Google study on the Unwanted Software industry

Martin Brinkmann
Aug 9, 2016

Google published (PDF document) the results of a one-year study on the Unwanted Software industry last week detailing how networks and their products operate.

Unwanted software refers to programs that users don't really need or want, but that get installed anyway on user systems.

Google classifies these programs into the following five groups: ad injectors, browser settings hijackers, system utilities, anti-virus, and major brands.

If you look closer at those five groups, you may compress them further into two. The first, comprised of ad injectors and browser settings hijackers, modifies programs a user uses, web browsers mostly, to earn revenue from injected display ads or modified search engine settings.

The second group, system utilities, anti-virus and major brands, is all about affiliate revenue. Companies pay affiliates for installs of their programs, and publishers that are part of the unwanted software industry take advantage of that by pushing these installs.

The Unwanted Software industry

opencandy adware

Companies mentioned explicitly in the study are AVG, LavaSoft, Comodo, Opera and Skype. While most are not involved directly, the study suggests that Opera Software interacts directly with  pay per install operators (while most interact with affiliates that interact with pay per install operators).

We observe a small number of major software brands including Opera, Skype, and browser toolbars distributed via PPI. Based on the affiliate codes embedded in the download URLs  for Opera, it appears that Opera directly interacts with PPI operators to purchase installs rather than relying on intermediate affiliates.

Offers by the four largest pay per install companies -- Amonetize, OpenCandy, InstallMonetizer and Outbrowse -- fly partly under the radar when it comes to being flagged by antivirus software. Between 68% (Amonetize) and 20% (OpenCandy) of offers were flagged by at least one antivirus engine on Virustotal on average over the course of the study.

pay per installs

Networks provide advertisers with a toolset that checks for installed antivirus and security solutions prior to presenting offers.

It consists of a blacklist of Registry keys and strings, and file paths that prevents offers from being displayed if blacklisted items are discovered on the computer. Apart from antivirus solutions, these blacklists may also contain information about virtualization software.

Google discovered information about the lucrativeness of the market. Successful installs bring the publisher between $1.50 and $0.02 per install. This depends solely on the region the installation is recorded in.

Generally speaking, North-America, Europe (West) and Australia are the most lucrative markets for pay per install campaigns.

Closing Words

Two of the five unwanted software groups affect Google's bottom line directly. The company loses revenue from ad injections and from search hijackers. The same can be set for other companies that develop web browsers but only to a degree. Mozilla is paid for driving search traffic to partner search engines.

It would be unfair to limit Google's motivation to deal with the distribution of unwanted software to that though. There is support requests that need to be taken into consideration, user perception of browsers or search engines.

Google study on the Unwanted Software industry
Article Name
Google study on the Unwanted Software industry
Google published the results of a one-year study on the Unwanted Software industry last week detailing how networks and their products operate.
Ghacks Technology News

Tutorials & Tips

Previous Post: «
Next Post: «


  1. Seban said on August 19, 2016 at 11:27 pm

    “Successful installs bring the publisher between $1.50 and $0.02 per install. This depends solely on the region the installation is recorded in.”
    Why is that? I get that Ads shown too statistically richer consumers probably results in more sold crap. But regarding the installation of some software or changing browser settings, why would they care where this happens?

    1. Martin Brinkmann said on August 20, 2016 at 6:40 am

      The return is better in the US than in any other country. Display ads for instance pay more for US traffic than, say, Chinese or Indian traffic.

  2. Kubrick. said on August 10, 2016 at 12:57 pm

    This clearly shows why downloading software from the original site is always the best idea.I agree that some av companies do need to be more clear as to what software is being bundled.
    I do not believe that chrome is the most popular browser purely by it being bundled as we can always uninstall if it is not desired.

  3. SCROOGLE4LIFE said on August 9, 2016 at 8:14 pm

    What’s unwanted? Google, now alphabet. I hate ads that clutter pages. I can’t stand the “‘search engine”‘ and it’s SUGGESTIONS.

  4. Jeff said on August 9, 2016 at 4:41 pm

    What about the year-long crusade from Microsoft to bundle Windows 10 as an “update” for Windows 7/8.1?

