Are there any trustworthy sources for downloading software?
Unfortunately, very few people pay for small Windows programs and utilities, and the decline in advertising revenues has driven an explosion in adware and even malware bundling. Companies that may be struggling to survive have the chance to make, perhaps, 10 cents to $1.50 or more per crapware installation. If they have thousands of downloads per day, it’s very hard to resist.
I assume CNet’s Download.com is one of the worst, because HowToGeek picked it for a recent horrifying/amusing article, Here’s What Happens When You Install the Top 10 Download.com Apps. Even Slashdot Media’s SourceForge, which started as a bastion of open source goodness, now uses an “enhanced installer” or “wrapper” to deliver crapware.
In theory, you can use these sites safely if you decline all the PUPs (potentially unwanted programs) they try to foist on you. You can even try using a utility such as Unchecky, which changes the defaults to Decline, but it probably doesn’t cover every download on the web, However, once you use an installer, you are putting your safety in someone else’s hands – someone who can probably make more money by betraying your trust than by keeping it.
In practice, it’s safest to download software directly from the original source, but not all companies are equally trustworthy. Microsoft and Mozilla (Firefox) should be fine, for example, but Oracle (Java) and Adobe will foist unwanted programs on you if you are not careful.
Many small software houses are trustworthy, but some have downloaded links that take you to another site, such as Download.com. I know you won’t go there again.
If you are not sure which program to download, try Major Geeks or Gizmo’s Freeware, aka Tech Support Alert. Both have the same drawback: they concentrate on the top utilities, which means they’re missing millions of programs. Gizmo’s has better reviews of fewer programs, but it’s a community effort and not all its sections are up to date. I also use AlternativeTo, where programs are rated by people’s votes (likes or “social software recommendations”).
All three sites provide direct links to the official websites for program downloads. This is important because it means you can avoid using Google, and the risk of clicking any Google ads. As you have found, Google is not a good guide to download sites, and some ads may be even worse. (Google has distributed Chrome, Google Toolbar etc as crapware with other downloads, including Avast and Adobe Flash.)
But be careful: even direct download pages can trick you into installing things you don’t want. For example, they may display huge green DOWNLOAD buttons that link to crapware, while the link you want is just one word of small, underlined text. Hover your mouse over the links to see where they actually go.
App stores and more
One solution would be a software repository that worked like the various app stores provided by Amazon, Apple, Google and Microsoft for smartphones and tablets. This isn’t foolproof because developers can still upload crapware, but at least the app store providers are trying to keep it out. Also, app stores work better for smartphone and tablet apps – which are small and very constrained as to what they can do – than for complex and powerful desktop/laptop software. Nonetheless, I expect the trend towards stores offering desktop software will continue.
There are also some independent stores, such as Ninite and AllMyApps. I have previously recommended both as reliable sources of crapware-free downloads. As far as I know, they still are trustworthy, but both use downloaders, and I can no longer see how to download individual programs from AllMyApps. Both also want to keep your downloads up to date, which may be a great idea for many users, but irritates my inner control freak.
Another solution is a “package manager” like the ones for Linux users. The leading Windows package manager is Chocolatey, which is “somewhat like apt-get, but built with Windows in mind”. Microsoft encourages this sort of thing, and is developing its own open source package management aggregator calledOneGet. It’s included in the Windows 10 preview code, which is mostly used by techies. I suspect not many ordinary users want to install software by typing text commands in what looks like a DOS window (PowerShell).
If you always download known programs from known sources – which I do – then you may never see this problem. People mainly get caught if they don’t know what they want or where to get it, which is why sites like Major Geeks, Gizmo’s, and AlternativeTo are important. After that, the bigget risk probably comes from “social engineering” approaches, such as the pop-ups that insist you download an unwanted (and virus-laden) Flash update right now, to watch a dubious video, rather than going to get.adobe.com/flashplayer/ and refusing the added crapware.
You can also run programs that help defend your PC. For example, add uBlock to your browser (with a suitable blocklist) instead of AdBlock Plus, and install theMVPS Hosts file to reduce the number of potentially deceptive ad links. Also, try running Malwarebytes Anti-Malware, because it takes a more hostile view of PUPs than most anti-virus programs.