Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Beware of Foxit PDF Reader!


  • Please log in to reply
44 replies to this topic

#1 Gary_R

Gary_R

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:50 AM

Posted 21 February 2014 - 01:40 AM

I have been using this program for about a year with no problems.  Tonight when I updated to the latest version from the official website, it tried to install conduit toolbar malware.  Luckily my antivirus caught it before it could work its full range of horrors on my browser, and I uninstalled it with malwarebytes and adwcleaner.  If you want to keep using Foxit, make sure that you don't use express install when updating.  Custom install gives you the option not to install the toolbar with no explanation beforehand.  HOW SNEAKY IS THAT?

As for me, I've already uninstalled Foxit, and will give PDF Xchange a try.  I hope I've helped someone avoid this terrible malware!



BC AdBot (Login to Remove)

 


#2 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 6,040 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:05:50 PM

Posted 21 February 2014 - 02:41 AM

Do you know which version you had.....or which version you updated to ?

 

EDIT......answered my own question.....the version carrying the toolbar is 6.1.4

 

Edit No.2     http://www.foxitsoftware.com/company/press.php?action=view&page=20070706u23f.html


Edited by Condobloke, 21 February 2014 - 03:28 AM.

Condobloke ...Outback Australian  fed up with Windows antics...??....LINUX IS THE ANSWER....I USE LINUX MINT 18.3  EXCLUSIVELY.

“A man travels the world in search of what he needs and returns home to find it."

It has been said that time heals all wounds. I don't agree. The wounds remain. Time - the mind, protecting its sanity - covers them with some scar tissue and the pain lessens, but it is never gone. Rose Kennedy

 GcnI1aH.jpg

 

 


#3 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,234 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:05:50 PM

Posted 21 February 2014 - 05:20 AM

I rate PDFXchange... always have. Does everything that acrobat does and more, except for joining pages.



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,596 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:50 AM

Posted 21 February 2014 - 07:36 AM

Many programs, toolbars and add-ons/plug-ins come bundled with other free third-party software as a common practice by legitimate vendors (and some folks actually like the bundled offers).

When a vendor includes an add-on such as a toolbar, they do so as a way to "pay per install" and recoup associated business costs. This practice is now the most common revenue generator for free downloads and is typically the reason for the pre-checked option. If pre-checked by default, that means you need to uncheck that option during installation if you don't want it. If you install too fast, you most likely will miss the "opt out" option and end up with software you do not want or need. The best practice is to take your time during installation of any program and read everything on the screen before clicking that "Install" or "Next" button. Even then, in some cases, this opting out does not always seem to work as intended.

Calendar Of Updates maintains a comprehensive list of software bundled with unwanted add-ons called the:
Installers Hall of Shame.

More information and Best practices for downloading software can be found in this topic:
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings

I have never condoned bundling of software but this is what we have to live with now as more and more legitimate vendors are doing this to recoup business expenses. Folks need to take some personal responsibility and educate themselves about this practice.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,234 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:05:50 PM

Posted 21 February 2014 - 09:32 AM

great advice Quietman7... well picked.



#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,596 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:50 AM

Posted 21 February 2014 - 09:56 AM

:thumbup2:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:03:50 AM

Posted 22 February 2014 - 08:11 AM

I rate PDFXchange... always have. Does everything that acrobat does and more, except for joining pages.

Ditto, been using PDF Xchange for about 3 yrs. One thing I'll add is that the program sets ASK.com as default search engine (within program, not in browser) which can easily be changed...

 

pdf_xch.jpg

 


Edited by Union_Thug, 22 February 2014 - 11:17 AM.


#8 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,085 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:08:50 AM

Posted 22 February 2014 - 10:57 AM

I have been using this program for about a year with no problems.  Tonight when I updated to the latest version from the official website, it tried to install conduit toolbar malware.  Luckily my antivirus caught it before it could work its full range of horrors on my browser, and I uninstalled it with malwarebytes and adwcleaner.  If you want to keep using Foxit, make sure that you don't use express install when updating.  Custom install gives you the option not to install the toolbar with no explanation beforehand.  HOW SNEAKY IS THAT?

Actually the program offered changes each time; I was offered TuneUp Ulities 2014 (please note BC does not support the use of registry cleaners). Conduit is just a toolbar, it's not malware as such, a PUP definitely though. People should never choose express install when installing programs as it will often install extras, which are sometimes dubious in nature. It was definitely sneaky, I'll give you that. Even Antiviruses are now offering extras too, it's nothing new. It's a way to keep these programs free.

 

xXToffeeXx~


Edited by xXToffeeXx, 22 February 2014 - 10:58 AM.

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#9 jonuk76

jonuk76

  • Members
  • 2,178 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Wales, UK
  • Local time:08:50 AM

Posted 22 February 2014 - 12:32 PM

Is Delta Search/Browser Defender classed as malware or just a PUP?  I inadvertently installed it with a valid program "Unlocker" and I thought it was extremely intrusive (more than standard crapware like Ask Toolbar) and it wasn't easy to remove fully either.


7sbvuf-6.png


#10 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,085 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:08:50 AM

Posted 22 February 2014 - 12:39 PM

It's behaviour is borderline; as such it's not malware in that people (not many) may have installed it purposely, and it's an actual program (a very dubious one certainly). Many antiviruses will not actually classify it as truly malicious (only PUP or adware). AdwCleaner is a good tool for all these toolbars, PUPs, and adware.

 

Personally I do not like any of those toolbars, PUPs and adware as the majority of the time they are unwanted. Many of us will remove these from computers which they are installed on at the same time as removing any malware.

 

That's my thoughts, I guess you could say it was malware, but most consider them either PUP or adware. Malwarebytes classify them as PUP.Optional.Delta, for example.

 

xXToffeeXx~


Edited by xXToffeeXx, 22 February 2014 - 12:42 PM.

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,596 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:50 AM

Posted 22 February 2014 - 02:53 PM

I just installed the latest version release of Foxit PDF Reader...I wasn't offered anything and it installed without adding anything.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,085 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:08:50 AM

Posted 22 February 2014 - 03:03 PM

I guess the installer only offers extras sometimes, nothing new there.

~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,596 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:50 AM

Posted 22 February 2014 - 03:13 PM

Or maybe they knew it was me who downloaded the file and were afraid I'd give them some bad press. :whistle:


.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,085 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:08:50 AM

Posted 22 February 2014 - 03:35 PM

Haha, maybe. You are quite scary and well respected, my friend :wink:


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#15 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:03:50 AM

Posted 22 February 2014 - 06:17 PM

I just installed the latest version release of Foxit PDF Reader...I wasn't offered anything and it installed without adding anything.

Just did a test install in VM, downloaded direct from Foxit also from FileHippo, both offered "Search Protect" & set Conduit as home page, default search & new tabs under Express settings. "Custom" installation had the same settings pre-checked. :whistle:

Foxit_1.jpg

 

Foxit_2.jpg






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users