Cnet is accused of bundling malware with downloads

[~BD~]

Nemo wrote:
[....]
>
> You don't appear to understand the point I was raising.

Sorry about that - I'm simply a catalyst! :-)

Read here: http://insecure.org/news/download-com-fiasco.html

[Peter Foldes]

"~BD~" <~BD~@nomail.afraid.org> wrote in message news:jbnnpk$vqr$1@dont-email.me...

LOL. Morgan was late with his report . Gordon (Lyon) advised the population on the
Net the minute the wrapping occurred. If you do not know who Gordon Lyon is then he
goes by the name of Fyodor who wrote the programs in question with this wrapping
fiasco

http://insecure.org/fyodor/

JS

BTW: BD there is always a great white hope as you always automatically think

[~BD~]

Peter Foldes wrote:
> "~BD~" <~BD~@nomail.afraid.org> wrote in message
> news:jbnnpk$vqr$1@dont-email.me...
>
> LOL. Morgan was late with his report . Gordon (Lyon) advised the
> population on the Net the minute the wrapping occurred. If you do not
> know who Gordon Lyon is then he goes by the name of Fyodor who wrote the
> programs in question with this wrapping fiasco
>
> http://insecure.org/fyodor/
>
> JS
>
> BTW: BD there is always a great white hope as you always automatically
> think


Some great places here! http://www.honeynet.org/book/index.html

[~BD~]

Kirk Bubul wrote:
> On Wed, 07 Dec 2011 08:59:12 +0000, Nemo<invalid@invalid.invalid>
> wrote:
>
>> On 07/12/2011 05:38, G. Morgan wrote:
>>> Virus Guy wrote:
>>>
>>>> Meanwhile Graham Cluley, security expert and blogger for Sophos in the
>>>> UK, expressed his surprise on Twitter, saying, "What on earth is CNET
>>>> playing at wrapping downloads (VLC, Nmap, etc) with a cruddy toolbar?"
>>>
>>> I broke this story months ago and provided a homemade video on how to
>>> get around it. The AV companies and software distributors are just now
>>> acknowledging it?
>>>
>> I've just checked a few trial downloads and can't see any evidence of
>> the wrapper. I wonder if Cnet has pulled it from its site, or maybe it
>> is selective in some way - I'm using Win7/IE9 and based in the UK.
>>
>> Could others report on their experiences?
>> (obviousy, don't let the installer run fully if the wrapper is evident)
>
> I have used Cnet's TechTracker to keep over 20 programs up to date.
> I've noticed with great displeasure that some time ago they started
> pushing the toolbar and other unwanted items as one tried to update a
> completely unrelated program.
>
> Just within the last week or so, the malware rejection/acceptance
> screen has become more buried in the chain of clicks that one must
> make in order to install the wanted software.
>
> Can we start a petition? I've given them negative feedback.


Please read here: http://insecure.org/news/download-com-fiasco.html

[Dustin]

G. Morgan <sealteam6@osama-is-dead.net> wrote in
news:e4rud7l04n3r3jk82sqs1qm2gm3gjhojf8@Osama-is-dead.net:

> Nemo wrote:
>
>>> I did find a sample for you though (4th random try)
>>>
>>> http://download.cnet.com/Advanced-Po...8_4-98269.html
>>>
>>> Should get you "cnet2_pscan13_exe.exe" with the wrapper.
>>>
>>Yes, that one is wrapped for me as well. It looks like CNET is trying to
>>cover its tracks by cleaning up cited examples?
>
> I don't know. What I do know is that "Graham Cluley" (no relation) and
> others in the anti-****ware community are apparently not doing their
> jobs. How could this Cluley guy be "surprised"¹ by this not-so-new
> development? Could it be that AV vendors are intimidated by CBS, and
> other big corporations for fear of legal retaliation for flagging it?
> Same for some commercial key loggers. I think there are some deals made
> behind closed doors for AV vendors to exclude signatures of commercial
> ****ware. Of course I can't prove it, and someone who knows for sure
> probably isn't going to publicly confirm it.

ehehehehe....



