4 Replies Latest reply on Oct 28, 2016 1:57 PM by ChrisSisk

    MALWARE: Flash player installs McAfee without permission

    bgoldnyx

      My browser (Firefox) claimed that my flash player was out of date. I clicked the install button to make the browser happy(1), and it install McAfee antivirus and Intel True Key as well. I have no particular objection to True Key except that it should not be installed without the user's permission. But I have no idea what Adobe thinks it is doing, installing an antivirus program without the user's permission.

       

      I promptly uninstalled McAfee, of course. I hate to think what would have happened if I'd needed to reboot and had _two_ antivirus programs running. My past experience is that having two or more AV programs makes the system pretty much unusable until you boot into Safe Mode and remove one of them. Uggh!

       

      Installing software that is likely break the user's machine is MALWARE in my view. A naive user would have no idea what is going on, and not even be able to reach the web to get support from a forum like this.

       

      I hope that in the near future Adobe will stop doing this. If not, I may have to search for an alternate player.

       

      (1) The flash game I wanted to play has been on my hard drive for years, so it's unlikely to have any recently-discovered exploits, nor to have any malware at all.

        • 1. Re: MALWARE: Flash player installs McAfee without permission
          m_vargas Adobe Employee

          The offers are not installed without permission.  They display in the center of the download page and the user has the option to not accept the offers:

          getflashplayer.JPG

           

          Certain ad-blockers and disabling JavaScript will hide the offers.

          • 2. Re: MALWARE: Flash player installs McAfee without permission
            bgoldnyx Level 1

            Here's what my browser window looks like after choosing "Adobe Flash Player" from the dark gray list at the right side of the list of available downloads. As you can see, there's nothing about the options there.

             

            AFAIK I'm not running a popup blocker -- some sites do pop up windows. And I use sites that need Javascript, so that works too.

             

            This shows the problem with turning on additional software by default -- especially software that can damage a user's machine (like two conflicting anti-virus products). If your page is too complicated, the option may not show up at all.

             

             

             

             

            • 3. Re: MALWARE: Flash player installs McAfee without permission
              m_vargas Adobe Employee

              Thank you for posting the screenshot.  I'll forward it to the team that handles the online installer.

               

              I'm not sure what you mean by "Here's what my browser window looks like after choosing "Adobe Flash Player" from the dark gray list at the right side of the list of available downloads." The get.adobe.com/flashplayer page (the one in your screenshot) doesn't provide the ability to select a specific Flash Player to download.  It auto-detects the OS and browser and offers the corresponding Flash Player for that OS/browser combination.

              • 4. Re: MALWARE: Flash player installs McAfee without permission
                ChrisSisk

                I have experienced this as well.

                 

                I'm not going to give any screen shots. What I am going to do, is say that I've been using photoshop since 5, and been a creative cloud subscriber and defender since the first version. I got an email from adobe to install a flash update, which I did, after navigating to adobe on my own to make sure there was no malware attack. I then installed a flash update, from your site. A day later, mcafee is installed on my computer, without any permission given by me.

                I don't give a flying f- if you have an 'opt out' option in there, and it was somehow hidden by ad blocking. As any designer who is worth their salt knows, opt out is basically just a way of funneling 90% of users to an option while maintaining an argument that you aren't 'forcing' the option. I'm a paying customer who loves and evangelizes your product, and you just stabbed me in the back. F- you. If this ever happens again, I'm done. End this **** right now. You know it is morally indefensible, no matter what the economic reasoning by some f-wit manager. No, I'm not going to be reasonable. This is not acceptable behavior. Fix it.