Antivirus & Indigo Rose logo

[ricday]

I have found an interesting problem (in the sense of the old curse, "may you lead an intersting life..."). For the past two weeks my Norton Antivirus (2004, updated daily) has been detecting a handful of setup.exe files created with Setup Factory as being infected with the "adware" called "Adware.ShowBehind".

I've run Ad-Aware 6, Spywareblaster, Spybot and a few others and none of them detected anything.

After doing a registry check that the real "Adware.ShowBehind" had not somehow got past my paranoid security precautions, I took a closer look at the problem files. All five were created with SUF 6.0.1.2 or 6.0.1.3 and all five had the General Design/Settings tab "Show Setup Factory logo on initial splash screen" option set ON.

There is absolutely no code in what I'm installing that could trigger the NAV response - I have tested every file/piece of code thoroughly.

I rebuilt one of the five (using 6.0.1.4) with the option set OFF and Norton ignored the file. So I strongly suspect the problem is with the code that runs that splash screen with the SUF logo - I think it must in some way be similar to the code used by the old "Adware.ShowBehind".

My worry is, I have built close to 300 commercial installers using SUF in the past year and there is an incredible number of them out there in consumerland. Fortunately, many are on CDs which use Autoplay to run the installer and the consumer won't get the setup app on their hard drive. But over 50 are downloadable setup apps on two commercial websites (one in Canada and one the US) and the download number will soon rise into the hundreds. Rebuilding all the download files and replacing them on the websites will be this weekend's nightmare.

Can anyone duplicate this?

[csd214]

So I strongly suspect the problem is with the code that runs that splash screen with the SUF logo

I don’t think so. Probably it’s the w32wiz.da1 from v.6.0.1.2 (and 6.0.1.3?) v6.0.1.2 was the current version from September 23, 2002 to November 14, 2003.
Have a look at this thread http://www.indigorose.com/forums/showthread.php?t=8007


Adam is waiting for a reply from Symantec. Personally I submitted a “threat file” to Symantec on July the 17th (so far no reply). If all of us submit a file to Symantec, they should respond to the issue? (Symantec has great products, but I prefer smaller companies with nice customer care.)

Your concerns are my concerns...