec Pack
45. Macrium Reflect Free
46. AOMEI Partition Assistant Standard Edition
47. Youtube Music Downloader
......
Spigot browser extensions - shopping aid, new tab, slick savings, Ebay shopping
assistant, search protect, offers to change homepage and search engine to
Yahoo during installation, and Pro PC Cleaner
48. JetAudio Basic ................
offers to change homepage and search engine to Yahoo during installation,
Spigot browser extensions - shopping aid, new tab, slick savings, Ebay shopping
assistant, search protect, Pro PC Cleaner, and AVG Toolbar - offers to change
homepage and tabs to AVG Secure Search
49. Pandora Recovery .............
offers to change homepage and search engine to Yahoo during installation,
Spigot browser extensions - shopping aid, new tab, slick savings, Ebay shopping
assistant, search protect, Pro PC Cleaner
50. Grand Theft Auto: Vice City Ultimate Vice City Mod .....................
offers to change homepage and search engine to Yahoo, Spigot browser
extensions - shopping aid, new tab, slick savings, Ebay shopping assistant,
search protect, and Pro PC Cleaner



Read the full story at http://emsi.at/dlpup
 
Back
Top