This ad in particular is hard coded by the author.

This isn't a case of someone using a shitty ad network, the author is knowingly pushing malware to the users of their application.

Hmm, not sure really where to go with this - I certainly don't want to support malware, but what's the "speedupmypc.exe" actually do that's malicious.

I ran it through online tools:

* https://www.virustotal.com/en/file/3d9e6b1e9f1296e0ce85061e0... (17/57)

* https://www.metadefender.com/#!/results/file/5fd5ceb2e10942d... (5/42)

* http://scanthis.net/scan/f74a94435ae047770b0fb26c4752d43b (result pending)

a lot of the big name antivirus companies don't report this as a malicious file (according to these tools).

e.g. looking at the first scan results Ad-Aware, Avast, BitDefender, Symantec, etc., etc., all find no problem with the file.

The obfuscation would be needed to load ads for the market that NoScript is targetting. To get ad revenue they would need some system to load the ads [as if] from the local server or they'll get blocked. Indeed isn't this what people often ask for from adverts that they won't use external providers in order to improve page-load times. If you look at the source for the page at noscript.net you see that the section is tagged as if it's included code from an automated script. So yes, he's clearly gone to trouble to hide the ad, but that's because it's an ad and not necessarily because it's malicious.

So, it hinges on whether the speedupmypc.exe is truly malicious IMO. Cnet & Tucows endorse it, not sure that tells us much ... installing the app (on a vbox) it looks like reasonably useful app after the type of PC-decrapifier or CC or whatever. I got a freemium app which gave a scan (results looked kosher) and offered a £20 unlock to fix the issues found.

Not the greatest software but not quite what I'd call malware. Perhaps oversold-stuff-people-dont-really-need-ware??

Unless, like I said, there's a hidden payload?

Fair enough. It is classified as "potentially unwanted software" by many, so calling it malware was probably wrong.

And that was the major issue I had with it (the fact that it was called malware by the blog post).

If that's not the case, then its not nearly as large of a problem than it looked.

Thanks for doing the research, you should repost this as a top level comment!

Before providing a "tldr" please read the article.

What makes you think he or she didn't?