I just got an ELM327 Dongle from "deep in China". It came with a little 3 inch CD-ROM which innocently sat in my tray when antivirus started its scheduled scan.
I just bought one of those last month. I put the disc in but never ran anything from it. A little too shady. There's really no need for them to send a disc, it's basically a plug and play type deal.