OpenCandy is advertising application. It is similar to Google AdSense, except it displays advertisements in installation program instead of websites. These advertisements promote another software packages. The advertisements are selected by providers of software being installed (in case of WinSCP it means WinSCP developers). When user installing a software (WinSCP) chooses to install promoted package, revenue is generated and shared between OpenCandy and software providers (WinSCP developers).

Some may consider OpenCandy an adware. In principle it is. It is a way to recover software development costs using advertisement.

On the other hand, OpenCandy does not demonstrate the negative characteristics commonly associated with adware:

• Advertisement is only shown as a one step of software installation. Once software (WinSCP) is installed, you do not receive any more advertisements.
• No unwanted software is installed. User has to explicitly choose to install promoted software to actually receive it. I.e. the default action is “do not install”:
• No private information are collected. Installation program collects only information necessary to choose relevant advertisement, such as geo-location, operating system and language. For this purpose OpenCandy sends these information to opencandy.winscp.net. It also downloads advertisement image from media.opencandy.com (though it does not send any information there).

For details see OpenCandy privacy policy.

Yes you can. Use /NOCANDY parameter when starting installation program.

You can also use portable executable, thus avoiding installation program with OpenCandy.