OpenCandy

[winsupertweaker]

Very happy to announce that MSE 2011 discovered Adware which was piggy-backed in the free download of Sothink Video Converter. Though the results say the risk is "low", it means that a trusted company from which I have purhased my video software for five years got a scalding support ticket from me! That lead to a discourse between myself and the marketing department. A small bribe (free license) if I would not disclose my findings on the Internet. I said sorry, "but I am all about Internet ethics. I cited my own online service and how people refer other computer users to my remote help site because of "my privacy and work ethics".

Bottom line. OpenCandy.com has been around a few years and sothink.com stuffs it into their free video converter application. Grrr! They denied it at first but not after I sent them a screenshot. Oops! It may not be harmful but it's "grayware" and I did not have an option to opt-out during the installation. Bad Dog!!

Good news, MSE 2011 does a better job than AVG, AVAST and Avira in this area. I reinstalled the program, ran all of them and not one detected Opencandy, just MSE 2011.

 

[adrianbourke]

Hi. My name is Adrian, and I'm one of the founders at OpenCandy and was involved with the design of the OpenCandy software, system, and policies. I'd like to provide some detail to what OpenCandy is, and answer any questions that are asked.

OpenCandy is a service that software developers include in their software to earn money by showing recommendations for other software in their installers. Developers use this money to keep their software free and invest in further software development.

The installer uses the OpenCandy component to present a software recommendation (such as the one below) during installation. You have complete control to accept the software recommendation by selecting either the“Install” or “Do not install” options on the software recommendation screen.

An example of an OpenCandy recommendation below:

OpenCandy isn't concealed or "piggy-backed" in software installers. In fact, OpenCandy isn't installed on your computer at all. As I said above, it's used by the installer to retrieve and present a software recommendation in the installer, and only in the installer.

It’s important to note that many of the world’s largest anti-virus companies that fight malware, including adware, are partners with OpenCandy. This includes Kaspersky and Symantec. These companies perform intensive analysis of their partners before working with them - it's critical to their reputations.

We believe the Microsoft Security Essentials threat to be inaccurate. When Microsoft created the threat entry on Feb 12th, many anti-virus providers automatically included the threat in their definitions. Most of these inclusions were automatic and made without human analysis. We contacted the providers that were flagging “Adware:Win32/OpenCandy” and they have since determined the threat to be false. Microsoft is alone in their continued classification of the “Adware:Win32/OpenCandy” threat.

If anyone has any questions, I'm happy to answer them.

 

[nitroman84]

"recommendations for other software in their installers" = adware to me. No offense but some of us are extremely particular about what invites itself into our systems

 

[adrianbourke]

"recommendations for other software in their installers" = adware to me. No offense but some of us are extremely particular about what invites itself into our systems

I don't disagree, which is exactly why OpenCandy does not install on your computer or install bundled software automatically without your consent. It's also designed to not collect personally identifiable information, the software recommendation messaging is very clear and accurate, and you choose if you take the additional software or not.

It's completely in your right to not use software installers that include OpenCandy. If you have a fundamental disagreement with advertising, then I completely understand. That's your choice and I support it.

What I'd like to ensure is that people are educated with the accurate and balanced information, so they make an informed decision.

 

[pparks1]

MSE found the OpenCandy stuff for me as well. However, based upon research that I did...which turned out to be what Adrian said above, I ok'd it and set it so that MSE doesn't squawk about it. It's really just advertising within the installer. I'm all for free software and if advertising during the installer is the worst that I get, I can handle that. It's far better than crappy manuevers like sneaking an ebay icon on my desktop, or installing something like the ASK toolbar unless you customize.

 

[Fayla]

Advertising in-software is fine if it isn't ticked for install by default (for those people who just keep clicking next, not wanting to see all the prompts.) It's a sneaky method to catch people out.

MSE found the OpenCandy stuff for me as well. However, based upon research that I did...which turned out to be what Adrian said above, I ok'd it and set it so that MSE doesn't squawk about it. It's really just advertising within the installer. I'm all for free software and if advertising during the installer is the worst that I get, I can handle that. It's far better than crappy manuevers like sneaking an ebay icon on my desktop, or installing something like the ASK toolbar unless you customize.

 

[pparks1]

Advertising in-software is fine if it isn't ticked for install by default (for those people who just keep clicking next, not wanting to see all the prompts.) It's a sneaky method to catch people out.

Well, I guess that is what "some" people get. Aren't people at the point where they are skeptical these days of everything. I'm not sure why people blindly click through the install and then feel they have a legitimate beef when they weren't paying attention.

 

[Borg 386]

I agree pparks1, and this is something that's happening more frequently.

