How-To Geek
Avast Antivirus Was Spying On You with Adware (Until This Week)
We warned you at the beginning of the year that many of your browser extensions are spying on you, tracking what you are visiting, and even inserting ads into pages. These aren’t just no-name developers either: even Avast, one of the most trusted antivirus vendors was in on the game.
Update 2: We just want to point out that this happened in the past, and Avast has cleaned up their act. They have a decent product, and while you can read this for historical purposes, you should know that many of the other antivirus vendors are doing worse things.
Update: Avast has posted a response to our article on their forum. We stand by our article and our research with the exception of one very inconsequential technical detail that we have updated below. The purpose of writing these types of articles isn’t to be vindictive — we just honestly want to make the world a better place for PC users.
Before we go even one step further, it’s important to note that they recently disabled the spying “shopping” feature in their browser extension. So if you are running the latest Chrome with extensions updated, you are fine. For now.
So Avast has stopped integrating the spying extension, but this is about the principle: you should be able to trust your antivirus provider. Why are they adding a feature that spies on your browsing, inserts ads… and all without properly notifying you?
And why, at the same time, are they claiming to stop spyware, even uninstalling other shopping extensions from other vendors, while they were doing the same thing they are supposed to stop?
Avast removes other Shopping extensions while leaving theirs enabled
On our test system, the only spyware and crapware that Avast actually detected and removed were the ones that competed with their own shopping extension.
Avast Online Security Extension Added a “Shopping” Component
No, the install process didn’t tell us about this.
About a week ago, we were playing around with installing a lot of nonsense from crapware sites, so we loaded up trusty Avast antivirus to see how much of the malware it would actually catch during the process. We were shocked to find out that some of the adware wasn’t from a third-party, but from Avast itself.
The problem lies in the SafePrice component of their Online Security extension, which adds shopping recommendations (ads) as you are browsing around the web.
Here’s the thing: many people actually want shopping extensions that help them find better prices — in fact, one of the HTG staff writers recently asked me what was the best way to find better prices. As a standalone product, if you specifically and deliberately choose to install something like this, there’s nothing wrong with it.
The problem is that Avast snuck this component in to their browser extensions that have at least 10 million users for the Chrome version alone. And then they enabled it by default.
Note: as we were doing research for this article, they updated their extension to not include the shopping feature, but it was there since maybe around last December.
Spying, You Say?
You might remember earlier how we said that this extension is spying on you and, unlike many websites, we’re definitely not going to make some claim like that without proof of what is really going on. So we loaded up Fiddler to see what’s really going on behind the scenes and under the hood and behind the curtain.
As it turns out, every single URL that you visit was being sent to Avast servers — first there would be a check to /urlinfo on one of their servers, passing in a unique ID that represents you on every single request. In this way they can build a list of every single page you have ever visited. They claim on their web site that they remove all personally identifying information, but how, exactly, are they able to do that when they are tracking every single page you visit and sending back that URL with a unique ID to represent you?
Update: Avast contacted us to point out that the /urlinfo page that we showed in the screenshot is actually part of their security extension, which does make sense. The /offers page, however, is sending back data as well.
That unique tracking ID is the biggest problem here: while it might not identify you by name, it’s enough to tie your whole browsing history together, and that’s a scary thing.
And remember, you didn’t ask for this. You just wanted to keep yourself safe online with a trusted antivirus provider.
The Bottom Line: Browser Extensions Have Wayyyy Too Much Power
This behavior, while ridiculous and sad from a company you should trust, isn’t new at all. Almost every product and service on the Internet and almost every browser extension, app, and website, are doing some form of tracking. Here on How-To Geek we use Google Analytics to see our site statistics, and our advertisers probably use a lot of other tracking that we can’t control. And it’s the same with every single web site.
Personal information and big data have become the standard; because after all: if a product is free, the real product is you. If you are browsing and reading a completely free web site, it’s not that big of a deal… after all, sites like ours need to pay our writers, and advertisements are the only way to do that. The problem is when it’s across everything you do.
The problem is that most browser extensions have access to everything you are seeing on the Internet, across every web site. And they aren’t properly disclosing this to you.
So the next time an extension says it can “Read and modify all your data on the websites you visit”, perhaps you should click that “Remove from Chrome” button instead.
How about Avast Mobile Security?
I still use Avast as they are the best when it comes to free antivirus, I have known about this since about July, and every customer machine I install with avast I disable this.I also turn off the software updater and the "grimefighter" tool. It is very dishonest on their part though, and it should be a option I can choose to turn on not something I have to hunt for to turn off. Any other free antivirus software that does not have something evil in it, I used to use AVG but that whole drivers update stuff turned me off of them, which is why I moved to Avast.
I'm glad I disabled that extension and used WOT(Website of Trust) instead.
