You are here

"Maxfiles" Adware in several PortableApps

5 posts / 0 new
Last post
synerdigm
Offline
Last seen: 16 years 11 months ago
Joined: 2007-03-15 10:42
"Maxfiles" Adware in several PortableApps

Over the past several weeks, I've had alerts on opening various PortableApps on my desktop PC from Webroot Spy Sweeper (version 5.3.2.2361, fully updated definitions), with Sophos Anti-virus both activated and not activated. The PortableApps have included the current versions of Firefox, Thunderbird, Sunbird, GAIM, Sudoku, and I believe another one, which I can't recall offhand.

The adware alert appears as soon as the PortableApp is opened from the suite window. I was able to eliminate the alert with respect to Firefox, Thunderbird and Sunbird by re-installing the .paf.exe file, this hasn't worked in the case of Sudoku and GAIM, as the alert continues to appear. Interestingly, however, I've found that the alert is somehow related to the affected application's trigger in the suite window. In other words, if I bypass the suite window and open the application's executable directly (e.g., in the case of GAIM, the path to the executable to which I'm referring is: G:\Portable Apps\PortableApps\GaimPortable\App\Gaim\gaim.exe), the adware alert isn't activated.

Perhaps I'm experiencing a false positive with this adware alert. A search of the PortableApps site hasn't been productive, so I thought I'd report the situation in case there might be something to it.

Kaatje

John T. Haller
John T. Haller's picture
Online
Last seen: 3 min 5 sec ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Spy Sweeper

It's a false positive. You should inform Spy Sweeper of their mistake. They're probably detecting lots of NSIS-based installers as spyware with a bad definition set.

Sometimes, the impossible can become possible, if you're awesome!

synerdigm
Offline
Last seen: 16 years 11 months ago
Joined: 2007-03-15 10:42
Spy Sweeper False Positive

Thank you, Mr. Haller. I'll pass the information along to Webroot.

koenbv
Offline
Last seen: 11 years 7 months ago
Joined: 2007-03-13 18:06
Thank goodness and thanks

I've been having the exact same trouble with Spy Sweeper! I'm a newbie here and was afraid to post my problem. I had read the "fault positive" post and was just hoping that was the problem. In fact, I had just about decided to uninstall all portable apps from my stick and forget the whole thing.

To confirm the issue: I have problems with Firefox, Gaim, Sudoku, Sunbird, Thunderbird, but NO problems with ClamWin and OpenOffice.

I also tried reinstalling Firefox from scratch, but with no change in the behavior.

I'm so relieved to find out it IS a false positive and will await action by Spy Sweeper. Thanks.

John T. Haller
John T. Haller's picture
Online
Last seen: 3 min 5 sec ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
helper dlls

It's actually a false positive with the NSIS helper DLLs that are used in some apps but not others. Based on the combinations seen, I'd guess it was FindProcDLL which is used to determine if an app is already running. I use Ad-Aware and Spybot and neither of them have this issue.

A lot of open source and commercial installers (including, I think, the Winamp installer) use this DLL.

Sometimes, the impossible can become possible, if you're awesome!

Log in or register to post comments