What's Happened To Imgburn

[Poppa_Meth]

I tested this with Ninite yesterday. Installed the current version of IMGBURN with Ninite and Comodo flagged it for cleanup as it found Opencandy in it. The program did install fine, but there was still something Opencandy related even in the Ninite install method.

[lordsmurf]

is imgburn even being developed anymore?

Nope. And the "new" version didn't add anything but the ad/spy/scamware.

The last safe version was 2.5.7.0, not a 2.4.x version.

[fritzi93]

The last safe version was 2.5.7.0, not a 2.4.x version.

I wondered about that. I have version 2.5.6.0 and didn't remember the installer having anything bundled.

There's no problem here. Baldrick has a link to version 2.4.4.0, and even a prominent bundleware alert for v.2.5.8.0.
If anyone goes ahead and gets v.2.5.8.0 anyway, and then merrily clicks okay right through all the express install options...
I won't feel much sympathy.

[steptoe]

Just go through the installer and READ whats being installed. The option ARE there. Sometimes you might to to choose cancel to stop the installation of the adware or search bar but its easy if you READ the installers


This also applies to a LOT of software installer now, they sneakily try to install adware or search bars, some make it quite difficult to stop them installing, making you think you are cancelling the main installer but in fact you are cancelling the adware installer


You might also need to choose custom installation to get the extra options, if you choose default then it merrily installer the adware/search bars. Some are very aggressive and install stacks of the rubbish. Thats how I found out when an installer was taking ages to install and asking me constant questions so I forcibly stopped the installer through the task manager and went through it slowly trying various options working out what it was trying to install

I've also noticed some download sites now bundle their own adware downloader to download other crapoware as well as the main software. Its rife now and getting harder to work out what is and isn't adware

[Seeker47]

We have talked about extracting the components from the installer, in order to work around this. (By means of Universal Extractor, or other tools.) This does not always work, though often it does. I did this back when 2.5.8.0 was released, and tossed the Open Candy crap that way, ending up with a clean 2.5.8.0 IB. A bit disconcerting to learn belatedly -- if true -- that there may be no functional difference with 2.5.7.0 or earlier. Of course, there is that rather common thing about non-support (or help in the product's own forum), if you are not referring to the current version.

[mike20021969]

Just disconnect from the internet when installing adware software.
Or add Open Candy or other adware IPs to your Hosts file.
e.g.
127.0.0.1 tracking.opencandy.com
127.0.0.1 media.opencandy.com
127.0.0.1 cdn.opencandy.com
127.0.0.1 api.opencandy.com

Simples.

[Constant Gardener]

Go here for a hosts file that blocks most undesirables. Be aware that it may block some stuff that you want to see; it's easy to edit once you realize the problem.

[Mrx15]

All good advice above!

FYI:
I've edited the Wiki's for ImgBurn and OpenCandy to mention several such counter measures and included some new cross-references. So those who go searching & reading are a bit more likely to get a clean install of 2.5.8.0. Unfortunately most won't do so, and will end up with OpenCandy junk. Even so, if they'll run Malwarebytes of similar afterwards, chances are good for a cleanup...unless they got stuck with a toughie like Conduit. It's a can of worms.

[ticktock]

Maybe Ninite run the installer like normal, just refusing all the bundled installation and not blocking or deleting OpenCandy. Good enough if undesirable installation is the only problem you're concerned of, but I wonder about the data sent to OpenCandy.....
Either modifying hosts file or using universal extractor, then.

Simply going through all those offer and turning each one down is good enough to ensure no extra software installed, however there are many tricks used to sometimes fool even the most careful. Very troublesome.

[Baldrick]

The last safe version was 2.5.7.0, not a 2.4.x version.

I wondered about that. I have version 2.5.6.0 and didn't remember the installer having anything bundled.

There's no problem here. Baldrick has a link to version 2.4.4.0, and even a prominent bundleware alert for v.2.5.8.0.
If anyone goes ahead and gets v.2.5.8.0 anyway, and then merrily clicks okay right through all the express install options...
I won't feel much sympathy.

I have added 2.5.7.0 as last adfree version now under www.videohelp.com/software/imgburn ....even though it contain some uniblue desktop shortcuts(driverscanner, registrybooster, etc) but I don't think they are selected by default?

Try https://www.videohelp.com/download/SetupImgBurn_2.5.7.0.exe and see if any adware is selected in the installation process by default.

https://www.virustotal.com/en/file/3b61ce3d5d75fe4a90313741cdfa71c47ba6543fc568ab3293e...is/1452500780/

[ticktock]

Before ImgBurn use OpenCandy, don't it used Ask toolbar offer instead?

[Baldrick]

Before ImgBurn use OpenCandy, don't it used Ask toolbar offer instead?

I think so. But I don't seem to get any ask toolbar from 2.5.7.0 ? Or is it the uniblue shortcuts?

Can anyone try https://www.videohelp.com/download/SetupImgBurn_2.5.7.0.exe on a computer without imgburn previously installed ? And see if you get ASK toolbar on something else?

[ticktock]

http://imgburn.com/index.php?act=changelog_complete
in 2.5.2.0 changelog there's this:

"Changed: Re-wrote the installer so the Ask Toolbar gets installed along with the rest of the files (if it's selected of course!) and not the second you click the 'Next/Install' button on the toolbar offer page. (No freeze when clicking 'Next' and looks nicer)"

which imply at least the one before this has ask toolbar too.

