Trojan virus

PDFCreator PDFCreator English
1

The lastest updated version (.2) attempts to install a Trojan virus.

2

Hi,


this is only possible if you downloaded it from somewhere else than our servers, you can check the MD5 ( http://download.pdfforge.org/download/pdfcreator ) to see if your setup was modified.

Please see
http://www.pdfforge.org/content/my-anti-virus-program-says-pdfcreator-contains-virus-dont-you-check-your-files 
for more details.

regards,

Robin
3

Hi Robin,

I just installed PDF 2.0.0 and AVG reported intercepting MalSign.Generic.5E6. I then come across your above comment that you think Georgetown must have got the installation file from somewhere. Because AVG intercepted a trojan from your installation, I went to check the MD5 and it is identical to the published one. So I am using an unmodified installation package according to your definition.

So what is your excuse now? I will not have to broadcast a warning to advise others to stay away from this Trojan ladden product.

Mickey


4

Hi Robin,

Correction:

So what is your excuse now? I will now have to broadcast a warning
to advise others to stay away from this Trojan ladden product.

AVG reports the presence of MalSign.Generic.5E6 in InstallManager.exe in the a temporary directory in %Temp% of random directory name.

It is repeatable in several clean VMs. The same file and the same Trojan/Malware.

Mickey

5

Hi,


it is only reproducable with AVG though and if the file was downloaded from our site and you even checked the hash, I can say for sure it is 100% clean of viruses/trojans as we scan everything before uploading it to our servers. Generic means some structure was found which could potentially be used in a virus or trojan. This is usually caused by the fact an offer screen is loaded during the setup depending on the users location (by the installmanager.exe). All offers are optional and can be deselected, none of them are viruses or trojans. If this concers you, you can quarantine the installmanager.exe during the setup, it will not break PDFCreators functionality. You can also upload the setup to virustotal.com where you can see over 90% of anti-virus companies correctly identify the file as safe (but it is very strange AVG says the file is dangerous on your PC but not at virustotal.com, have you updated the latest virus definitions?) 
Sorry about the trouble and I can understand your concerns, but it is not a trojan for sure.
It is also possible to purchase an 100% ad free version of PDFCreator which will not give any warnings, but we are constantly trying to resolve false alerts for the free version aswell.

best regards,