content: Download the source code and build your own binaries without the crappy malware bundle. Search on Wikipedia for the name of the program, and follow the link from there to the project's official web site. Get your download link from the official web site. If that link points to Sourceforge then see 1 or 3. Join the project's IRC channel and ask the devs where trustworthy builds are hosted. Make sure to mention why you don't trust SourceForge. I have never tried it, but I've read about Ninite I have never tried it, but I've read about Chocolatey  You can always scan for malware on VirusTotal, Metascan, and Jotti. When you do you will be given one or more hash codes you can use to compare with other users. HTH