--
Character is doing the right thing when nobody's looking. There are too many
people who think that the only thing that's right is to get by, and the only
thing that's wrong is to get caught. - J.C. Watts

[Bullwinkle.]

No you are a ****ing rat...
\
Path:
Xl.tags.giganews.com!border1.nntp.dca.giganews.com !nntp.giganews.com!local2.nntp.dca.giganews.com!nn tp.bt.com!news.bt.com.POSTED!not-for-mail
NNTP-Posting-Date: Thu, 05 Nov 2009 15:34:41 -0600
Date: Thu, 05 Nov 2009 21:34:41 +0000
From: ~BD~ <BoaterDave'remove'@hotmail.co.uk>
User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812)
MIME-Version: 1.0
Newsgroups: microsoft.public.test.here
Subject: Re: Wow! Some inside information disclosed?
References: <HfCdnXslYv2OU2_XnZ2dnUVZ8vSdnZ2d@bt.com>
<#5HDwuhXKHA.1268@TK2MSFTNGP04.phx.gbl>
<7dWdnUn-lsA8f2_XnZ2dnUVZ8lZi4p2d@bt.com>
<iISdnemK2rDuZ2_XnZ2dnUVZ8n-dnZ2d@bt.com>
<MbidnX_r9pF3m27XnZ2dnUVZ8l-dnZ2d@bt.com>
<baadnVUCMZVUgm7XnZ2dnUVZ8uidnZ2d@bt.com>
In-Reply-To: <baadnVUCMZVUgm7XnZ2dnUVZ8uidnZ2d@bt.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Message-ID: <OsmdnSrcR6hs2W7XnZ2dnUVZ8hudnZ2d@bt.com>
Lines: 140
X-Usenet-Provider: http://www.giganews.com
X-AuthenticatedUsername: NoAuthUser
X-Trace:
sv3-BHci9ippSXnVgMxUz9KLm/mEVJGqG+fWmxkLdD3X6KO1/+qmzgQIvtTIr8eq8HFyJ5dKbqScxKL6QsJ!8kvcPVte2GMR7Tm S31i5EfYPRLhlURK9655dLxWYMtk1u+YD/3QDKXcBGnTyWO9QCyHfsva5220=
X-Complaints-To: abuse@btinternet.com
X-DMCA-Complaints-To: abuse@btinternet.com
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint
properly
X-Postfilter: 1.3.40
Bytes: 6589
Xref: number.nntp.dca.giganews.com microsoft.public.test.here:7478747



>> In case you are wondering, I am *not* being paid -
>
> I wasn't wondering, what made you say that?

I've mentioned before that because of my 20+ years of active service in
the Royal Navy I qualified for continuing service with MI5 (rather like
007) but decided to help on a non-contractual basis without accepting
further Government funds. I do, though, keep in close contact with 'the
authorities'.


>> --
>> Dave
>>
>
>



"~BD~" <~BD~@nomail.afraid.org> wrote in message
news:jbojcq$l07$1@dont-email.me...
Nemo wrote:
[....]
>
> You don't appear to understand the point I was raising.

Sorry about that - I'm simply a catalyst! :-)

Read here: http://insecure.org/news/download-com-fiasco.html

[Bullwinkle.]