With Microsoft Security Essentials degraded and Avast no longer viable, what free option should I go with?
Looks like it might be time to switch back to Avira. Although when installing Avast I always uncheck everything but the actual anti-virus portion of it.
I really wish browsers would not allow extension to be installed at all unless you go and get them yourself from the actual extension repository the browser uses. Chrome has made better strides with this lately, but there still should be more done.
Somebody on Twitter just said that Avira was doing the same thing. I haven't had a chance to look into it yet.
Carry on using MS Security Essentials but add in EMET 5.0 as well.
No AV is perfect. I've seen them all beaten time after time. So basically go with the cheapest and least bothersome.
If it's your day to get a virus then there is nothing you can do to stop it really. Just luck of the draw.
From what I've been testing, one of the best things you can have is Malwarebytes, which is one of the only anti-malware tools that actually catches most spyware. It's not perfect, but it's a lot better than antivirus that sits there saying everything is fine when it isn't.
I know why people don't like this stuff but the reality is, some of it is needed! Avast! is a mostly free product, they need to make their money somewhere. I would prefer to trust my anti-virus vendors extension than some random one on the internet that's bloated. They should of probably been more transparent about it really.
I use Malwarebytes Free and Bitdefender Free edition. Both seem to work very well and I haven't had any problems. A while ago, I used to use Avast, long before the spyware was added. and I swtiched to Bitdefender because its rated as one of the best anti-viruses.
@piercy Compaines can make their money from their non-free (paid for) products like their Internet Security Suites. If they aren't making enough from sales, they should improve their product (to beat the competition) or stop giving away the free products.
Why? Simple the same reason all the others are spying -- GREED. There is an insane amount of money to be made by selling out your customers and any time there is that much money involved someone will sell their own grandmother.I was using Avast - No more - they just lost another formerly loyal customer with this bit of low life stupidity. I hope enough people dump them to make it clear that GREED has its costs. And I hope someone at Avast gets fired over this.The fact that they claim to have stopped is now no longer relevant. They got caught with their hand in the cookie jar and now must pay the price.
Use Comodo Internet Security Free, it has top notch browser sandboxing, even has a secure desktop sandbox (with Free Angry birds game, thanks Comodo!) you can use and best of all it gives you the OPTION of using the same Comodo Secure DNS they use in their paid version but you can uncheck the box if you don't want it. I decided to use it and it catches a lot of infected malware adverts before they can load which is VERY nice.
Not surprised.- they have google analytics code in antivirus.- they had open candy in antivirus but removed when users found out.- and now this spying.Avast now looks more like an spyware rather than an antivirus.I used avast for a long time and stayed with an older version 6 to avoid these things, but now they forcefully upgraded the installation to 2014 version even when program updates was set to manual. Uninstalled it right away and installed MSE.
up until a year ago Malwarebytes was next to useless. I could scan an infected PC with it and it would findnothing and them MSE/Combofix etc. would find loads of bad stuff. It got so bad I dropped it from my range of cleaning software.
I then tried it with its new detection engine and its much better. Its now back on my list as one of the scanners I use for cleaning.
The big mistake people make is using just one product to clean their machines. I use a minimum of five products to clean up a infected machine.
The HDD/SSD is removed and then scanned with -
MalwareBytesMS Security EssentialsSuperAntiSpyware
All three will find different things.
The drive is then put back in the machine and further scanned with -
Adware CleanerCombofix
I then know that the machine is pretty clean and usable from that point on. One clean does not do the job.
Well, I was shocked upon seeing the subject of the newsletter itself, but the problem is with the users. I have been an avast user for the past 6 years and had it installed it over a 100+ PCs but never had this extension installed.
The problem is that people must be precautionary while installing free software, just clicking the next button a couple of times and getting things installed will lead to this. Always take your time choose custom option, and disable things you know you wouldn't use and Finish the installation.
Even chrome will notify you of new extension installed, but we will always choose to ignore these things.
I'd love to know the reaction of some of extensions owners if any of them were spying on my browsing history in Firefox:"Tumblr porn blog, Tumblr porn blog, Tumblr porn blog, Rule34, Shadbase, Lazygirls, Redtube, Redtube, Pornhub, Beeg, Redtube, Facebook of sexy cosplayer, 4chan, Redtube"
They can have that...
You should be able to trust your antivirus provider, even with their browser extension. You chose to not install it, which is why you didn't get the ads.
Anybody else that trusted them got adware.
And that's pretty messed up, and it's silly to defend that position, which is basically "Oh, you should have known that Avast would spy on you and not installed it".
I have personally used and installed Avast Anti-virus on many computers, I have never had it download any spyware. Thanks for the information, I will take a good look at the 3 computers that are in for their yearly cleaning and updating their owners want done. I run MalWare bytes, Spybot, SpyWare Blaster, Adaware, and a few more every time I do these cleanings. I always run in Safe Mode, and I always run registry programs and eyeball the registry. HiJack This has found nothing, so back to eyeballing the autoruns and programs running in the background.
