Question: Virus in installer version aimp_5.02.2368/69.exe ?

[Rfx9123]

 
When I try to start the installation version, my antivirus program reports with "Junkware (PUP): Win32.Application.Agent.H5I401" and prevents the installation. A download from Google Drive, probably because of this problem, is also not possible and is thus blocked. Please provide a cleaned version. The no-installer version is clean.

[Artem]

App is clean. I check all releases via virustotal before publishing. What is your antivirus? I think that this is false positive

[bogs]

Аналогичная ситуация. NOD32: модифицированный win32/aimp.D

[Алексей Долматов]

Аналогичная ситуация. NOD32: модифицированный win32/aimp.D

С этой фирмой ситуация известная. Они внесли плеер в негласный "чёрный список", заблокировали возможность связаться с ними официальными способами. Как видите, даже создали отдельный тип угрозы AIMP.

[Алексей Долматов]

Официальный ответ


ESET блокирует наш установщик, поскольку в нем есть реклама Яндекса, которая показывается только для русскоговорящих пользователей. В старых версиях программы у страницы с рекламой чуть другая сигнатура, поэтому на них NOD32 не реагирует (пока).


ESET blocks the installer because of Yandex offer that displayed for Russian users. In old versions, page with offer has different signatures. So, ESET does not block it (yet).

[Алексей Долматов]

Win32.Application.Agent.H5I401

Судя по типу классификатора, это антивирус G-DATA.
Rfx9123 может прояснить верно ли я определил через поиск в Google.

[Rfx9123]

Correct, I have already contacted GDATA.

[Artem]

It seems that the antivirus has reacted to new version of 7z-SFX module (it used to unpack installer). Now, I have rolled back to previous version. Please, re-download the app.

[Rfx9123]

aimp_5.02.2369.exe
So the problem seems solved. Thanks very much.

Unfortunately no, the message is now "Junkware (PUP): Win32.Application.Agent.3HK4Q1 (Engine B)" and the installation is aborted  .

[Artem]

Oh, I have no idea what goes on... Please, write to your antivirus vendor, I think that this is false positive detection.

[Artem]

As I can see now, the G-Data detects "agent" in all versions of 7z SFX. It seems I need to refuse from SFX modules at all.

[Rfx9123]

Hello Artem. I have now received a reply from GDATA, they were indeed hoaxes and the virus signature has been corrected. Thanks for the good work.

[Artem]

Hello Artem. I have now received a reply from GDATA, they were indeed hoaxes and the virus signature has been corrected. Thanks for the good work.

Thank you!