7 out of 8 free antivirus suites bundle with PUPs

[Petrovic]

We decided to further look into this and do the same test with all other free, full antivirus suites, and the results are pretty shocking:

ALL free Antivirus programs come with toolbars or PUPs of some sort – except Bitdefender Free. A lot of them have a “rebranded” Ask toolbar that generates considerable pay per install (PPI) revenues while they’re labeled as part of the vendors own security solution. Some disclose they use Ask (for example Avira), others like AVG go as far as adding pops with coupon deals.

Antivirus programs are supposed to protect your computer from viruses, yet many of them give you a questionable program during installation, without clear disclosure. Below is the list of 8 free antivirus programs and the type of PUPs they give you during installation at the time of posting. Please note that we only included full antivirus suites, not scanner-only products.

Bitdefender Free: as mentioned before, Bitdefender Free is one of the only clean antivirus vendors that does not come with any PUPs.

Comodo AV Free: changes home page and search engine provider to Yahoo during the installation process, unless the user unchecks the box.





Avast Free: offers Dropbox during installation by default, unless you uncheck the box. No toolbars are installed. Offers Software Informer when downloading, which gets very mixed reviews in terms of how clean the software is.







Panda AV free: installs Panda Security toolbar, yahoo search takeover and MyStart (powered by Yahoo) home page takeover. No product rebrands, at least the installer is clear that both are Yahoo products.



AdAware free: installs WebCompanion by default unless user unchecks the box. Also installs Bing Homepage takeover and Bing search takeover by default, unless opted out. Discloses that AdAware offers these programs to keep the software free.



Avira free: offers Dropbox after installation. Takes over search with Avira Safe Search, which is a a white-labeled version of the Ask toolbar. Avira does disclose that it partners with Ask, and states that it “chose Ask.com to be our partner in bringing you the SearchFree Toolbar because Ask.com is one of many vendors whose products offer functionality which we believe our users will value”.



ZoneAlarm free AV + Firewall: with Custom Install: Zonealarm homepage and search takeover.This is a rebranded Ask toolbar, which is not mentioned on ZoneAlarm’s website.



AVG free: installs Web Tuneup, including AVG SafeGuard. Sets AVG Secure Search as homepage, new tab page and defaults search engine. Toolbar is Ask powered, although this is not explicitly stated. Also offers AVG Rewards, which displays popup advertisements with coupons and deals.




Popular ways for free Antivirus programs to make money with PUPs
Looking at the above screenshots, we can see that the antivirus vendors have a few popular methods to make money with PUPs:

• Search Engine Takeover: you now set your default search engine to the software vendor’s choice, there’s big money to make there. Just look at this company called Google.
• Ask Toolbar: do a quick search on Google for the Ask toolbar, and you’ll learn quickly why the first results page is full of “How to remove the Ask toolbar” and “How to get rid of the Ask toolbar”.
  
• Rebranded Ask Toolbar: even worse than the Ask toolbar, the rebranded version is a white-labeled Ask toolbar where the software vendor gives it a different name and look, while it’s just the Ask toolbar in disguise.
• Homepage take-over or new tab: “free” guaranteed traffic to a website anyone?
• Your data, search and browser behavior: it is not known what antivirus vendors do with your data. It is known that they are watching you and track you. Do you trust whether they do anything with this data? Tracking and selling browser data and other personal information has been a big business for years in the internet industry, so who knows.

What’s disturbing about all the methods these antivirus vendors use is that in the majority of the cases, the PUPs are included in the default intallation, unless a user opts out or reads the small fine print. Sometimes the PUP install is not disclosed at all, or hidden. It’s rarely explained what the installed PUP actually does, if anything. Questionable tactics to get onto computers of unknowing users.

When the product is free the real product is YOU
As HowtoGeek states as well, it doesn’t matter what download site you use. The people that make the freeware are the ones bundling. Some download sites bundle on top of that but it’s not the root of the issue. They’re a player in the game. As HowtoGeek states it in their article:

“There are also no safe freeware download sites… because as you can clearly see in the screenshots in this article, it isn’t just CNET Downloads that is doing the bundling… it’s EVERYBODY. The freeware authors are bundling crapware, and then lousy download sources are bundling even more on top of it. It’s a cavalcade of crapware. Each time we ran through this experiment over the last few months, different software would end up being bundled in a rotation, but every single software that bundles itself ends up bundling the same culprits: browser hijackers that redirect your search engine, home page, and put extra ads everywhere. Because when the product is free the real product is YOU.”