One disturbing trend we're seeing is a lot of companies, that in the past had nothing attached to their free software, are now offering such things (or in some cases, trying to sneak them by) such as the Ask toolbar (just an example).

I've seen it appear in several programs that in the past didn't have it and it's offered either in small print or with the promise "if you don't like it, it's easy to uninstall."

The thing I have to wonder about...legitimate companies will generally respect your option not to install an added item. But what about the "less legitimate" ones? Does clicking "no" mean that it won't go ahead and install it anyway (or a piece of it)?

That why I get a little bit nervous when I see something like that bundled in with software. I generally shut off all connections to the net when I see there's something like that in the bundle.

And indeed, I have witnessed actions committed by these programs several times without my permission. Such as the Ask installer trying to access the internet (fortunately, my firewall caught that and prevented it).

It's apparent that anytime you install anything nowadays, it's a good idea to slow down, read the prompts carefully and don't just blindly click on every yes that pops up to speed the installation. Otherwise, you never know what you may have just put on your HD.

 

[Fayla]

That's why I felt like mentioning the clicking next deal, I have had DIVX start trying to bump this stuff in when it was never there before. They must be hard up for cash if they're having to take handouts from these shady systems.

One disturbing trend we're seeing is a lot of companies, that in the past had nothing attached to their free software, are now offering such things (or in some cases, trying to sneak them by) such as the Ask toolbar (just an example).

 

[pparks1]

Remember that many of these companies "are hard up for cash", they give away their software free.

 

[Fayla]

That's the method "of getting people past the door" so to speak. AOL have been doing it for a long time with their Winamp software, even MBAM does it. I used to use the free DIVX software, but after using their free version for a while I ended up buying their Pro version, audio enhancer and DIVX author + DVD plugin.

+add: These companies don't employ software engineers, register patents etc just to give away free software. Almost every web company will offer a free *basic* service/version of their software or a trial of the pro. Either way they aim to get user(s) drawn in and persuade them to upgrade to the full pro. version. So yes, if they are not doing good profit wise they might stoop to third-party advertising on their website or their installers, since these advertisers pay cash in hand to them. But you know this already.

Remember that many of these companies "are hard up for cash", they give away their software free.

 

[Borg 386]

Yepperz, they are giving away a free software product. And you really can't blame them for taking cash from a company to offer a product. That's just business sense.

What I do object to though, is programs that either blatantly slam something on your HD without warning, or when a program tries to link to the installer online, before the installation of the main program has even begun. (Had it happen a couple times)

I think as the economy worsens, or as the times progress, we'll see a lot more of these offers pop up when you hit the "install" button. It's the way things are headed. You'll just have to be careful.

 

[adrianbourke]

I agree pparks1, and this is something that's happening more frequently.

One disturbing trend we're seeing is a lot of companies, that in the past had nothing attached to their free software, are now offering such things (or in some cases, trying to sneak them by) such as the Ask toolbar (just an example).

I've seen it appear in several programs that in the past didn't have it and it's offered either in small print or with the promise "if you don't like it, it's easy to uninstall."

The thing I have to wonder about...legitimate companies will generally respect your option not to install an added item. But what about the "less legitimate" ones? Does clicking "no" mean that it won't go ahead and install it anyway (or a piece of it)?

That why I get a little bit nervous when I see something like that bundled in with software. I generally shut off all connections to the net when I see there's something like that in the bundle.

And indeed, I have witnessed actions committed by these programs several times without my permission. Such as the Ask installer trying to access the internet (fortunately, my firewall caught that and prevented it).

It's apparent that anytime you install anything nowadays, it's a good idea to slow down, read the prompts carefully and don't just blindly click on every yes that pops up to speed the installation. Otherwise, you never know what you may have just put on your HD.

Absolutely agree with you. There are a lot of "bad actors" in the software bundling space. A lot of companies installing additional software without the user even having the option, without providing clear and accurate messaging about additional software, using opt-tricky practices (putting an "Accept" button where the "Next" button usually is), and simply install or recommending malicious software.

As a company that has set out to build a dynamic software bundling service that respects users rights, security, and privacy, we see these bad actors and practices every day. Honestly it's better today that it was 3 years ago. That being said, there's still a considerable amount of dishonest and questionable things happening.

Regardless of software bundling, users should always be careful when installing software they have downloaded from the internet. They should take their time, read each screen, and take an interest in what they install onto their computers.

 

[winsupertweaker]

It is sneaky because there is no way to "stop the installation" of OpenCandy. Sothink has emailed directly apologizing for their use of OpenCandy. Two problems we all have with any sotware free or otherwise. You must choose custom or advanced isntall not to get the piggy-backed crap (toolbars, gadgets etc.) The second problem, people are still trying to sneak in something that we did not ask for even when we do all the above.

