Spyware in Daemon Tools Lite installer?

[bpz2]

When I run the Daemon Tools Lite installer I get an alert for Riskware.Win32.Somoto.AMN. I ran the installer and it is immediately sending out a long list of what is installed on my system without asking and downloading dll and exe files that have virus warnings before I even click on anything. This is spyware! How can I get a spyware free installer??

[Sway]

It's not a spyware. It's a "false-positive" reaction of your antivirus.

In case digital signature of DAEMON Tools setup file is valid, we guarantee you that our software does not contain any harmful code. All binary and executable files of installed DAEMON Tools are also signed with our official digital certificate.

[bpz2]

Thanks for your reply Sway.

It's not a spyware. It's a "false-positive" reaction of your antivirus.

Maybe I was not specific but after the alert I already ran Daemon Tools Lite installer in Wireshark and this list about my system is sending to nsis.bisrv.com -

installer_data={"uid":"B43DE587EB164BCFB239BCDE74CD65D0","muid":"af80b63072ef4fa6b059bd38b2d723d0","affid":"daemontoolslite","sid":"daemontoolslitemdma","installerVersion":"2.0.0u","osVersion":"6.1.7601 64bit","ieVersion":"9.0.8112.16421","ff_installed":"0","ff_version":"","ff_default_homepage":"not_found","ff_is_default":"0","ie_installed":"1","ie_version":"9.0.8112.16421","ie_default_homepage":"","ie_is_default":"1","chrome_installed":"0","chrome_version":"","chrome_default_homepage":"not_found","chrome_is_default":"0","opera_installed":"0","opera_version":"","opera_default_homepage":"not_found","opera_is_default":"0","safari_installed":"0","safari_version":"","safari_default_homepage":"not_found","safari_is_default":"0","couponamazing":"false","couponamazing_check2":"false","couponamazing_check3":"false","default_browser_not_chrome":"null","default_browser_not_chrome_xp":""C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome","addlyrics":"false","FiftyonRED_2":"false","FiftyonRED_3":"false","FiftyonRED_4":"false","FiftyonRED_5":"false","firefox_version_not_8_to_12_XP":"null","firefox_version_not_8_to_12_Win7":"null","default_browser_ff_1":""C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome","default_browser_ff_2":"null","default_browser_not_ff_1":""C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome","default_browser_not_ff_2":"null","CouponCaddy_1":"false","CouponCaddy_2":"false","CouponCaddy_3":"false","sdp":"false","iminent_32bit":"false","iminent_64bit":"false","dotnet_4":"1","conduit":"false","babylon":"false","claro":"false","incredibar_1":"false","incredimail":"false","incredimail_2":"false","fixie":"false","incredibar_post":"false","pcfixspeed":"false"}

All binary and executable files of installed DAEMON Tools are also signed with our official digital certificate.

It is downloading the files bitool.dll from nsis.bisrv.com and bi_downloader.exe and installercdn.filebulldog.com with Riskware.Win32.Somoto.AMN without asking. I checked the signature like you said and one is not signed and one is signed by Somoto, so it is not a false positive.

Is this riskware supposed to be there? It is not even mentioned.

[Sway]

DAEMON Tools Lite is absolutely free for personal use. We have several legal partners to monetize our freeware. SOMOTO is one of these partners. Such services recommend users to install 3rd party software (toolbars, search engines or some useful software) during DAEMON Tools Lite installation. BUT it is absolutely optional. You can uncheck appropriate options in installation wizard, and nothing will be installed together with DAEMON Tools Lite. Also you can disable your Internet connection during installation to prevent any offers. And of course, paid version of DAEMON Tools Lite does not contain any partner offers.

[tss]

DAEMON Tools Lite is absolutely free for personal use. We have several legal partners to monetize our freeware. SOMOTO is one of these partners. Such services recommend users to install 3rd party software (toolbars, search engines or some useful software) during DAEMON Tools Lite installation. BUT it is absolutely optional. You can uncheck appropriate options in installation wizard, and nothing will be installed together with DAEMON Tools Lite. Also you can disable your Internet connection during installation to prevent any offers. And of course, paid version of DAEMON Tools Lite does not contain any partner offers.

You are wrong on 2 points:

- I unchecked everything that is related to toolbars and such obviously malware software during installation, and it managed to install itself! The "useful software" I found is incredibar, I remembered UNCHECKING the options to install it (there were 3 of them), and it still altered my browsers search engines/default pages. I reverted back to the originals but continued the search and found 3(!) different applications (incredibar toolbar for IE, IB updater, and the third is called sth similar, IB...), even though I did not want them on my computer, and you said those were optionals. No, those were not.
- These toolbars are very-very far from useful. All of those are malwares altering the default options/installing themselves without questions. I know it's not easy to make high quality free software, but letting these ***** infections into the users computers is a really bad habit in my opinion!