Path:
Xl.tags.giganews.com!border1.nntp.dca.giganews.com !nntp.giganews.com!local2.nntp.dca.giganews.com!nn tp.bt.com!news.bt.com.POSTED!not-for-mail
NNTP-Posting-Date: Thu, 05 Nov 2009 15:34:41 -0600
Date: Thu, 05 Nov 2009 21:34:41 +0000
From: ~BD~ <BoaterDave'remove'@hotmail.co.uk>
User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812)
MIME-Version: 1.0
Newsgroups: microsoft.public.test.here
Subject: Re: Wow! Some inside information disclosed?
References: <HfCdnXslYv2OU2_XnZ2dnUVZ8vSdnZ2d@bt.com>
<#5HDwuhXKHA.1268@TK2MSFTNGP04.phx.gbl>
<7dWdnUn-lsA8f2_XnZ2dnUVZ8lZi4p2d@bt.com>
<iISdnemK2rDuZ2_XnZ2dnUVZ8n-dnZ2d@bt.com>
<MbidnX_r9pF3m27XnZ2dnUVZ8l-dnZ2d@bt.com>
<baadnVUCMZVUgm7XnZ2dnUVZ8uidnZ2d@bt.com>
In-Reply-To: <baadnVUCMZVUgm7XnZ2dnUVZ8uidnZ2d@bt.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Message-ID: <OsmdnSrcR6hs2W7XnZ2dnUVZ8hudnZ2d@bt.com>
Lines: 140
X-Usenet-Provider: http://www.giganews.com
X-AuthenticatedUsername: NoAuthUser
X-Trace:
sv3-BHci9ippSXnVgMxUz9KLm/mEVJGqG+fWmxkLdD3X6KO1/+qmzgQIvtTIr8eq8HFyJ5dKbqScxKL6QsJ!8kvcPVte2GMR7Tm S31i5EfYPRLhlURK9655dLxWYMtk1u+YD/3QDKXcBGnTyWO9QCyHfsva5220=
X-Complaints-To: abuse@btinternet.com
X-DMCA-Complaints-To: abuse@btinternet.com
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint
properly
X-Postfilter: 1.3.40
Bytes: 6589
Xref: number.nntp.dca.giganews.com microsoft.public.test.here:7478747



>> In case you are wondering, I am *not* being paid -
>
> I wasn't wondering, what made you say that?

I've mentioned before that because of my 20+ years of active service in
the Royal Navy I qualified for continuing service with MI5 (rather like
007) but decided to help on a non-contractual basis without accepting
further Government funds. I do, though, keep in close contact with 'the
authorities'.


>> --
>> Dave
>>
>
>

"~BD~" <~BD~@nomail.afraid.org> wrote in message
news:jbotq2$m19$1@dont-email.me...
Please read here:

[Nobody > (Revisited)]

On 12/6/2011 9:38 PM, G. Morgan wrote:
> Virus Guy wrote:
>
>> Meanwhile Graham Cluley, security expert and blogger for Sophos in the
>> UK, expressed his surprise on Twitter, saying, "What on earth is CNET
>> playing at wrapping downloads (VLC, Nmap, etc) with a cruddy toolbar?"
>
> I broke this story months ago and provided a homemade video on how to
> get around it. The AV companies and software distributors are just now
> acknowledging it?
>

See edited subject line.

I needed a "fresh" download of Avast Free for a friend this weekend, so
I proceeded to the Awil/Avast website. Those clowns now are letting CNET
handle the 'Free' version downloads directly, no other links/mirrors
shown there.

So... I d/l'ed it from CNET and scanned it with my own Avast and MBAM,
all seems kosher .... at this time.

I didn't install *that* one, went to MajorGeeks (usually good) and got
it there. This one also checked out OK via Avast/MBAM.

CNET has gotten so much **** handed to them over this that they had to
fix this, and it appears they did.

Regarding the "download houses" (CNET, MajorGeeks, File Hippo,
Softonic, etc)... it's always been a crapshoot if you don't do scanning
on your own. I *usually* do, but I admit that I have just gone on faith
a few times and go bit for it, had to clean out a few added crap
toolbars and BHOs but luckily no real baddies.

There's nothing you can do about the obligatory "Do You Want Chrome" nag
frames and such, that's a given.

IIRC, this isn't CNET's first trip down this lane. If memory(?)'s
correct, they tried a similar stunt back about 1997.



