Second .jpeg is from a routine uninstall of the previous version of Foxit Reader Free using Revo Uninstaller Free.
Scanned the downloaded .exe file gotten from the vendor’s site (31.9 MB) with both avast! and Malwarebytes Free before running it. Both reported file as clean. Checked the EULA for evidence of any unwanted extensions or add-ons the user was agreeing to install before executing the file. Found Open Candy present and noted that if the system was not connected to the Internet it would not download the components needed to install and run that, so out went the internet connection.
No-opt out dialog box was ever presented during the new install of Foxit Reader.
Updated definitions for Malwarebytes and ran that after install was complete. Did not allow Foxit Reader to run after installation was completed and the Finish window was open. Scanned new install with Malwarebytes, and it found three instances of malware. Rebooted the system after the Malwarebytes scan was completed and all were removed.
Newest version is 6.1.4.2017
Sneaky. And very irritating.
Any other alternatives to Foxit Reader Free, now that this vendor, one of many, has now succumbed to this ad-based malware campaign?
Thank you for that. What this really means is that user vigilance must be brought higher and higher levels, even with previously trusted software, when installing anything that is offered as free these days. Free has become not free, as it were.
Got Open Candy? It’s your fault, as you did not read the EULA before you installed our free software. : >:(
Yeah Sumatra is a lot lighter than Foxit and doesn’t install any toolbar on your system or you guys can still go back to Adobe because Sumatra had some trouble displaying some pdf pages with Chinese characters.
Sometimes extracting the installer with 7-Zip is the way to get “clean” installer that doesn’t install adwares.
It is working with KMPlayer,Advanced Codecs etc.
AdwCleaner does a good job of getting rid of the Open Candy bundled-pest. Not irritating that developers bundle, because I fully understand they also need a decent living, but irritating is that they are not up front about it and won’t give you a chance to opt out or opt in even. You get these goodies delivered unwanted and mostly undesired, a classification term for a PUP. In the aftermath a lot of users even wonder where they got such an adware infection? So in this case it was a free reader that had it included.
MBAM also detects this Open Candy undesirable but cannot get rid of it completely and fails to reboot to do the final cleansing boot-bit of this pest.
We are entering days whenever you are not knowledgeable and assertive enough your computer or peripheral is slowly taken out of your hands, where others decide what crap to silently install onto it. Good we have these forums here to at least get some users informed and wake them up to these new developments.
As long as we’ve got this topic going, add this free tool to the list; formerly clean and good, now not: ImgBurn latest version 2.5.8.0 now also has unwanted adware installs [PUP’s] w/o your explicit consent. And this file is direct from the vendor’s site.
Next oldest version is clean: 2.5.7.0 Sometimes it doesn’t pay to upgrade to a newer version; you can open your system to unknown/unexpected new risks when you do.
As the proverbial Mr. Scrooge is now chief of the board in many places and with many developers also - the actual amount of “crap to get money” will just grow.
The fabric is coming loose at the seams, I think. Look at what a sloppy site a big corp like Nividia is being hosted → http://forum.avast.com/index.php?topic=146812.msg1065958#new
Everybody wants those extra pennies, but at the same time wants to sit in the front row at minimal costs. One way or another you loose customers that way.
And in our example this is translated into dissatisfied users.
Pol I don’t see what an infected webpage has to do with adware included with installers ???
You also know as well as I do that any site can be hacked at any given time so I don’t think I would go as far as to call NVidia sloppy, everyone including AV companies are always playing catch up to the malware guys.
The common denominator here is “trying to burn the candle from both ends”. And to have a cheap and insecure hoster and earn additional money from bundled downloads has the same underlying ideology. In that respect the policy is the same and it is wrong. Of course bundling software with crapware to get extra money and sloppy IT managment to save on cost is not the same, but the underlying principle is - that was what I wanted to point out. One is taking a penny on the side and the other one is saving it not having security as a first priority. Apples and pears compared, you are right there, but both “brown and putrid on the interior” ;D,
polonus
P.S. Nividia was not sloppy, those admins that hosted their site were ignoring basic security practices to deliver a secure ASP.site (the very basics were ignored and this led to the compromise, also that more than one domain were being hosted on the same IP and not on a dedicated server.
Sucuri did not see an attacked site because of any site that could be hacked, but this site was insecurely hosted.
D
>:(