  5. Earl said on August 9, 2016 at 4:04 pm

    It’s funny. Some people seem to think that those who create and distribute software of all types are bundling other software–such as Google Chrome–against their wishes, when–in fact–they’re doing it by choice. Weird. (What? Google’s supposed to be averse to its products being bundled and installed? As a rule, though, only the installer is bundled–Chrome still gets downloaded and installed directly from Google.) If Chrome getting installed is the worst problem you have, then you’ve got it easy.

  6. Tony said on August 9, 2016 at 12:30 pm

    Ironically, many people consider Google Chrome to be #1 in the list of Unwanted Software.

    Time for Google to look in the mirror instead of pointing fingers.

    1. pHROZEN gHOST said on August 9, 2016 at 3:07 pm

      I may be wrong. But I believe that Google did the study to see how others were impacting Google’s playing field.

    2. Tom Hawack said on August 9, 2016 at 12:38 pm

      Bad guys beat each others when only the good guys team-up :)

  7. Anonymous said on August 9, 2016 at 10:40 am

    I am waiting for someone to acknowledge, and create a computer system user friendly to older folks.. my computer is is pretty much useless to me now, the number of ads and steps, start overs, too many passwords for companies such as arts and cra. I am fed up with how difficult using a computer has become. I read the article above. Who is your target audience there. My time was wasted on that! Write some easy programs suited for people 60 and over Who use to know the simplicity and efficiency of computers before we retired, or your going to lose alot of baby boomers. We can pay now, but if it is too aggravating, I, for one, will discard. Sincerely, and with respect..
    Karen carpenter

    1. Tom Hawack said on August 9, 2016 at 10:59 am

      And yet I imagine you have a computing experience, background, even if you describe it implicitly as insufficient when it comes to the increasing complexity of computing, of OSs, of browsers … let’s just try to consider the situation of users who discover these universes with Windows 10 : they never touched a computer; go to the store and buy one, equipped with latest MS OS. That’s when the story states the holy man who walks away, crying …

  8. Tom Hawack said on August 9, 2016 at 10:32 am

    For who ever wondered if there was or could be a secret alliance between all those who take advantage of the masses the answer is definitely no. The struggle for monopoly, if it does impact us all by slowing down the natural implications of competition and diversity, at the same time splits the hypothetical concept of a binary struggle between “them” and “us”.

    A company may very well be coherent with itself when combining its inquisitive policy with the struggle against others which play on the same ground but in such a less wise way that they offer the means of an attack on the basis of those obvious behaviors, especially when those behaviors and effects are far worse than those of the judge.

    Thanks, Google :)

  9. Yuliya said on August 9, 2016 at 8:39 am

    They forgot to count themselves?

  10. F-ckGoogle said on August 9, 2016 at 8:38 am

    So Google didn’t mention itself explicitly? Google Chrome is the most spammed piece of software in history.
    Jesus Christ.

    1. Martin Brinkmann said on August 9, 2016 at 9:17 am

      They mention that they did not include direct distribution licenses.

      We differentiate this from direct distribution licenses such as Java’s agreement to bundle the Ask Toolbar [18], as there is no ambiguity between the advertiser and publisher around what packages are co-bundled and the source of installs. (page 2 under publishers).

      I don’t think that differentiation is valid if you look at it from a user perspective, as the end result is the same for the user.

  11. Sais said on August 9, 2016 at 8:30 am

    One of the most common unwanted software is Google Toolbar.

    1. MrHandsome said on August 9, 2016 at 12:36 pm

      Google toolbar has its uses, I’ve intentionally installed it on various systems due IE integration for Gmail etc.

    2. Size said on August 9, 2016 at 9:13 am

      No, it’s Google Chrome. Bundled everywhere anywhere.

  12. neal said on August 9, 2016 at 8:02 am

    Kinda hypocritical given Google history of sometimes silently installing Chrome bundled with a lot of free software like AVs.

    1. Dave said on August 9, 2016 at 4:05 pm

      That’s the first thing I thought too. Avoiding Chrome took some effort for years.

    2. MrHandsome said on August 9, 2016 at 12:35 pm

      So true. Google Chrome gets installed with a bunch of software around. McAfee went for a very long time with Adobe Flash, and many others.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.