Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Author Topic: Norton Internet says HGStats is a virus  (Read 2394 times)

bbnovice

  • Reg Member
  • ***
  • Posts: 220
Norton Internet says HGStats is a virus
« on: January 12, 2014, 07:17:39 PM »

Just a heads up but Norton Internet Security is starting to report HGStats as a potential virus via File Insight on my PC. I have run both NIS and HGStats alongside each other for some while.

This seems to have started ever since NIS quarantined a file called eed_ec.dll on my PC because it was behaving suspiciously. Does HGStats call that dll by any chance?   

Regards BBN
 
Logged

ryant704

  • Reg Member
  • ***
  • Posts: 318
Re: Norton Internet says HGStats is a virus
« Reply #1 on: January 12, 2014, 09:06:30 PM »

Where are you downloading the program from?

.CNET when the whole NSA revelations and this and that were happening they were reported to be adding malware/adware to the downloads available.
Logged

bbnovice

  • Reg Member
  • ***
  • Posts: 220
Re: Norton Internet says HGStats is a virus
« Reply #2 on: January 13, 2014, 03:22:12 PM »

HGStats was downloaded from a link on this forum quite a while ago. I can't remember which download site the link took me.

A NIS virus scan on all executables in the HGStats suite. But NIS File Insight flags up graphpd.exe and HG612_current_stats.exe as "suspicious" due to their behaviour. 

Personally I think that the above executables in HGStats are just showing as false positives, but I thought I would ask if anybody else had encountered this particular issue.

Regards BBN

 

Logged

snadge

  • Kitizen
  • ****
  • Posts: 1205
Re: Norton Internet says HGStats is a virus
« Reply #3 on: January 13, 2014, 03:24:47 PM »

CNET always add PUPs (Potentially Unwanted Programs) to most of their downloads...some of them even come with 4 or 5 PUPs on 1 download and are really tricky when trying to get you to install them, they will have tick boxes already checked, use ACCEPT or DECLINE buttons which makes most people think 'declining' will stop your download from installing...when it doesnt, it just declines that PUP

I avoid CNET all the time...they are rogue!

but yeah it will be false positives due to unusual runtime compression or summit, I have 2 or 3 programs that get flagged by various AV's - JD Speedtester gets flagged... so does MKV Audio Converter
Logged
Zyxel VMG8924-B10A <-> PlusNET <-> Eci DSLAM
Sync: 79,000k <-> Atten: 14.2db <-> Snr: 6dB <-> Mode: FastPath

Ronski

  • Moderator
  • Kitizen
  • *
  • Posts: 3295
Re: Norton Internet says HGStats is a virus
« Reply #4 on: January 13, 2014, 03:55:46 PM »

You would of most likely downloaded it from Freeware Files which is were the main program package is distributed from.

The program doesn't use an installer, if it does then it's not the proper package, it should be just a Winzip file, which you extract. My GUI does have an auto update facility, but that downloads just the GUI program and just replaces the old program, no Windows installation.

It is most likely a false positive, I've had Avast complain numerous times whilst I've been developing the GUI that it has a potential virus (I'm sure I've mentioned this in the respective thread), and during researching this I have found that loads of programmers are finding the same problems. Antivirus programs look at what the code does and some can be a bit over sensitive so to speak.

There are two things I do in this case, the first is to use Virus Total (part of Google) to scan the file, this use 47 different virus scanners to check the file, this will give you a good idea if it's a false positive. The next step is to report the suspected false positive to your antivirus provider, hopefully they will do whatever they do and if it's a false positive they will stop this happening. If you are happy it is a false positive you can add it to an exemption list, presuming your AV has this facility.

Edit: I just scanned GraphPD with VirusTotal, looks like somebody scanned it over Christmas, anyway 2 out of 48 antivirus scanners think it shows suspicious behavior. If it was dangerous I'm sure a lot more would say so.

Edit. No idea what eed_ec.dll is.
« Last Edit: January 13, 2014, 04:03:53 PM by Ronski »
Logged
Formerly restrained by ECI and ali,  now surfing along at 390/36  ;D

bbnovice

  • Reg Member
  • ***
  • Posts: 220
Re: Norton Internet says HGStats is a virus
« Reply #5 on: January 13, 2014, 07:49:12 PM »

Thank you everybody for your replies.

After some scratching around I have managed to determine that:

(1) eed_ec.dll is a legitimate file provided by Samsung for their M series of printers. This printer was purchased and installed last November, so why NIS suddenly took a dislike to the file last week is a mystery.

(2) The HG6612 warnings are (as expected) false positives.

The 2 issues are separate and it just appears to be coincidence that NIS started to warn about both at exactly the same time.

Regards BBN     
Logged