[Terramex]

Just tested myself, and i guess you've pressed 'OK' in the confirmation window, but there you should have canceled.


Granted, it's far from perfect, but DT Soft has no bearing on that behaviour.

[Sway]

Thank you, Terramex.

Yes, we have no bearing on that behaviour. Please be attentive during installation process.

[RobM]

DAEMON Tools Lite is absolutely free for personal use. We have several legal partners to monetize our freeware. SOMOTO is one of these partners. Such services recommend users to install 3rd party software (toolbars, search engines or some useful software) during DAEMON Tools Lite installation. BUT it is absolutely optional. You can uncheck appropriate options in installation wizard, and nothing will be installed together with DAEMON Tools Lite. Also you can disable your Internet connection during installation to prevent any offers. And of course, paid version of DAEMON Tools Lite does not contain any partner offers.

I am new user and have just tried to use your lite version of your software for the very first time downloaded from your site, while installing the installer asked me to install the toolbar, I unticked all the options but the installer still installed this parasite on my newly formatted machine with fresh copy of Windows 8, not only that home pages in both firefox and ie have been changed to mysearch and it was a pain in the butt to remove. This type of behavior verge on spyware/malware and you need to keep a tighter grip on who you deal with, I will be telling all my friends to avoid using your program for this very reason.

[TomCC]

How about when it is IMPOSSIBLE to untick the options?

First of all: the extra "goodies" page I was offered was in russian. I live in Estonia, we haven't been part of the Soviet empire for 22 years now.

Second of all: at this point I couldn't just exit the installer either. The close button was disabled.

Third of all: After finding somebody to translate, I selected the option that would let me untick the bastards. I had just formatted the computer to get rid of the zombie corpses of unwelcome tag-alongs. IT WOULDN'T LET ME UNTICK THE OPTIONS. Neither by clicking on them nor by keyboard-jutsu could I untick the choices. At that point I just killed the installer process. If pushed with force in directions unpleasant, push back harder.

Straangely, when I tried the installer again, to get a screenshot of the offending tag-along, it let me untick the boxes. I was so overjoyed, I forgot to take the screenshot, and I'm not running it again. Still, maybe let your partners know that I'm hardly motivated to install something in a language I don't understand. If you get paid by the number of people actually installing stuff via your installer, it would benefit you too.

[Thels]

I had similar options to the above. I was alarmed that a newer version was available, so I updated, and it asked me like 3 or 4 extra addons. One of the addons was called Delta Search, which mentioned it was going to replace my search engines and homepage. Obviously, I wasn't so interested in that, so I cleared the boxes, and continued the install.

Then I found out that Firefox had still updated it's search engine to Delta Search, and Internet Explorer now opened on the Delta Search homepage.

I understand the reason about including additional packages, and I can even understand it if the software is unavailable without also installing one of the packages, as long as you inform the user about this, and give him an option not to install the entire software. But secretly installing the package anyhow, even though the user specifically requested not to include the package and wasn't under the assumption that the package would be included is not exactly proper.

[Terramex]

You should have got a confirmation windows like the one in post #6.
Please take also a look here: http://forum.daemon-tools.cc/f14/del...82/#post137314

[Monz]

So if I do uncheck all boxes & press cancel in the confirmation window this thing won't install itself by his own?

[Terramex]

Exactly! Pulled the installation through without an annoying surprise.

[Monz]

Ok, I'll try it and post the result here.

[Smiling Cat]

I guess I will chime in here instead of making a new thread. Recently reinstalled windows and while I was installing the latest DAEMON Tools Lite v4.46.1 (with SPTD 1.83) from Disc-Tools.com and I clicked that OK in the popup for Delta-Search after turning off all the install radio boxes for it. After I cleaned it up I reinstalled just to make sure it was my error and it was, but the OK or Cancel got me since I've been installing all sorts of programs. My fault\mistake, but the amount of time it took to get that Delta-Search removed really put me off. It really does a number. Changing multiple settings for three different browsers, adds extensions for the, and has multiple uninstalls that still leaves problem remnants all over. Even some Babylon toolbar stuff that didn't actually installed, but they are related so some registry settings get placed.

I love the DEAMON Tools and have been using it since the around the time the first version came out. Small headache for me, but I recommend it to friends and family. If I had to walk them through removing Delta-Search I am sure they would rather go with Nero or something else just because hassle even if I explained if they bought it there would be no issue. Oh well just put my thoughts out there while I was staring at file transfers, disc rips, and backup percentage bars.