Full Article

 

[Viking]

Shame on them!

 

[Deleted member 21043]

It's actually quite shameful that they are bundling software. It's like a massive trick - one minute they are saying it is "free", yet they would be making money off the advertisements (e.g. Yahoo search and start page being added to the browsers over the existing Home Page and Search provider).

I wonder how much money Avast gets for bundling Dropbox, or Comodo for advertising Yahoo... AVG with the Ask toolbar, it just becomes annoying (and how you must accept to change your homepage to continue the add-on use on the browser for the protection it offers).

WebComparison, another installation... This time with AdAware.

It's just horrible to see this. They are meant to be stopping the Home Page URL and search provider from being tampered with (if not, it's a good idea for the protection), not actually doing it themselves. It's quite typical. They call themselves "Anti-viruses", yet they are tampering with the users Home Page and Search provider, installing additional software? What's even worse is that you have to uncheck the boxes, not check them if you want them. They are actually checked by default... Shocking. I would say about half the users who install the software most likely want to install and forget or do not have the experience to know about things like PUPs/PUAs, web browser modifications and will just hit continue, or next to get the installation complete.

Thus, upon this, then later on getting irritated when they see that Google is no longer the Home Page or Search provider, or they later on find some unknown applications installed on their system (PrivDog) that they do not want or use (included in Comodo installation).

Oh dear.

 

[PrMi]

Bitdefender isn't selfish ;D

 

[Soulbound]

Companies will use any method possible to increase profit. When offering free solutions the service they offer is still free and I'll say that on some cases they do point the gun at you to install someyjing extra. Most cases however user has the choice not to install so to be fair most are not forcing you to use something that will grant them a share of revenue. Pup has always been that topic of discussion for morality. Just have a look at CNET... their policy hasn't changet but they are still one of the go to sites for downloads...

Sorry to say this but it's the same principal for when accepting terms and conditions on something whether it's a contract signing or digital t&c. How often do one reads the clauses and small print? I do because I like to see what's the catch behind something. Simple as that. But most people will not read small prints of t&c. Hope that makes sense.

 

[frogboy]

Just opt out when installing.

 

[Soulbound]

Just opt out when installing.

Most sensible thing to do when you are not a beginner. Unfortunately not computer savy users often than not will not realize this option. That's how it always been. Awareness has always been there to help those who can.

 

[Azure]

Bitdefender isn't selfish ;D

I think it's more likely that they can afford to have free product that doesn't come bundle with stuff because of the money they already have.

 

[Av Gurus]

Here are couple of Free AV that don't bundle with Adware/PUP:

• 360TS/IS
• Baidu
• Fortinet
• Microsoft Security Essentials

 

[Azure]

Most sensible thing to do when you are not a beginner. Unfortunately not computer savy users often than not will not realize this option. That's how it always been. Awareness has always been there to help those who can.

An example is ZoneAlarm's little "skip all offers". Which I didn't notice the first time I tried the product. Seriously can that think be even more disguise than it already is?

 

[cruelsister]

I have to take the opposite side of this argument (to a certain extent, anyway). First off, I think it is kind of disingenuous for Emsisoft, which charges for its products, to disparage some companies who do not. But just a few points:

1). Softwin (the makers of BitDefender) has fantastic management. Their free product is subsidized in full in a number of ways- the AV arm is just one part of the company which includes a training arm (Intuitext) and Paxato, which is a Customer Service support thingy. Add to this the paid AV option as well as the aggressive selling of definitions to various other AV concerns and it can be understood that any income generated by attaching 3rd party products is not needed. That being said, Softwin's management still must be complimented for being very smart and not going that route.

