Download.com: Not Safe, Not Trusted, And Not Spyware-Free

One of my old Internet friends, Steven Burn, wrote me about finding malware in a program called Kiwi Alpha, which is a peer to peer file sharing client. He found it at Download.com. He also knows I've had bad experiences at Download.com in the past.

Steven sent me a link to a thread at SpywareWarrior's forums where he had posted his analysis of Kiwi Alpha. It looked bad, but naturally I had to try it for myself.

Preparation

I created a clean Windows 98 virtual machine using Microsoft's free Virtual PC program. Then I googled for the page at Download.com. I found Kiwi Alpha and installed it in the virtual machine so that I could safely test it without infecting my PC.

Analysis

Over the next few days, I scanned the program with four different anti-spyware tools and really didn't find much of anything. I wondered where Steven had gotten his copy of Kiwi Alpha because I noticed that the MD5 checksum was different from the one I had. In fact, it looked like we had scanned different files.

Steven later confirmed that someone had replaced the infected Kiwi Alpha with a clean version. This apparently happened sometime between November 20th and November 23rd. Isn't that interesting?

In this case, Download.com is redirecting you to the KiwiAlpha website to download the file. This means that Download.com cannot truthfully guarantee the safety of anything you download from some of their pages. This is common at Download.com, so be aware of it when you go there.

Results

The last time I looked, over 800,000 people had downloaded copies of Kiwi Alpha. How many of these downloads had the WhenU/SaveNow and Relevant Knowledge adware in them?

Download.com could easily host all of the downloads and end this little game of hide and seek. However, I'm sure they talked about it and decided it wasn't "cost effective" to provide a really safe place to download software.

Another friend of mine, JohnInCal, wrote in the CNET forums and got some attention from the right people at Download.com. Finally, as of November 29th, Download.com has removed the download page for Kiwi Alpha.

Thanks also to Tom at Temerc security forums for advice on malware analysis, and for providing a great place to chat about the dark things out there on the net.

Conclusion

Download.com claims to be "Safe, Trusted, & Spyware Free". How can they possibly say that? Three strikes and you're out. You can't keep us safe, I don't trust you, and you can't keep your third party downloads spyware free.

In my opinion, this isn't the worst practice there. They also provide "sponsored links" to websites that offer more downloads full of adware and other malware. Click here for an example screen shot.

Make no mistake about it. Adware is big business and big money. Download.com is getting a piece of the action when they sponsor those websites that distribute adware or other malware.

I recommend that you stay away from Download.com. There are places I trust that offer almost everything I look for. You can find some of them here.

Join the rest of the freeware fanatics at Clif Notes Newsletter, today!