Mind the PUP: Top download portals to avoid

Starbuck · March 13, 2015

We recently researched how many potentially unwanted programs (PUPs) come with the 50 most popular applications on Download..com. Since the results were quite disturbing, we decided to look into the habits of other popular download portals to see if they are any better, or whether it’s better to avoid download portals altogether. Most of them claim to have “clean and safe downloads” and many portals express this on their website. However, trusting any download portal at all is becoming a difficult task for most people due to the rapid growth of bundled PUPs and the software reviews on the sites that often don’t seem objective.

We looked into the ten most popular download portals, downloaded their top ten most popular applications to see how many toolbars, adware, homepage hijackers and other PUPs come with them to see how clean and safe they really are.

What are the top 10 applications on each download portal?

First, here is a list of the top 10 most popular downloads per download portal that we used for this article:

Download..com – Avast Free Antivirus, AVG Free Antivirus, CCleaner, YAC, KMPlayer, YTD Video Downloader, Advanced System Care Free, DownloadApp, iObit Uninstaller, Free Youtube Downloader
Filehippo – Adobe Reader, CCleaner, Mozilla Firefox, Picasa, Java, Recuva, Skype, uTorrent, VLC Media Player, WINRAR
Snapfiles – Avast Free Antivirus, CCleaner, Comodo Internet Security Premium, Auslogics Disk Defrag, Eusing Free Registry Cleaner, Freemake Video Converter, GIMP, PDFX Viewer, Recuva, Revo Uninstaller
Softonic – Avast Free Antivirus, BSplayer, Mozilla Firefox, Hotspot Shield, Adobe Flash Player, iObit Malware Fighter, Skype, uTorrent, VLC Media Player, YTD Video Downloader
Softpedia – Google Chrome, Malwarebytes Antimalware, Nero Free, Orca, Super Simple Video Converter, Picasa, Image Burn, Skype, Unlocker, Yahoo Messenger
Tucows – Express Files, Karaoke Player Software, Network Inventory Advisor, Internet Download Manager, Internet Explorer 8, IrFan View, Internet Explorer 9, Outlook Express, PDF Converter, PDF Reader
SourceForge – 7Zip, Audacity, Camstudio, DVD Styler, Filezilla, KeePass, Media Player Classic, Process Hacker, Password Safe, VLC Media Player
Filehorse – Avast Free Antivirus, Advanced System Care Free, Adobe Reader, AVG Free Antivirus, Java, Moborobo, Skype, iTunes, VLC Media Player, Winamp Media Player
Software Informer – Free Download Manager, Avira Free Antivirus, Avast Free Antivirus, Free 3GP Video Converter, Free MP3 Wma Converter, AVG Free Antivirus, Free Sound Recorder, Free Video to JPG Converter, Free DWG Viewer, 123 Solitaire Free
Soft32 – Counterstrike, DC++, Mozilla Firefox, Google Chrome, Google Earth, Virtual DJ, Internet Explorer 9, Yahoo Messenger, VLC Media Player, MSN Messenger

Download Portal Mayhem: how many can you safely trust?

We tested all the above mentioned downloads per portal to see how many PUPs come bundled with them. Please note that only PUP programs were counted; potentially unwanted modifications or changes (such as changing the search homepage tab without installing a program) were not. The overall results:

http://img.photobucket.com/albums/v708/starbuck50/1emsisoft_pup_charts1-1024x724_zp***rjhfws.png

http://img.photobucket.com/albums/v708/starbuck50/2emsisoft_pup_charts2-1024x724_zpspdpyixwu.png

As you can see, nearly every download portal contained at least one or more PUPs. Out of the ten tested download portals, only SourceForge managed to keep their top software PUP-free. The download portals that should be avoided at all costs are: Download..com, Tucows, and Softonic.