I have used Avast for at least 5 years, 4 for free and last year " upgraded " to a paid version for $9.99 for 1 year. When it was free and I unsubscribed to junk mail I would see a vast ( he he ) reduction in my spam. In the last several months I have noticed that after unsubscribing to many of the same ones, they crop up again. This has been my observation in recent months. I use Mozilla and Yahoo. Could this be tied to this? I am anxious to see. I used to have good control of my spam, but in this past year it seems to have multiplied exponentially. I also think I may have liked the free version better as I also get suggestions on how to speed up and clean up my pc. Can I deactivate that easily in Avast? That would be my geeky 1st. I hope this end to supplanting crap in my purchase, as yes, I am sadly disappointed in this news and will consider other options.
I don't think Avast has anything to do with the spam.
There is an official reply from Avast on their forum which apparently the author or this article wasn't interested in having published as a rebuttal to his statements. Any one interested in Avast's position on this claim is free to read it at:Avast Rebuttal to the spying claim.
This kind of behavior is against Google's single use policy. A single extension is only supposed to do one thing. It is okay for an extension to inject adds, but that is all it should do.
Thanks for pointing out their reply. They didn't point out that I asked them to publicly reply to our article if they would like to do so.
I've edited the post to reflect the fact that the data sent back to /urlinfo is part of the security extension and not the ads. Although they are still sending back info for advertisements, so it's just really debating semantics.
We stand by the rest of our article, which was fully researched and vetted before publishing. The ad-injecting plugin was active in the primary extension as of a week ago.
FYI, I have updated our article with a link to their response.
After reading their response carefully, I don't think they are even disagreeing with our article on the key point, which is that they were injecting advertisements into pages without allowing people to choose.
From their response:
My virtual machine was installed on October 13th, 2014, and the screenshots I took were clearly from the primary extension. The ad-injecting code was not removed until about a week ago, and there was no screen that explained the advertisements or added an option to deselect during the install.
In any case, we stand by the research in our article, and we'll let people decide what they want to decide.
They were NOT open in their disclosure. The installation process did not say anywhere that they would be inserting advertisements into their pages.
You are welcome to believe whatever you wish, but there are user complaints all over the web from people that didn't realize that Avast would be bundling adware into their security extension. This isn't an isolated incident.
Further, if you actually read How-To Geek you'll see that we have been writing about security, adware, and crapware for a while now, so I don't know what your "no qualms" statement is all about.
Anybody that is hiding or sneaking adware or spyware into people's computers should really consider stopping, because we'll be writing about them soon.
I look forward to reading those "other" articles.
Sure, you can start with these:
I could go on, but obviously we have a strong stance on these things.
Yup, I've read most of these. I'm not sure why you are taking so much heat on this.
There is no such thing as free.
There is no free lunch. The company needs to make money some way. If you use a free version of any software other than a trial version. you get what you pay for.
While a lot of free programs bundle things, not all do and many are good quality programs.Here is a short list of some quality free programs that don't bundle adware:
NirSoft Software - "NirSoft web site provides a unique collection of small and useful freeware utilities, all of them developed by Nir Sofer." Sysinternals Software - "Sysinternals utilities [...] help you manage, troubleshoot and diagnose your Windows systems and applications".Sysinternals was brought by a Microsoft a few years ago but even before that the software had no adware. MPC-HC - Media Player for Windows Paint.NET - Photo EditorI use Avast free on android and do not know the extent of tracking,but I'm sure there is some kind of following of my browsing activities. I would bbe interested if someone knew anything about how this works for android AV programs.
On another note about FREE anything, Bookshout is a fairly new company,and I heard on the radio about a free book I could get. I had to register first,and before I could read the book,I was informed I had to download their free app. Well,first off,the permissions for the reader app (like Google books app) wanted just about every single permission available! So I went back to the website to see if there was another way to reads the bbook online,and happened to look at my new profile while there,and guess what I found, I was by default,signed up for about TEN different ways to SPAM my email and follow me etc.etc.! So I unchecked all those boxes,saved changes,then deleted my new account! And when they starters sending me emails anyways,I reported them as SPAM,and they send one daily. I wrote them to tell them how despicable I thought they are,but recieved the usual self-defense excuses.A FREE BOOK would be a pdf download,or being able to read online,no strings attached. What a joke these lowlifes are.So you always need to do some background investigation on any company or group because most are not up front about their intentions. And will defend their heinous behavior.
So,like I said before,Avast did FIX their problem, most will not. Privacy,and permissions is becoming a bigger issue day by day, so we consumers need to be more vocal and proactive about not putting up with this crapware anymore. Get educated and fight back!