Adware detected in installer

Bug report and feature request
pelle
Beginner
Beginner
Posts: 2
Joined: Tue May 19, 2009 5:37 am

Adware detected in installer

Post by pelle » Tue May 19, 2009 5:45 am

Doing a manual scan of the installer (v0.7.0.4399 - Full Edition) gives this with Eset NOD AV 4.0.424. Installer was downloaded from Sourceforge.

Number of scanned objects: 507
Number of infected objects: 1
Number of cleaned objects: 0

D:\Downloads\MediaCoder-0.7.0.4399.exe » NSIS » rkinstall.exe - Win32/Adware.Agent.NMA application

The v0.7.0.4395 installer gives no such warning.

Extracting the v0.7.0.4399 installer with UniExtract. VirusTotal gives this result (20/40 (50.00%))for the rkinstall.exe located here (\MediaCoder-0.7.0.4399\$TEMP\$TEMP\rkinstall.exe)

Report form VirusTotal:
http://www.virustotal.com/analisis/cde3 ... 583338a5e7

Most likely a false postive but can you verify the validity of the file rkinstall.exe contained in the installer?

LoudThunder
Beginner
Beginner
Posts: 6
Joined: Sat Oct 25, 2008 5:48 am

Re: Adware detected in installer

Post by LoudThunder » Tue May 19, 2009 8:48 pm

I had the same answer for the same file.
Hope someone can tell us if rkinstall.exe is safe.

RkInstall.exe is truly a adware, but I don't understand why Mediacoder has it.
Someone can tell me what is going on?
Open Source is the most powerful way to spread knowledge.

stanley
Site Admin
Site Admin
Posts: 4130
Joined: Mon May 15, 2006 7:43 pm
Location: Sydney

Re: Adware detected in installer

Post by stanley » Sat May 23, 2009 3:58 am

It will not be installed by default.
When things work together, things work.

jbkeh
Beginner
Beginner
Posts: 2
Joined: Sat May 23, 2009 9:38 pm

Re: Adware detected in installer

Post by jbkeh » Sat May 23, 2009 9:52 pm

It won't be installed BECAUSE IT WON'T BE (SUCCESSFULLY) DOWNLOADED!

Most people sane enough to use a virus checker have it set to scan anything being downloaded and to reject anything containing undesirable material.

Suggest you QUICKLY RETHINK this action - once the software package (and you) garner a reputation for inappropriate conduct, it will be irreparable.

You are killing the goose - I doubt you will find a collection of golden eggs.

stanley
Site Admin
Site Admin
Posts: 4130
Joined: Mon May 15, 2006 7:43 pm
Location: Sydney

Re: Adware detected in installer

Post by stanley » Sun May 24, 2009 3:13 am

The 4399 installer is repackaged and uploaded.

Here is the scanning report of VirtusTotal:
http://www.virustotal.com/analisis/5d82 ... 1243101200

TrendMicro's detection of PAK_Generic.001 is obviusly a mis-reporting.
When things work together, things work.

User avatar
Placio74
Advanced
Advanced
Posts: 455
Joined: Sun Sep 17, 2006 11:02 pm
Location: Poland
Contact:

Re: Adware detected in installer

Post by Placio74 » Sun May 24, 2009 6:29 am

Hmm...

New installer from SourceForge does not contain RelevantKnowledge Survey.

But new installer from Google Code contain RelevantKnowledge Survey and unfortunately... is running before choose components. :!: (Which means the lock installation by many antivirus and antimalware apps, also can't install MC without RK.)
VideoAudio.pl - Serwis o technologii wideo & audio

stanley
Site Admin
Site Admin
Posts: 4130
Joined: Mon May 15, 2006 7:43 pm
Location: Sydney

Re: Adware detected in installer

Post by stanley » Sun May 24, 2009 2:47 pm

If the survey component is not selected, it won't be installed anyway.
There is also 7z package version for download on google server.
When things work together, things work.

User avatar
Placio74
Advanced
Advanced
Posts: 455
Joined: Sun Sep 17, 2006 11:02 pm
Location: Poland
Contact:

Re: Adware detected in installer

Post by Placio74 » Sun May 24, 2009 8:36 pm

stanley wrote:If the survey component is not selected, it won't be installed anyway. ...
With 'old' installer - yes.
However with installer uploaded 16 hours ago - not.

After running MC installer (from Google Code), antivirus may warning and block rkverify.exe > instead MC license is show RK license > if not accept RK license, can't install MC > can go forward (to choose components) after accept RK license > RK is selected by default.

With old installer is show MC license and RK is not selected by default (only problem was blocking by antyiwrus when download - detected RK in installer).

Installer from SourceForge have different size and hash - also no problems with current installer from SF.
stanley wrote:There is also 7z package version for download on google server.
Thanks.
VideoAudio.pl - Serwis o technologii wideo & audio

jbkeh
Beginner
Beginner
Posts: 2
Joined: Sat May 23, 2009 9:38 pm

Re: Adware detected in installer

Post by jbkeh » Mon May 25, 2009 10:02 pm

"The 4399 installer is repackaged and uploaded."

But not for the Audio Edition? (And who knows what else.)

Fool me once.....

encroder
Modest
Modest
Posts: 289
Joined: Tue Apr 21, 2009 3:23 pm

OpenCandy

Post by encroder » Wed May 27, 2009 1:53 am

OpenCandy

Its in the mediacoder program directory, in documents and settings\user\local settings\temp

I don't use mediacoder on any internet enabled pc, but that may change. And would mean no mediacoder on that pc, i do have a plan to network further pcs. Thinking of adding more nics and a router, so soon they all will be iternet capable, will i stop using mediacoder then.

All i read on the net that opencandy is adware/malware/spyware

As one site puts it nicely, 'When younger you were always told never to take sweets (candy) from strangers'.

What is this doing in mediacoder, for what purpose, data mining ?

Why did you snnek it in, could you not give the user the chance not to use it on install. And those that have it on update choice to remove it. I would think a high percentage would choose to remove it not have it installed.

Probably mediacode is getting big monetry rewards for using this. Every time opencandy is used for connection and X activity is logged through it X ammount of money is then aded to media coder account with open candy.

Or do you think i have this all wrong ?

If so please explain, without directions to any opencandy sites.

Post Reply