"If you want to stop this kind of thing you need to get angry at the people who fund it and make money from it." I actually believe that the people making mone

"If you want to stop this kind of thing you need to get angry at the people who fund it and make money from it." I actually believe that the people making money from it are: (1) the big search engines (2) companies promoting toolbars (3) toolbar publishers. I believe the main issue is not DIVX's Conduit Toolbar (which from what I can see is fairly transparent - see below for my notes on their installation flow), but the parasitic nature of this industry funded mainly by the big search engines themselves: Google, Bing and Yahoo. Conduit and Babylon toolbars generate revenue via their partnerships with the big three. They get paid to help search engines gain market share and generated revenue. This revenue model is similar to a parasitic model because the product, often very inconspicuously, "attaches" itself to the browser. This "attached" entity provides no real added value to the "host" or user. It "feeds" off of the user's searches and sponsored result clicks. On top of that, toolbars are often harmful to the user by causing browser slowdowns, freezes, crashes, HTML/JS injections, ad insertions, page rendering errors, etc. However, the worst that I have seen in this space are advertisers pushing toolbars on Google, Bing and Yahoo by hijacking the products of popular freeware publishers (VLC, Adobe PDF Reader are examples). Here's an example with VLC: http://i.imgur.com/wesQBcF.png http://i.imgur.com/wesQBcF.png Users trying to get VLC are duped into running these hijacked products. Though VLC is ultimately delivered at the end of the installation, most users won't see that they are also installing several add-on components like a Conduit toolbar. If you download from VLC.Download-Insider.com and install their toolbar you'll get the following: - Bing as default browser search - Conduit homepage (Bing-powered) with banner ads: http://i.imgur.com/8MIG9Lb.png http://i.imgur.com/8MIG9Lb.png - Ad injection on Google search results page: http://i.imgur.com/A2XrQxF.png http://i.imgur.com/A2XrQxF.png - Coupons on some shopping sites: http://i.imgur.com/2tR88DG.png http://i.imgur.com/2tR88DG.png I'm actually quite surprised that this is still going on and that the big search engines are still allowing them to advertise a product they clearly do not have the rights to. * NOTES - DIVX INSTALLATION FLOW * Chrome already seems to be detecting the downloadable file on divx.com as malicious: http://i.imgur.com/9qs4tex.png http://i.imgur.com/9qs4tex.png I ran through the installation process on a VM. Here are the screenshots. 1 - Startup with language selection: http://i.imgur.com/9qs4tex.png http://i.imgur.com/9qs4tex.png 2 - EULA (agreement unchecked, no mention of Bing or Conduit): http://i.imgur.com/DB37y8I.png http://i.imgur.com/DB37y8I.png 3 - Installation components (all DIVX-related): http://i.imgur.com/q7wsLeL.png http://i.imgur.com/q7wsLeL.png 4 - Conduit offer screen: http://i.imgur.com/fOgUnrO.png http://i.imgur.com/fOgUnrO.png - Conduit Toolbar (opt-out) - Conduit Search + Search Protect(opt-out) - EULA and Privacy Policy as text links 5 - Post-install email collection: http://i.imgur.com/9Ym3mkh.png http://i.imgur.com/9Ym3mkh.png 6 - The toolbar itself: http://i.imgur.com/dQdsaic.png http://i.imgur.com/dQdsaic.png Based on the installation flow, the offer was stated, albeit very discretely. I hate homepage and search takeovers as much as everyone, but DIVX appears to be doing it in a transparent way (and I'm not sure why Chrome flagged their exe as being malicious).