--
"**** this is it, all the pieces do fit.
We're like that crazy old man jumping
out of the alleyway with a baseball bat,
saying, "Remember me mother****er?"
Jim “Dandy” Mangrum

[Li'l Abner]

"Nobody > (Revisited)" <usenetharvested@aol.com> wrote in
news:Z1MMq.47754$mJ.44324@newsfe10.iad:

> On 12/6/2011 9:38 PM, G. Morgan wrote:
>> Virus Guy wrote:
>>
>>> Meanwhile Graham Cluley, security expert and blogger for Sophos in
>>> the UK, expressed his surprise on Twitter, saying, "What on earth is
>>> CNET playing at wrapping downloads (VLC, Nmap, etc) with a cruddy
>>> toolbar?"
>>
>> I broke this story months ago and provided a homemade video on how to
>> get around it. The AV companies and software distributors are just
>> now acknowledging it?
>>
>
> See edited subject line.
>
> I needed a "fresh" download of Avast Free for a friend this weekend,
> so I proceeded to the Awil/Avast website. Those clowns now are letting
> CNET handle the 'Free' version downloads directly, no other
> links/mirrors shown there.
>
> So... I d/l'ed it from CNET and scanned it with my own Avast and
> MBAM, all seems kosher .... at this time.
>
> I didn't install *that* one, went to MajorGeeks (usually good) and got
> it there. This one also checked out OK via Avast/MBAM.
>
> CNET has gotten so much **** handed to them over this that they had to
> fix this, and it appears they did.
>
> Regarding the "download houses" (CNET, MajorGeeks, File Hippo,
> Softonic, etc)... it's always been a crapshoot if you don't do
> scanning on your own. I *usually* do, but I admit that I have just
> gone on faith a few times and go bit for it, had to clean out a few
> added crap toolbars and BHOs but luckily no real baddies.
>
> There's nothing you can do about the obligatory "Do You Want Chrome"
> nag frames and such, that's a given.
>
> IIRC, this isn't CNET's first trip down this lane. If memory(?)'s
> correct, they tried a similar stunt back about 1997.

I tried to download unlocker from them today. The file downloaded was
"cnet2-unlocker.exe" or something like that. I didn't even run it. I
looked around until I found a non polluted copy.

--
--- A dyslexic man walks into a bra ---

[FromTheRafters]

Li'l Abner wrote:
> "Nobody> (Revisited)"<usenetharvested@aol.com> wrote in
> news:Z1MMq.47754$mJ.44324@newsfe10.iad:
>
>> On 12/6/2011 9:38 PM, G. Morgan wrote:
>>> Virus Guy wrote:
>>>
>>>> Meanwhile Graham Cluley, security expert and blogger for Sophos in
>>>> the UK, expressed his surprise on Twitter, saying, "What on earth is
>>>> CNET playing at wrapping downloads (VLC, Nmap, etc) with a cruddy
>>>> toolbar?"
>>>
>>> I broke this story months ago and provided a homemade video on how to
>>> get around it. The AV companies and software distributors are just
>>> now acknowledging it?
>>>
>>
>> See edited subject line.
>>
>> I needed a "fresh" download of Avast Free for a friend this weekend,
>> so I proceeded to the Awil/Avast website. Those clowns now are letting
>> CNET handle the 'Free' version downloads directly, no other
>> links/mirrors shown there.
>>
>> So... I d/l'ed it from CNET and scanned it with my own Avast and
>> MBAM, all seems kosher .... at this time.
>>
>> I didn't install *that* one, went to MajorGeeks (usually good) and got
>> it there. This one also checked out OK via Avast/MBAM.
>>
>> CNET has gotten so much **** handed to them over this that they had to
>> fix this, and it appears they did.
>>
>> Regarding the "download houses" (CNET, MajorGeeks, File Hippo,
>> Softonic, etc)... it's always been a crapshoot if you don't do
>> scanning on your own. I *usually* do, but I admit that I have just
>> gone on faith a few times and go bit for it, had to clean out a few
>> added crap toolbars and BHOs but luckily no real baddies.
>>
>> There's nothing you can do about the obligatory "Do You Want Chrome"
>> nag frames and such, that's a given.
>>
>> IIRC, this isn't CNET's first trip down this lane. If memory(?)'s
>> correct, they tried a similar stunt back about 1997.
>
> I tried to download unlocker from them today. The file downloaded was
> "cnet2-unlocker.exe" or something like that. I didn't even run it. I
> looked around until I found a non polluted copy.
>
I guess they kind of shot themselves in the foot with these wrapped
downloads - especially if prospective visitors start going elsewhere as
a first choice.