Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Background:

Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other benign software. It seems a lot of free software is using this to make some money from referrals.

Questions:

Is there anything malicious InstallIQ does that I have missed?

Will there come a point that this becomes so ubiquitous that ESET stops flagging it as Adware?

share|improve this question
    
The question "Will there come a point" is a bit argumentative (and in any case has been thoroughly answered by @AaronS). –  D.W. Nov 3 '11 at 5:19
1  
A lot of free software gets wrapped with those install-wrappers by third parties on dubious download sites, without the original project getting any money at all. A recent Google update pushed those download sites further down in the search result list, which is a good thing. –  Hendrik Brummermann Dec 10 '11 at 20:30
1  
@HendrikBrummermann Yep, I just found a wrapper for AbiWord, legal, but unethical –  Martheen Feb 4 '12 at 7:50
    
Malwarebytes Anti-Malware is also flagging it for removal which I chose to do. –  user40578 Feb 22 at 20:54

3 Answers 3

up vote 12 down vote accepted

Is there anything malicious InstallIQ does that I have missed?

From what I can gather, InstallIQ in and of itself does not actually install anything malicious - however, it does provide mechanisms for third parties to bundle additional "offers" with products at install-time, which is a very attractive proposition for malware/spyware authors.

Will there come a point that this becomes so ubiquitous that ESET stops flagging it as Adware?

I understand your concern, but I'm going to say no. There are many competing installer packages available in the market and many are considered more reputable. For example, MSI is Microsoft's preferred solution and integrates best with the likes of WSUS. Aside from MSI, other popular windows installers include NSIS (which I believe Mozilla use) or InstallShield. So InstallIQ has an uphill battle to become ubiquitous.

Secondly, there's a reputation issue. Personally, I would not distribute my software with any kind of add-on bundling solution, especially one which has links with malware distribution, however tenuous, if an alternative existed. Distributing nagware or malware to your customers will do nothing for your goodwill and continuing business. In this sense, such a solution is actually a security threat to you business model.

Finally, antivirus and antispyware producers are not going to ignore malware distribution in installers - even innocent installers could potentially be corrupted or be tampered with. Not catching viruses, nagware and spyware is not a good business model to use as an antivirus company.

So in conclusion, I think there are enough good reasons and sufficient pressure that such solutions are unlikely to become either ubiquitous or ignored, although they will continue to be used on a small scale both legitimately and to distribute malware.

share|improve this answer
    
Thank you, sir. Very informative. –  k to the z Nov 8 '11 at 21:18

It's still Adware, being ubiquitous has nothing to do with that.

Aaron

share|improve this answer
    
I wish the world was as simple as "Adware is Adware", but these installer wrappers are heavily prevalent. Lets say in five years 90% of all free software available for download now contains something similar to InstallIQ. Is an antivirus company really going to flag you 90% of the time you download something? Of course not. –  k to the z Nov 2 '11 at 18:45
2  
According Wikipedia "Adware, or advertising-supported software, is any software package which automatically plays, displays, or downloads advertisements to a computer." en.wikipedia.org/wiki/Adware, so "Adware is Adware" –  AaronS Nov 2 '11 at 19:01
2  
You have so much nerd rage. You are missing the fact that ESET decides what falls into that definition. There are plenty of programs that play/display ads that are not flagged by ESET. –  k to the z Nov 3 '11 at 13:21
1  
@ktothez - what you should do in the case of those other programs is inform ESET, so that it can flag them. –  Rory Alsop Nov 7 '11 at 12:56

It is just what ESET says it is, a "Potentially unwanted application". You can ignore PUAs if that is your policy. Personally, whenever Sophos finds an installer with a PUA like that I have it remove it.

While not specifically malicious, I can't stand coming across machines with unnecessary toolbars taking up screen real estate and processing power for something never used and not wanted. If all you care about is actual malware ignore the PUA alerts.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.