Search Google for people's feelings about OpenCandy. You'll see vendor trying to rationalize using it, and you'll see the consumers reprimanding the developers for using it. It snuck by everyone's spwyare but MSE. What does that tell you? It is something that was installed that I had no way of knowing it was doing so.......perioid. That's just wrong.

 

[adrianbourke]

It is sneaky because there is no way to "stop the installation" of OpenCandy. Sothink has emailed directly apologizing for their use of OpenCandy. Two problems we all have with any sotware free or otherwise. You must choose custom or advanced isntall not to get the piggy-backed crap (toolbars, gadgets etc.) The second problem, people are still trying to sneak in something that we did not ask for even when we do all the above.

OpenCandy does not install without the user's consent. An OpenCandy installation only occurs after the user sees a very clear and transparent offer in the software developer's installer, and chooses to accept the offer. Here is an screenshot of an example offer:

http://winscp.net/eng/data/media/screenshots/installer_opencandy.png

OpenCandy will never download and install additional software unless the user sees a screen such as above. This means OpenCandy is never hidden in the custom or advanced section of an installer. It's against our policy to work with software developers that conduct such practices. You may see an outline of our policy here: OpenCandy Software Network Policies | OpenCandy

Since being a partner with OpenCandy means meeting these policies, several developers have ceased conducting such practices in their installers. We believe this is great for users.

Search Google for people's feelings about OpenCandy. You'll see vendor trying to rationalize using it, and you'll see the consumers reprimanding the developers for using it. It snuck by everyone's spwyare but MSE. What does that tell you? It is something that was installed that I had no way of knowing it was doing so.......perioid. That's just wrong.

Microsoft has examined the current version of OpenCandy and determined it to be malware free.

avast!, Avira, Symantec, AVG, McAfee, Kaspersky, Panda, Trend Micro, PC Tools, BitDefender, and Sunbelt have examined current and previous versions of OpenCandy and determined them to be malware free.

 

[Golden]

Microsoft has examined the current version of OpenCandy and determined it to be malware free.

Hi Adrian,

Can you provide a source/reference for the above statement please?

Thanks,
Golden

 

[adrianbourke]

Microsoft has examined the current version of OpenCandy and determined it to be malware free.

Hi Adrian,

Can you provide a source/reference for the above statement please?

Thanks,
Golden

Absolutely.

MMPC (Microsoft's Malware Protection Center), the division of Microsoft that maintains the threat definitions for Microsoft Security Essentials, Windows Defender, and other Microsoft security products, conducted an examination of our current version of the OpenCandy SDK, and partner installers that include that version.

They determined it not to warrant inclusion in their threat definitions. They updated the threat definition located here to highlight that it only applied to some versions of OpenCandy: Encyclopedia entry: Adware:Win32/OpenCandy

To say:
Some versions of this program may send user-specific information, including a unique machine code, operating system information, locale (country), and certain other information to a remote server without obtaining adequate user consent. These versions are detected by Microsoft’s anti-malware products.
"Some versions" does not include the current version.

To verify you can download the current OpenCandy SDK or a partner's installer that uses it, and have Microsoft Security Essentials scan them. They will come up clean.
Current OpenCandy SDK can be downloaded from here: Developer Signup. Click the "Download the Publisher Kit" link.

The latest version of CDBurnerXP, which includes OpenCandy:
CDBurnerXP: Free CD and DVD burning software

And finally to quote MMPC from an email exchange:
Based on our review, we have determined that the current version of the software does not warrant classification in the definition library. We are currently not detecting the current version of the software and users will not be prompted by Microsoft’s anti-malware products for the current version of the software.

 

[HammerHead]

Smoke

I find the defense of this practice as repugnant as the practice itself.

 

[pparks1]

I find the defense of this practice as repugnant as the practice itself.

You have the option of simply using commercial software that you pay for to alleviate this practice.

I just don't see the problem with advertising during the install of free software and suggestions for other applications that I might find usable. These freeware developers don't make a ton of money, and I'd bet that MOST of us who love these freeware programs we use, don't actually donate money to the cause.

 

[Borg 386]

Everyone has valid points here. Software includes these bundles to make a little extra on the side and in these times, who can blame them.

As long as it clearly states, out front (not buried somewhere in the EULA), that it's giving you a choice to install it, explains what it is and respects your decision when you say "no", that's not necessarily a bad of a thing.

I hope what we can all agree on is that the bundles that give you no choice, no warning, try to install behind your back through shady means and don't give a damn when you hit "NO" need to go.

BTW...doing a recent scan with MSE on a program I d/l ed , it did flag OpenCandy. Not as malware, but as "potentially unwanted software" and gave me the option to delete it or keep it.