Download.com - safe, trusted & spyware-free?

One of my old internet pals, Steven Burn, wrote me about finding malware in Kiwi Alpha, which is a peer to peer file sharing client. He found it at Download.com. He knows I’ve had bad experiences at Download.com in the past.

Steven sent me a link to a thread at SpywareWarrior’s forums where he had posted his analysis of Kiwi Alpha. It looked bad, but naturally I had to try it for myself.

I created a clean Win98 virtual machine using Microsoft’s free Virtual PC program. Then I googled for the page at Download.com. I found Kiwi Alpha and installed it in the virtual machine so that I could safely test it without infecting my PC.

Over the next few days, I scanned the program with four different anti-spyware tools and really didn’t find much of anything. I wondered where Steven had gotten his copy of Kiwi Alpha because I noticed that the MD5 checksum was different from the one I had. It looked like we had scanned different files. Steven later confirmed that someone had replaced the infected Kiwi Alpha with a clean version. This apparently happened sometime between November 20th and November 23rd. Isn’t that interesting?

In this case, Download.com is redirecting you to the KiwiAlpha website to download the file. This means that Download.com cannot truthfully guarantee the safety of anything you download from some of their pages. This is common at Download.com, so be aware of it when you go there.

I checked Google’s cached copy of the Kiwi Alpha page at Download.com which was dated November 19th. At the time of this “snapshot”, 800,000 people had downloaded copies of Kiwi Alpha. How many of these downloads had the WhenU/SaveNow and Relevant Knowledge adware in them? What does this tell you about Download.com’s concern about the consumer who comes to their website?

Conclusion: Download.com claims to be “Safe, Trusted, & Spyware Free”. How can they possibly say that? Three strikes and you’re out. You can’t keep us safe, I don’t trust you, and you can’t keep your third party downloads spyware free.

In my opinion, this isn’t the worst practice there. They also provide “sponsored links” to websites that offer more downloads full of adware and other malware.

Example: (screen shot)

Make no mistake about it. Adware is big business and big money. Download.com is getting a piece of the action when they sponsor those websites that distribute adware or other malware.

I recommend that you stay away from Download.com. There are places I trust that offer almost everything I look for. You can find some of them here.

If you want details, I have a complete version of this article in my newsletter.

Drop on by sometime …