Then there's this: http://forum.imgburn.com/index.php?/topic/14352-lose-the-ask-toolbar/
so maybe 2.5.0.0 is the last clean one. I remember seeing someone mentioned which one is the truly last version to not include Ask and OpenCandy, but I don't remember where....

However we can rule out 2.5.1.0 and above.

[Baldrick]

If it it's selected

So it's not selected by DEFAULT? But I can't find it when I install 2.5.7.0.

I'm only sure that 2.4.4.0 has NO toolbar or crap.

[mike20021969]

And see if you get ASK toolbar on something else?

Ask toolbar is offered with 2.5.7.0:


The following URLs are accessed too...

http://apnmedia.ask.com/media/toolbar/stub/1.0.0.0/ApnIC.dll?tb=IMB&version=1.0.0.0
http://crl.verisign.com/
http://websearch.ask.com/
http://img.apnanalytics.com/

... so maybe a good idea to add them to hosts file (not sure about the verisign one though. That could be safe):

127.0.0.1 apnmedia.ask.com
127.0.0.1 crl.verisign.com
127.0.0.1 websearch.ask.com
127.0.0.1 img.apnanalytics.com

[ticktock]

maybe your hosts file is good or something?

changelog for 2.5.8.0:
Changed: No longer bundling/offering the Ask.com toolbar in the setup program, OpenCandy now handles product offerings during installation.

from same URL as above.

and from 2.5.1.0:
Added: Optional installation of the Ask.com toolbar within the installer as part of a new partnership.
Added: Optional creation of desktop icons/shortcuts (web links) for free scans using Uniblue's DriverScanner, RegistryBooster and SpeedUpMyPC programs within the installer as part of an affiliate scheme.

I missed that before because of wrong search term, but I guess 2.5.0.0 is really the last safe one then.

Edit:
crl.verisign is for certificate revocation list. doesn't seem safe to add to block list, and verisign is connected to SSL and web certificate.

[Baldrick]

Okey. Going back to 2.4.4.0 as adfree on www.videohelp.com/software/imgburn then.

Okey, I guess 2.5.0.0 is okey then.
https://www.virustotal.com/en/file/85602bca03dd85afa422dbc21dbbbc6c9131ba6c7d279022e0d...is/1452508651/

[ticktock]

I checked one file with unexposed opencandy dll and virustotal could detect it, so if virustotal doesn't detect anything there it's official, then.

How about the "more information" part?

More information and other downloads:
The last free version without adware is Imgburn 2.4.4.0.

[Baldrick]

How about the "more information" part?

More information and other downloads:
The last free version without adware is Imgburn 2.4.4.0.

I changed it to 2.5.0.0.


mike20021969: Can you also test https://www.videohelp.com/download/SetupImgBurn_2.5.0.0.exe and see if you get any ask toolbar?

[mike20021969]

mike20021969: Can you also test https://www.videohelp.com/download/SetupImgBurn_2.5.0.0.exe and see if you get any ask toolbar?

No offers at all with that one. Just a standard installer:
Welcome...Next>Choose Components...Next>Choose Install Location...Next>(Program installs)...Finish.

[lordsmurf]

@Baldrick:

Here's what happens on 2.5.7.0

When the Imgburn installer launches, it puts all the install files in your temp directory. The Ask Stub is put there too, but it's just the installer. For now, it's benign. It does almost nothing. It's waiting. It's just like any other stub, be it Firefox or Adobe Flash. Remember that the stub isn't the full program.

C:\users\ls\appdata\local\temp\apnstub.exe

When you go to install 2.5.7.0, simply uncheck the Ask Toolbar install option.

When the temp folder is emptied at some point, the never-did-anything installer (including all the Imgburn files) are wiped out.

Ask Stub does try to connect 4 IPs:

[Attachment 35192 - Click to enlarge]

However, this is likely for the purpose of connecting to Ask, as part of the prep for install. Again, a stub is not the full software. The stub downloads the current version of the full software. But if no install is made, it does little more than tell Ask that an install attempt was made.

I use Windows 10 Firewall Control from Sphinx (freeware version), which essentially turns the Windows firewall into Little Snitch (a popular Mac tool). It has nothing to do with Windows 10, so don't be fooled by the (stupid) name. HOSTS file adds are not as needed when running this, as you can wholesale deny a program any network access. For example, I tell my Adobe software to STFU and sit in the corner. All the constant network access was ridiculous.

So 2.5.7.0 is safe. It's version 2.5.8.0 that had all the auto-install shit.

In those earlier years, changes to Imgburn were more meaningful. So version 2.4.x is far too old, and even version 2.5.0.0 may be a bit lacking. But 2.5.7.0 was essentially the final version, with 2.5.8.0 only adding crapware. So if you only give download links to older version, you may need to warn others that features may be missing.
See also: http://www.imgburn.com/?act=changelog

I would not bother installing anything older than 2.5.5.0.

[Baldrick]

2.5.0.0 is the only version I will host. And I have a link to latest version also(with a warning). I'm not going to add another link to an ask-toolbar version....

[SameSelf]

Thanks guys for all the useful information. A while back, I removed ImgBurn from my system build image because of the stupid adware. I can now add it back

[Blackened2687]

If I remember correctly, version 2.5.8.0 includes very important bug fix - a bug when BH14NS40/BH16NS40 drives couldn't write BD-R media at 14x and 16x speed because of incorrect speed recognition due to bug in firmwares of these drives (LightningUK! talked about the details of this bug on his forum).