OpenCandy is an adware module classified as malware by many anti-virus vendors. They flag OpenCandy due to its undesirable side-effects. It is designed to run during installation of other desired software. Produced by SweetLabs, it consists of a Microsoft Windows library incorporated in a Windows Installer. When a user installs an application that has bundled the OpenCandy library, an option appears to install software it recommends based on a scan of the user's system and geolocation. Both the option and offers it generates are selected by default and will be installed unless the user unchecks them before continuing with the installation.
OpenCandy's various undesirable side-effects include changing the user's homepage, desktop background or search provider, and inserting unwanted toolbars, plug-ins and extension add-ons in the browser. It also collects and transmits various information about the user and their Web usage without notification or consent.
The software was originally developed for the DivX installation, by CEO Darrius Thompson. When installing DivX, the user was prompted to optionally install the Yahoo! Toolbar. DivX received $15.7 million during the first nine months of 2008 from Yahoo and other software developers, after 250 million downloads.
Components of the program may have differing but similar names based on version.
Note that files dropped by this program usually have the 'hidden' and 'system' attributes set. In order to see or search for them, folder settings for "hide operating system files" will need to be unchecked, and "show hidden files and folders" will need to be checked.
Note: additional processes associated with any accepted offers may also run.
Registry keys have varying names, so that a search of the registry for "*opencandy*" will need to be done to find and delete them.
DNS and HTTP queries
Software known to have included OpenCandy
- Auslogics Disk Defrag
- CamStudio (since version 2.7 r316)
- CDBurnerXP (depending on version; alternate download without OpenCandy available; confirmed 2017-03-01)
- FileZilla (present in 2013)
- Format Factory
- Foxit Reader (6.1.4 – 6.2.1)
- GOM Player
- ImgBurn (since version 18.104.22.168, though only on the version of the installer distributed directly from imgburn.com; the version distributed from the official mirror sites is adware-free)
- MP3 Rocket
- MyPhoneExplorer (dropped March 2015)
- Orbit Downloader (confirmed 2015-10-24) 
- Sigil (dropped in version 0.5.0 and later)
- Trillian (dropped 5 May 2011)
- WinSCP (through August 2012)
There is a workaround to bypass OpenCandy by running the installer with a parameter on the command prompt:
- PUP.Optional.OpenCandy, Malwarebytes, retrieved 3 February 2018
- OpenCandy, Sophos, retrieved 3 February 2018
- ADW_OPENCANDY, Trend Micro, retrieved 3 February 2018
- Virustotal analyses of OpenCandy, Virus Total, retrieved 3 February 2018
- Richards, Gizmo (16 April 2017), Controversial Advertising Program Now Being Embedded in More Software, Tech Support Alert, retrieved 2 February 2018
- ADW_OPENCANDY: Trend Micro page, 30 April 2016
- Needleman, Rafe (11 November 2008), OpenCandy brings ad market to software installs. What?, CNET news, retrieved 18 August 2009
- Marshall, Matt (10 November 2008), OpenCandy inserts recommendations when you install software, retrieved 18 August 2009
- "Antivirus notes".
- "Inquiry about detection of Auslogics Defrag Free Edition - ESET NOD32 Antivirus".
- "Complete Version history / Release notes / Changelog".
- "FileZilla OpenCandy". Retrieved 24 July 2013.
- "Format Factory - Free media file format converter".
- "Does Foxit Reader free 6.1.4.0217 have malware?". Foxit Corporation Forums.
- Zenju. "FreeFileSync".
- "FrostWire: Downloader, BitTorrent Client and Media Player".
- "GOMlab.com include technical information and download link of GOM Player, GOM Audio, GOM Video Converter and GOM Remote".
- LIGHTNING UK! (16 June 2013). "The Official ImgBurn Website: Change log". www.imgburn.com. Retrieved 3 October 2017.
Changed: No longer bundling/offering the Ask.com toolbar in the setup program, OpenCandy now handles product offerings during installation.
- LIGHTNING UK! (16 June 2013). "The Official ImgBurn Website: Download". www.imgburn.com. Retrieved 3 October 2017.
- "MD5 doesn't match any downloadable installers - ImgBurn General". forum.imgburn.com. 29 October 2016. Retrieved 3 October 2017.
- "Wrong hash? - ImgBurn Support". forum.imgburn.com. 23 June 2016. Retrieved 3 October 2017.
- "Wrong Hash 2 - ImgBurn Support". forum.imgburn.com. 31 January 2017. Retrieved 3 October 2017.
- "ImgBurn". fileforum.betanews.com. 17 June 2013. Retrieved 3 October 2017.
CLEAN INSTALL! No OpenCandy bundled.
- "ImgBurn Download: Changelog". Softpedia. 31 March 2017. Retrieved 3 October 2017.
no more 'opencandy' adware!
- "Codecs.com | Downloads for ImgBurn 2.5.8". www.free-codecs.com. 20 June 2016. Retrieved 3 October 2017.
Download ImgBurn 2.5.8 - without OpenCandy!
- "ImgBurn". www.majorgeeks.com. 23 June 2016. Retrieved 3 October 2017.
This is a clean, no OpenCandy version.
- gizmo, richards (8 February 2014). "Controversial Advertising Program Now Being Embedded in More Software". Gizmo's Freeware. Archived from the original on 7 August 2014. Retrieved 30 August 2014.
OpenCandy (OC) is a relatively new advertising product that more and more software developers are bundling with their programs. It can now be found in the installers of dozens of popular programs including IZArc, mirC, PrimoPDF, Trillian Astra and more.
- "MP3 Support Analysis - herdProtect".
- SEMU-Design. "FJ Software Development".
-  On the Help/Facts page
- Discussions on pdfforge Forums Archived 4 March 2016 at the Wayback Machine
-  PhotoScape - Virus and Malware
- Schember, John (21 January 2012). "Sigil 0.5.0 Released". Retrieved 17 March 2012.
- "Malware on Install".
- "WinSCP - OpenCandy". Archived from the original on 7 April 2014. Retrieved 3 April 2014.