Spyware in Daemon Tools Lite installer?
When I run the Daemon Tools Lite installer I get an alert for Riskware.Win32.Somoto.AMN. I ran the installer and it is immediately sending out a long list of what is installed on my system without asking and downloading dll and exe files that have virus warnings before I even click on anything. This is spyware! How can I get a spyware free installer??
It's not a spyware. It's a "false-positive" reaction of your antivirus.
In case digital signature of DAEMON Tools setup file is valid, we guarantee you that our software does not contain any harmful code. All binary and executable files of installed DAEMON Tools are also signed with our official digital certificate.
Thanks for your reply Sway.
Maybe I was not specific but after the alert I already ran Daemon Tools Lite installer in Wireshark and this list about my system is sending to nsis.bisrv.com -Originally Posted by Sway
Code:installer_data={"uid":"B43DE587EB164BCFB239BCDE74CD65D0","muid":"af80b63072ef4fa6b059bd38b2d723d0","affid":"daemontoolslite","sid":"daemontoolslitemdma","installerVersion":"2.0.0u","osVersion":"6.1.7601 64bit","ieVersion":"9.0.8112.16421","ff_installed":"0","ff_version":"","ff_default_homepage":"not_found","ff_is_default":"0","ie_installed":"1","ie_version":"9.0.8112.16421","ie_default_homepage":"","ie_is_default":"1","chrome_installed":"0","chrome_version":"","chrome_default_homepage":"not_found","chrome_is_default":"0","opera_installed":"0","opera_version":"","opera_default_homepage":"not_found","opera_is_default":"0","safari_installed":"0","safari_version":"","safari_default_homepage":"not_found","safari_is_default":"0","couponamazing":"false","couponamazing_check2":"false","couponamazing_check3":"false","default_browser_not_chrome":"null","default_browser_not_chrome_xp":""C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome","addlyrics":"false","FiftyonRED_2":"false","FiftyonRED_3":"false","FiftyonRED_4":"false","FiftyonRED_5":"false","firefox_version_not_8_to_12_XP":"null","firefox_version_not_8_to_12_Win7":"null","default_browser_ff_1":""C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome","default_browser_ff_2":"null","default_browser_not_ff_1":""C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome","default_browser_not_ff_2":"null","CouponCaddy_1":"false","CouponCaddy_2":"false","CouponCaddy_3":"false","sdp":"false","iminent_32bit":"false","iminent_64bit":"false","dotnet_4":"1","conduit":"false","babylon":"false","claro":"false","incredibar_1":"false","incredimail":"false","incredimail_2":"false","fixie":"false","incredibar_post":"false","pcfixspeed":"false"}It is downloading the files bitool.dll from nsis.bisrv.com and bi_downloader.exe and installercdn.filebulldog.com with Riskware.Win32.Somoto.AMN without asking. I checked the signature like you said and one is not signed and one is signed by Somoto, so it is not a false positive.
Is this riskware supposed to be there? It is not even mentioned.
DAEMON Tools Lite is absolutely free for personal use. We have several legal partners to monetize our freeware. SOMOTO is one of these partners. Such services recommend users to install 3rd party software (toolbars, search engines or some useful software) during DAEMON Tools Lite installation. BUT it is absolutely optional. You can uncheck appropriate options in installation wizard, and nothing will be installed together with DAEMON Tools Lite. Also you can disable your Internet connection during installation to prevent any offers. And of course, paid version of DAEMON Tools Lite does not contain any partner offers.
You are wrong on 2 points:
- I unchecked everything that is related to toolbars and such obviously malware software during installation, and it managed to install itself! The "useful software" I found is incredibar, I remembered UNCHECKING the options to install it (there were 3 of them), and it still altered my browsers search engines/default pages. I reverted back to the originals but continued the search and found 3(!) different applications (incredibar toolbar for IE, IB updater, and the third is called sth similar, IB...), even though I did not want them on my computer, and you said those were optionals. No, those were not.
- These toolbars are very-very far from useful. All of those are malwares altering the default options/installing themselves without questions. I know it's not easy to make high quality free software, but letting these ***** infections into the users computers is a really bad habit in my opinion!
Just tested myself, and i guess you've pressed 'OK' in the confirmation window, but there you should have canceled.
Granted, it's far from perfect, but DT Soft has no bearing on that behaviour.
I'm not employed by Disc Soft and my views do not necessarily reflect the ones of the company.
Thank you, Terramex.
Yes, we have no bearing on that behaviour. Please be attentive during installation process.
I am new user and have just tried to use your lite version of your software for the very first time downloaded from your site, while installing the installer asked me to install the toolbar, I unticked all the options but the installer still installed this parasite on my newly formatted machine with fresh copy of Windows 8, not only that home pages in both firefox and ie have been changed to mysearch and it was a pain in the butt to remove. This type of behavior verge on spyware/malware and you need to keep a tighter grip on who you deal with, I will be telling all my friends to avoid using your program for this very reason.
How about when it is IMPOSSIBLE to untick the options?
First of all: the extra "goodies" page I was offered was in russian. I live in Estonia, we haven't been part of the Soviet empire for 22 years now.
Second of all: at this point I couldn't just exit the installer either. The close button was disabled.
Third of all: After finding somebody to translate, I selected the option that would let me untick the bastards. I had just formatted the computer to get rid of the zombie corpses of unwelcome tag-alongs. IT WOULDN'T LET ME UNTICK THE OPTIONS. Neither by clicking on them nor by keyboard-jutsu could I untick the choices. At that point I just killed the installer process. If pushed with force in directions unpleasant, push back harder.
Straangely, when I tried the installer again, to get a screenshot of the offending tag-along, it let me untick the boxes. I was so overjoyed, I forgot to take the screenshot, and I'm not running it again. Still, maybe let your partners know that I'm hardly motivated to install something in a language I don't understand. If you get paid by the number of people actually installing stuff via your installer, it would benefit you too.
It looks like a duck, quacks like a duck, even walks like a duck. It has to be a hippie pigeon.
I had similar options to the above. I was alarmed that a newer version was available, so I updated, and it asked me like 3 or 4 extra addons. One of the addons was called Delta Search, which mentioned it was going to replace my search engines and homepage. Obviously, I wasn't so interested in that, so I cleared the boxes, and continued the install.
Then I found out that Firefox had still updated it's search engine to Delta Search, and Internet Explorer now opened on the Delta Search homepage.
I understand the reason about including additional packages, and I can even understand it if the software is unavailable without also installing one of the packages, as long as you inform the user about this, and give him an option not to install the entire software. But secretly installing the package anyhow, even though the user specifically requested not to include the package and wasn't under the assumption that the package would be included is not exactly proper.
Posting Rules
Reply With Quote
Bookmarks