Be careful when clicking the big green Download button

The big green “Download Now” button looks pleasantly appealing to the naked eye; however, what is really hidden within it once you click on it? A massive variety of “Download Now” buttons on several of the top download portals and software vendor websites are unsafe to use because they are in fact cleverly disguised PUP installers. Your desired software will be presented to you at the very end of the installation after being presented with tons of junkware offers and PUPs first. A word of warning: the direct download link will most likely be disguised or even hidden, you may find yourself having to carefully search for it. Below are a few example screenshots of installers that describe this very scenario:

http://img.photobucket.com/albums/v708/starbuck50/3FilezillaSourceForgeDownloader_152302_zpsvz60rnxa.png

SourceForge may do a good job at keeping their top ten applications PUP-free; however, some PUPs are delivered through optional installs per the freeware vendors choice. Sourceforge provides software developers the option to make cash with their freeware through software bundles, and apparently some software vendors chose to do so as you can see in the above screenshot with the popular Sourceforge application FileZilla.

Soft32 makes no attempt to hide its efforts to push its “smart download manager” which will “smartly” download a plethora of PUPs onto your computer. Once again, the seemingly safe “green” download button betrays a user and the safe direct download link for Avira can be found underneath in very small print. Ironically, PUPs are even bundled with various free antivirus products that are designed to keep your computer free of such threats.

http://img.photobucket.com/albums/v708/starbuck50/4Soft32DownloaderPUP_152302_zpse5pmnv0x.png

This site is so “clever” that it even incorporate the McAfee Secure logo to further ease a users mind about downloading this software using their “smart download manager”.

Lastly, Software Informer not only hosts a PUP downloader; but, actually warns the user that it “might” contain adware or suspicious components. This is a clear giveaway that you are about to be presented with several unwanted offers and maybe even more before the real installation even begins. Another seemingly suspicious factor that can be taken into consideration is the color coding of the download button. The “download anyway” button is actually presented to the user in an orange type color which is a clear indication that you might want to use caution before clicking it.

http://img.photobucket.com/albums/v708/starbuck50/5SoftwareInformerPUPDownloader_152302_001_zpsl54uiour.png

Below the PUP downloader, you can actually see several other options. Within the three options, you can find a “Download latest version” button which will present you with a direct vendor download link. Always use the direct vendor download when possible to ensure that your computer will remain PUP- free.

Top 5 commonly found PUPs across all download portals

Many download portals appear to bundle similar potentially unwanted programs. Some of the below listed PUPs may seem harmless; however, they are bundled in applications unknowingly to the user, and in addition could pose privacy concerns or potential security holes.

PUP ............... Portals it was found on

Dropbox ...........Download..com, Snapfiles, Filehorse, Software Informer

AVG SafeGuard Toolbar ..Download..com, Snapfiles, Softonic, Filehorse, Software Informer

Spigot ............Download..com, Filehorse, Software Informer, Soft32

Search Protect ....Download..com, Tucows, Filehippo, Softonic

Pro PC Cleaner ....Download..com, Tucows, Softonic

Out of all the similar PUPs, Dropbox and AVG SafeGuard Toolbar are the most common bundled programs across all download portals. Dropbox is seemingly bundled with a plethora of free antivirus software. Spigot and Pro PC Cleaner were most widely distributed on Download..com. Search Protect was found a multitude of times, often bundled with Spigot.

Source:

http://blog.emsisoft.com/2015/03/11/mind-the-pup-top-download-portals-to-avoid/?ref=newsbox_ticker150312&utm_source=software&utm_medium=newsbox&utm_content=ticker150312&utm_campaign=newsbox_ticker150312

RandyL · March 14, 2015

Thanks for posting this Starbuck. I'm sure this will be helpful as it is getting quite bad and very deceptive.

I might add that it is also well known that even if you download from the source many programs these days install add-ons from the installer file. One should always use a custom installation option when you can. However even that can be deceptive. I've seen that option purposely worded to try and trick you into thinking you chose custom when instead it is the full installation. Worse yet I've seen where you choose custom, opt out of the add-ons and choose "next" only to find out that you had to choose another poorly worded option hidden way down from what appeared to be a EULA to custom install and opt out a second time.

But it gets worse. I noticed that YTD Video Downloader is listed a few times in the top ten downloads. I like this program but will not recommend it anymore. The installer does have PUPS and it's one that likes to hide the opt out options. But here is the really bad part. It needs to be updated occasionally to keep up with youtube changes and it will prompt you to update.

