Nod32 Antivirus Alert from Invision 3.2

[racky29]

i know norton has been mentioned about virus alert
but not sure if its been said about ESET Nod32 Antivirus 2.x, 3.x and 4.x
recently has been flagging up Invision3.2.july10.exe Installer as NSIS/TrojanDownloader.Agent.NGA trojan
ive been a invision user and follower for years and fully trust all the releases from here, and i even checked the md5 hash to make sure its the same as printed here, and it was

i have a xp machine with Nod32 v2.7
a vista machine with Nod32 v3.x
and Windows 7 macine with Nod32 v4.x

and they all have been poping up the invision installer the same NSIS/TrojanDownloader.Agent.NGA trojan
not sure exactly how long its been doing this but it must be the past couple of weeks or so

i submitted the file to them and wrote a comment to say this must be a false positive

[Riamus]

Thank you for the update. I think the next release will remove the mIRC download option and just require that users manually download and install mIRC. I'm sure that's what these two antivirus programs are flagging it for. Even though the user is asked if they want to download mIRC while installing Invision, the antivirus software doesn't understand that I guess. So that means two things... 1) The installer will lose a feature that can be nice to have, and 2) The installer will be easier to understand by having one less install option.

There is no estimate on when the next release will be, so hopefully these two antivirus programs will remove the installer from their matches so there aren't problems in the meantime.

[NuBiXx]

Just to add Bitdefender also detects Invision 3.2 (July '10).exe has virus.

[anglerthefish]

ESET, the company that makes NOD32 for Windows, now makes a version for the MAC called ESET Cybersecurity. I use a MAC with Parallels Virtual Machine running XP. I have mIRC in my XP window. I downloaded the latest version of Invision both in XP where I have NOD32 running, and on Mac itself to transfer manually to my XP window with ESET Cybersecurity running.

Well, in both cases I too received the error message (under NOD32 AND ESET Cybersecurity) that the Invision download had a trojan virus as described by other posters in this thread, and both ESET programs deleted the downloaded file before I could use it anyway (as I know the file is clean because it is coming directly from the Invision web site). Summary: I can't download Invision at this time under either Windows XP or MAC OS X. I just thought you would like this feedback. My goal is to run mIRC and Invision under XP in the virtual machine on my MAC.

I'll keep checking this thread to hear of possible solutions of future Invision releases or if someone has a work-a-round.

Thanks!

[Riamus]

The solution at this time is to disable A/V until you download and install Invision and then enable it again. Not a great solution, but all there is for the time being. Just don't browse other sites or do anything else online while the A/V is turned off. I'd also avoid this forum as there are sometimes spammers who post links and they may stick in something malicious before I see it and remove it. Or, if you can get someone else to download and install it on their system, they can then compress the folder and send it to you to extract. Only the installer has the mIRC download option, which is what's causing the trouble.

It would be nice if they hadn't changed this after we had the installer out for months. We would not have added that feature if we knew A/V wouldn't like it.

[anglerthefish]

Thanks, Riamus. I'll try this work-a-round Nice to meet you, btw. Thanks again!

EDIT:

Update: I disabled the ESET NOD-32 from my Windows virtual machine. I downloaded the latest version of Invision. The download was sucessful

I then installed the software to the previously installed latest version of mIRC. Once installed, I then turned on the A/V again. Next I did a complete NOD-32 computer scan of my virtual machine. Then I ran ESET Cybersecurity for the MAC to scan my entire iMac computer. Three "viruses" were found by NOD-32; one was the Invision UnInstaller; two were Invision Launch agents. I deleted them from "quarantine" then I ran the complete virus scans again. The results: ESET is now reporting zero viruses on my computer xDDDDD

The work-a-round suggested by Riamus worked Thanks, Riamus!

And it doesn't matter to me that the A/V has caught the uninstaller of Invision after I had installed it because I have no intention to uninstall Invision. I will use it faithfully with my mIRC. And that is the end of this update

[Riamus]

Just an update, ESET has said the next signature release will remove the false positive. Still waiting to hear from Norton.