In 2012, YC invested in a company InstallMonetizer[0] which, from my understanding, helps align software products with bundling other installers for additional revenue.
Impossible to have so many investments and not have a few bad apples. Still surprised PG did not distance himself further from installmonetizer, otoh props for standing by his investment and doing damage control for them at the expense of the YC cachet.
And Airbnb was spamming Craigslist posters (https://growthhackers.com/companies/airbnb/ - but of course selling cereals is the anecdote preferred by storytellers), and I have freelancer friends who got totally screwed by YC companies ("We can't pay for your work right now but we'll hire you and give you tons of equity right after demo day!" ... only to never respond to their emails ever again. Yes, the few of my friends to whom this happened could have been less naive, but still shitty).
The vast majority (but not all) of startups do dubious things. That's to be expected in an environment that glorifies "breaking things" and worrying later if what they're doing is legal or not. Being YC affiliated does not change that in the slightest bit.
People disliked them because the founders acted like obnoxious fratbros, but the specific claims of wrongdoing were over blackhat SEO ( https://news.ycombinator.com/item?id=6956658 ) which ended up getting them penalised by Google.
There's a wide variety of these "Pay-Per-Install" (PPI) type services, all of which profit by installing some form of malware on your machine. Sketchier services pay more, but also install stealthily rather than asking. Any kind is a pretty disturbing way to profit from your users. They're the kind of things you see script kiddies deploy to a small botnet. Not something you expect from a legitimate company.
[0] http://www.crunchbase.com/organization/installmonetizer