F-Secure Deepguard does not like Sumatra PDF

baroque-quest
baroque-quest Posts: 74 Enthusiast
in Web Browsing

If I try to install Sumtra PDF, Deepguard complains that it is trying to change a process or something like that.  Is there really something wrong with Sumatra PDF?

Like Awesome

Comments

  • Ukko
    Ukko Posts: 3,727 Superuser

    Hello,

     /some words added/

    Probably it's can be situation, when installer trying to determinate all processes/kill process or refresh explorer.exe for launch services by current software. /but... also you should be able to see "more"-feature during DeepGuard prompt, where will be description for "which processes are changed" - it's can be just critical file/process/ - which can be addition for "other reasons".

    If current file.. not really popular or known - it's can be like "totally suspicious actions" and detected by DeepGuard (that explanation for... situations... when not each installer will be with same prompt).

     

    If you can to trust for current software and it's from trust-source. Probably here all OK :)

     

    Also... you able to create a ticket for F-Secure SAS website (like sample submission) for checking "something wrong or not". Where will be answer about part - "safe or not" :)

    Also installer and installed software - different things.

    But also here can be "wrong" with meanings "not good realizations for installer-code".

     

     

    Like Awesome
  • Simon
    Simon Posts: 2,667 Superuser
    Try scanning it with https://www.virustotal.com/. That will give you a good idea as to whether the file is safe or not. FS is probably just flagging it as it's an unknown process, but I believe there have been instances of malicious PDF files / applications, so it pays to be careful.
    Like Awesome
  • Ukko
    Ukko Posts: 3,727 Superuser

    Probably "Sumatra PDF" can be detected by virustotal with some companies (if be honestly - I never use that, but current software some kind of heard by somewhat reasons?!); And it's anyway... just installer can be with payload; So, virustotal can to give view about detection just for adware-category. It's not really close to "safe or not"; Payload can be different too.

     

    Anyway :) here will be detection by DeepGuard about action... and probably on virustotal it's not visible (like other behavior-detections by some other companies);

     

    Like PDF-viewer... time to time.... I can to use STDU Viewer (STD Utility) or some kind of "close to that name" - if it's need something "portable" or "fast to look" in some situations (where not able to do it with another steps).

    Like Awesome
  • baroque-quest
    baroque-quest Posts: 74 Enthusiast

    Scanning the downloaded file with MBAM, F-Secure, and virustotal did not raise any red flags.  It was only upon installation that Deepguard complained.

     

    I sent F-Secure support a specific query.

     

    One reason I was a little confused is that while I have run into things which Deepguard had never white-listed, e.g. Intel's Desktop Utilities, Sumatra PDF had not been flagged in the past by Deepguard.  So did F-Secure accidentally add Sumatra PDF to the malware category or has someone hacked into that webpage and/or software?

     

    Thanks to Ukko and Simon.

    Like Awesome
  • Simon
    Simon Posts: 2,667 Superuser

    I guess it's possible that the program has changed or updated, and FS haven't added it to their whitelist yet.  You did the right thing by contacting Support, but you might get a quicker response by Submitting it as a Sample to the labs.

    1Like Awesome
  • Ukko
    Ukko Posts: 3,727 Superuser
    @baroque-quest wrote:

     

    One reason I was a little confused is that while I have run into things which Deepguard had never white-listed, e.g. Intel's Desktop Utilities, Sumatra PDF had not been flagged in the past by Deepguard.  So did F-Secure accidentally add Sumatra PDF to the malware category or has someone hacked into that webpage and/or software?

     

     

    DeepGuard time to time also with changes. It's can be new logic, new databases or other.

    It's can be... that previously not detected, but now with detection. Also it's can be different in various operation-systems and etc.

     

    But about Sumatra PDF - does you mean just installer?! It's of course can be with various situations.

    If certainly about Sumatra PDF executbable files... probably you can to check "digital certs" (signed or not). And it's like "checking" for "hacked" or not.

     

    And of course... how it already was replied...   any changes in software.. will be like new "reason" for DeepGuard be more targeted for that application.

     

    @baroque-quest wrote:

    Scanning the downloaded file with MBAM, F-Secure, and virustotal did not raise any red flags.  It was only upon installation that Deepguard complained.

     


     

    Probably... I still think about that situation... like from first reply:

     

     - We talk about Installer (potential can be malicious and it's not related with installed-software already);

     

     - Installer can to use during installation "determination for all processes or kill processes";

    Usually... it's need for "refresh" Explorer.exe or for simply.. refresh...  during adding new services for system (services by new software);

    Or other reasons.. if installer created not really nice.