2). Comodo- Although PrivDog (which is actually a product of one of Comodo's subsidiaries, AdTrustMedia), was included in later version 7 versions of their products, it was seen as a grave mistake and has been ditched in current version 8 versions. The current request to change one's Home Page to is clearly stated in the setup (with the notation "I want to help Comodo by..."). A simple uncheck takes care of it. For me this is hardly a burden. Comodo corporate does indeed generate income through both DNS managed services as well as SSL certificates, the AV arm (Comodo Security Solutions) still must be a loss leader for the company as a whole.

3). Notice that Emsisoft left out Qihoo?

Finally, I think more outrage should go to Oracle Corp with the inclusion of the Ask Toolbar option in Java setups. But perhaps Larry Ellison is building a new yacht and needs the income: http://www.superyachtfan.com/larry_ellison.html

 

[jerzy601]

This is true of almost all the programs antyvirusowe free and not only because I have not paid too do try to install something we do not want, so you have to watch out when installing and read and then check off what you do not want, and it happens from there that programs do not inform further additions during the installation and it is unpleasant and should be information on supplements.
and there are also cases of programs in which there is no possibility of antyvirusowych not get rid of these additives, and this is just a surprise.
but as they say the ad is trading lever, but why at the expense of users? and without their knowledge.

 

[jamescv7]

Its all about the money, money, money.....

In actual reality, those PUP bundled does not make the AV performance worst prior only that specific adware/grayware may delisted as special treatment.

 

[Solarlynx]

The author of the article Emsisoft is smart at removing PUP. I use EEK for this.

 

[2!<15]

When the product is free the real product is YOU

 

[MalwareT]

Dropbox isn't Adware.

 

[conceptualclarity]

AdAware free: installs WebCompanion by default unless user unchecks the box. Also installs Bing Homepage takeover and Bing search takeover by default, unless opted out. Discloses that AdAware offers these programs to keep the software free.

Anybody ever tried AdAware Web Companion? I don't think AV browser helper objects are necessarily a bad thing.

 

[Elemec]

I kinda like the Comodo Dragon that comes a long with Comodo firewall/ IS.
It's same thing as chrome , But looks pretty good.
However nothing stands Baidu Spark Browser

 

[conceptualclarity]

I kinda like the Comodo Dragon that comes a long with Comodo firewall/ IS.
It's same thing as chrome , But looks pretty good.
However nothing stands Baidu Spark Browser

Love Comodo Dragon! I think it's the best of the Chromium family, far better than Google Chrome. Some have called it a PUP--hogwash!

 

[Jaspion]

Honestly, so many people here imply these companies do these things purely out of greed, money is all that matters to them, bla bla bla, yeah, how about you thoughtlessly accepting they should offer something valuable for free? Someone must be paying for their work.

As long as the install procedure is clear about the addons, and offers a clear way of opting out, I don't think these bundled offers are abusive at all. I think of it like a physical store: who has never been greeted by an annoying salesperson who keeps offering one useless thing after the other? That kind of thing is annoying at a store, and it is also annoying in your computer. But if you can say no to these bundled offers and have your choice respected, where is that different from a "would you like fries with that?"

The problem begins to me when the products try to hide the opt-out options, or when they keep repeating offers. For instance, ZoneAlarm's discrete "Skip all offers" button, which I would classify as a mostly benign, although not really commendable method. A much worse case is Baidu: their Antivirus will pop up a notice when it updates, with a rascal little pre-selected checkbox that will install some other Baidu product unless you uncheck it before clicking the OK button. Stuff like that, or like having to first download a downloader that will download (the repetition is intentional) your installer finally, but only after a series of bundled offers, each with a different method to confuse you, all, of course, beside a big nice "Agree" or "Next" button; an approach after which the careless usually end up wishing they had known of MalwareTips sooner... well those are truly some of the worst this-could-have-easily-been-avoided cases. Yes, they do abuse the unaware.

It would be much better if companies focused on offering bundled stuff that is both clearly optional and possibly useful. I think the more useful the bundled offers, the less tricky the methods to attract users will have to be. But what offers will those be? Will they be purchasable offers, or will they be free? We come again to the question of who will be paying the bills.

Truth is there needs to be a certain degree of trust and cooperation between people for either bits or money to flow freely. Too bad many trusted sources act rogue these days. But someone smarter than me once said truth is one of those things that cannot long be hidden.