In my previous job, I worked at an advertising company in the "downloadables" department for a number of years. Basically we developed browser toolbars, softwar

In my previous job, I worked at an advertising company in the "downloadables" department for a number of years. Basically we developed browser toolbars, software installers, mobile apps, and other software all with the sole purpose of gathering information about users in order to make money off them. We never (to my knowledge) developed any actual keyloggers, but we would do other equally insecure things with end users' data. For example, sending browser cookies, registry values, files off the hard drive, etc. in plain text to databases on our servers for later analysis. Getting this kind of software through spyware screens in antivirus programs is not too difficult. Some of the antivirus companies have automated processes by which you can upload your binaries to them as false-positives and they'll automatically whitelist them for you. Sometimes it requires a quick email or phone call to the appropriate person at the antivirus company. Occasionally you have to make changes (usually just adding more disclaimers to an already ridiculously long EULA) in order to satisfy them and get on the whitelist. On a few occasions we just had to pay some money to get whitelisted. Some of the more inscrupulous antivirus companies would even take money to bundle our now-whitelisted spyware applications in the installers for their products (as a checked-by-default "also install" option). My takeaway from my time in that industry is that antivirus and antispyware software and companies are, by and large, just as bad as a lot of the spyware and spyware producing companies that they claim to be protecting you from. It's just a big circle jerk where the ultimate goal is to trick people into generating revenue by installing software or seeing ads that nobody in their right mind would ever actualy opt-in to.