     

     - DeepGuard can to detect that. And it's will be like your description for situation.

    --------------------------------------------------------------------------------------------------------------

     

    But here need to look for "DeepGuard" prompt and addition ifnromation about "which processes" and etc.

    Maybe it's indeed something malicious happened.

    And it's action, which virustotal can not to show. Also like MBAM can not to detect - if F-Secure not detected it's by signature-based technologies.

     

    Potentially here need to transfer certainly "installer"-file. for my opinion.

    If I correctly understand situation.

    1Like Awesome
  • Ukko
    Ukko Posts: 3,727 Superuser

    Also.. can be important.. source of downloaded files.

    Potentially installer can be with payloads... and already will be "adware"-detection;

     

    First of randomly results by virustotal:

    https://www.virustotal.com/da/file/923a1c2671321add62822080b6ef8499190f988163a024159818df9d5bbaf0f5/analysis/

     

    Here file detected as "adware" or potential unwanted application (F-Secure also detected it);

    It's mean... current file from source, where installer or already software.. with payload.

     

    It's mean - potentially your sample can be "new version" of something strange. But current one "example" - without valid signed certs.... and it's mean probably here just "trick".

    Your file should be with signed certs (I think).

     

    And probably here was just prompt by DeepGuard about "installer's actions", which probably indeed can be suspicious.

    Like Awesome
  • baroque-quest
    baroque-quest Posts: 74 Enthusiast

    Ukko and Simon:

     

    I completely forgot about certificates.  Good point.

     

    I always download directly from the source.  I never use CNET or other secondary sources because I always wonder if they have added some adware or worse.

     

    Sumatra PDF has always bothered me a little because it has ads which intentionally confuse users into downloading adware/malware (DOWNLOAD HERE!).  I realize that websites for free products need useful ads, but I suspect that quite a few people who view his site fall victim to the fake downloads.

     

    Support wrote back with: "I would suggest you to download Adobe Reader X to view your PDF files as the program is also free for download.  Adobe is a trust able and reputable software manufacturer for a very long time."

     

    I find this response to be slightly amusing for two reasons.  First, if users are not sophisticated enough to un-select the "free" Chrome download, they will get more than they wanted, just as with Sumatra PDF's website.  And second, Adobe Reader has been the subject of many security flaws over the past few years, the reason many of us looked at alternative viewers.

     

    That said, I downloaded Adobe Reader for this new PC.

    1Like Awesome
  • Simon
    Simon Posts: 2,667 Superuser
    I've not used it myself but I've often heard recommendations for Foxit PDF reader. Might be worth a look?

    http://www.foxitsoftware.com/Secure_PDF_Reader/

    Personally, I've never had a problem with Adobe Reader, and they seem to patch any vulnerabilities pretty quickly, on the whole. I guess the golden rule is, only open PDF files from trusted sources. :)
    1Like Awesome
  • NikK
    NikK Posts: 903 Forum Champion

    Foxit is a good reader, but be aware of the complaints for its recent versions regarding including "OpenCandy" in the installer:

     

    "We sincerely apologize for this inconvenience. I'll forward your feedback and experience to our market development team for references and evaluating.
    PUP means Potentially Unwanted Products. The bundled third party software will not harm your system, but provide you with an offer of a third party product. And they are not mandatory to be installed. In the process of installing Foxit Reader, you shall have an Offer Screen which allows you to Accept or Reject the bundled tool, and you can un-check the option to choose not to install the recommended tool."

     

    I prefer Foxit when copying text from PDFs. Other than that I use Adobe and Adobe is also my default PDF reader.

     

    In both of these programs you can increase the security in its preferences.

    For Adobe - enable protected mode and view for All Files  http://helpx.adobe.com/en/reader/using/protected-mode-windows.html#main-pars_header_0

    1Like Awesome
  • Simon
    Simon Posts: 2,667 Superuser
    True Freeware seems hard to come by these days. Smiley Sad
    Like Awesome
  • baroque-quest
    baroque-quest Posts: 74 Enthusiast

    NikK wrote: "In both of these programs you can increase the security in its preferences."

     

    Thanks, that is good to know.

     

    The story regarding Foxit and Open Candy made me want to take a virtual shower.  Yuk!

    Like Awesome
This discussion has been closed.
Feedback on New Design

Categories