DO NOT UPDATE IT.

If you use the program update option there is no option to opt out of the PUPS. You get all the garbage. Instead download a new version from the source and try not to miss the options when installing it.

Be careful where you download from.

Be careful how you download.

Be careful with the installation.

And the newest trick. Be wary of using the programs update function in some cases.

As for me if I'm trying a new program I set a restore point first. It's sometimes easier than cleaning and resetting things.

Starbuck · March 17, 2015

I noticed that YTD Video Downloader is listed a few times in the top ten downloads.

Yes and this is what comes bundled with it...........

Spigot browser extensions - slick savings, browser Error assistant, Ebay shopping

assistant, search protect, offers to change home and startup pages to Yahoo

during installation, and GeniusBox

Download.com’s Top 50 downloads: what comes with them?

31 out of 50 tested Download.com applications bundle PUPs

Application ...... Potentially Unwanted Program

1. Avast Free Antivirus ...........

Dropbox

2. KMPlayer ......................

Spigot browser extensions - shopping aid, newtab Aid, slick savings, Ebay

shopping assistant, search protect, offers to change homepage and search

engine to Yahoo during installation, Pro PC Cleaner, and Wajam

3. AVG Free Antivirus .............

AVG SafeGuard - changes homepage and search engine to AVG secure search,

web tuneup

4. YAC (Yet Another Cleaner) ......

Considered to be a PUP itself

5. CCleaner ......................

Chrome

6. Advanced System Care ...........

Driver Booster, iObit Uninstaller

7. Free Youtube Download ..........

Skype, PC Reviver

8. YTD Video Downloader ...........

Spigot browser extensions - slick savings, browser Error assistant, Ebay shopping

assistant, search protect, offers to change home and startup pages to Yahoo

during installation, and GeniusBox

9. iObit Uninstaller ..............

Advanced System Care

10. Download App ..................

Spigot browser extensions - shopping new tab aid, slick savings, Ebay shopping

assistant, search protect, offers to change homepage and search engine to

Yahoo during installation, and Pro PC Cleaner

11. 3DP Chip ......................

nProtect, SpeedUpMyPC 2015

12. GOM Media Player ..............

Skype, Clean Water

13. Virtual DJ 8

14. Malwarebytes Anti-Malware

15. PhotoScape ....................

Google Drive, PC Mechanic

16. Start Menu 8

17. Driver Booster ................

iObit Malware Fighter

18. VLC Media Player

19. Ad Aware Free Antivirus .......

Ad Aware Web Companion - changes home page and search engine to secure

search

20. Minitool Partition Wizard

21. Irfan View

22. mHotspot ......................

Tuneup Utilities, PC Mechanic, Safer Browser, Clean Water, Driver Max

23. Panda Free Antivirus ..........

anda Security Toolbar - changes default homepage and search engine to

Yahoo

24. Hotspot Shield ................

changes default homepage and search engine to HotSpot web search, installs

Hotspot shield toolbar during installation

25. Mozilla Firefox

26. SlimDrivers ...................

MyPC Backup

27. uTorrent ......................

OWSLA Bundle , Skype

28. Virtual DJ 7

29. Any Video Converter ...........

offers to change homepage and search engine to Yahoo during installation,

Spigot browser extensions - shopping aid, new tab aid, slick savings, Ebay

shopping assistant, search protect, and Pro PC Cleaner

30. AdwCleaner

31. PrimoPDF ......................

Open Candy

32. DriverMax .....................

Open Candy, Safer Browser, Tuneup Utilities

33. Daemon Tools Lite .............

Spigot browser extensions - shopping aid, new tab aid, slick savings, Ebay

shopping assistant, search protect, offers to change homepage and search

engine to Yahoo during installation, Pro PC Cleaner, iCinema, and Bo Browser

34. UMPlayer

35. Screencast - O - Matic

36. iObit Malware Fighter .........

MyPC Backup, Advanced System Care Ultimate

37. Spybot Search and Destroy

38. FastStone Imager Viewer

39. Google Chrome

40. VLC Media Player (64 Bit)

41. 7Zip

42. Kingo Android Root ...........