False alarm on Hotspot Shield?

[cunni]

Hi everyone,

I'm not quite sure if this is the right place to ask, but I suspect Avast giving false alarm while installing Hotspot Shield (http://www.hotspotshield.com). I downloaded the file from that URL and scanned it with avast - no problem found. While trying to install it, Avast tells me that there ist a virus ("Win:32 Trojan-Gen (other)") in serveral TEMP-Files while installing AND uninstalling Hotspot Shield.

Is this a known issue? I don't really think that Hotspot Shield provides a trojan... I suspect Avast ist giving out a virus warning because Hotspot Shield is trying to install a VPN client... What can I do? Ignore it?

Thanks for your help,
Cunni

EDIT: Virustotal tells me that the Install-File has been checked previously an is "0/33 (0.00%)" - well, Avast doesn't find a virus in the Install-File anyway... it appears after installing!

[Lisandro]

You've posted in the right place.
Thanks for alerting this, probably, false positive.
Hope they take a look on it, as usual, very quickly.

[misak]

thank you for detail description... Avast falsely detect files ns*.tmp in %temp% directory. This false positive alert will be fixed in next VPS update

[cunni]

Thanks guys for your fast reply!  Exactly, the ns*.temp-files were reported.

OK, I'll now install it anyway and ignore the virus alert.

Cheers,
Cunni

[coaster3000]

I think it is one. Its doing something to my browser. (i did not download anything i was using a proxy ip and port. and it redirected me to that page. I turned off the proxy it still is doing it. Its dled something to my system. Avast did not detect it!

Turns out some other site said the unstallers are viruses!

[polonus]

Hi folks,

This is not a FP but a real threat. Analysis:
General information
Location of website    USA

Reported threat
Found one  Drive-bydownloads found 1:

Name of threat:  23476 
Location:  htxp://search.hotspotshield.com/g/results.php?c=e&err=404&q=http://megadataaccess.com/video-plugin.40013.exe 
But here it is given clean: http://scanner.novirusthanks.org/analysis/504243984df0e65c54ced0e0f1cefe72/aW5kZXg=/

polonus

 
 
 
 

[coaster3000]

Hi folks,

This is not a FP but a real threat. Analysis:
General information
Location of website    USA

Reported threat
Found one  Drive-bydownloads found 1:

Name of threat:  23476 
Location:  htxp://search.hotspotshield.com/g/results.php?c=e&err=404&q=http://megadataaccess.com/video-plugin.40013.exe 
But here it is given clean: http://scanner.novirusthanks.org/analysis/504243984df0e65c54ced0e0f1cefe72/aW5kZXg=/

polonus

 
 
 
 

does it download without knowing?

[polonus]

Hi coaster3000,

According to Norton Safe Web it does,

polonus

[fixento]

I made a mistake, when I download a small printer ap, I had the pleasure of 7 additional different programs appear.  Most had a setup icon and were easy to delete.   However, when I attempted to remove Hotshot with its uninstall.  It would reappeared on start up and screwed up my wireless connection.   After three hours of removing it from various registers, etc I believe I have finally eliminated this POS.   I suggest you investigate the reviews of this program before you install it.  Don't believe it's simple to remove because it not that makes me suspicious there may be underlying reasons.

[polonus]

Consider: http://incodesolutions.com/threats.php?file=System32Rootvideo-plugin40013exe

polonus