Comments on: SourceForge-hosted PDFCreator Trojan/Toolbar Warning

By: Lee

Lee — Tue, 02 Aug 2011 19:41:04 +0000

We were using this app since 0.9.7 and push it to our machines using deployment tools. We used to have a method to uninstall the toolbar via scripting but now there is no method to exclude the toolbar from the installation, even when using the uninstall string. Currently I can uninstall PDF Creator but the toolbar errors stating another app is installing and I must wait.

Attempting to uninstall it failed, would not even work from Safe Mode. We’re done using their software and removing it from our library.

By: arows1faith

arows1faith — Tue, 22 Mar 2011 22:42:06 +0000

I’m terribly disappointed in this… and it’s apparent truth! I GREATLY APPRECIATE the info!!!!

FYI: original page of Post of angry user @ http://replay.waybackmachine.org/20090301134326/http://www.pdfforge.org/node/2423

By: David

David — Tue, 15 Mar 2011 18:48:39 +0000

I got stung by this. I installed PDFCreator from SourceForge thinking it was safe. Boy was I wrong! I did unselected the option to install the toolbar component, but it installed anyway. Fortunately my ForeFront AV noticed the suspicious behavior and alerted me. I will think long and hard about downloading anything from SourceForge in the future. I;m surprised that they would permit malware being added to software there.

By: Ulla

Ulla — Sat, 08 Jan 2011 05:05:49 +0000

Thank you for this post, it is very helpful to me, just the information I was looking for.

By: niarami

niarami — Sat, 11 Sep 2010 17:46:01 +0000

I strongly agree, that’s not tolerable for an opensource project according to me. That is being unethical because 99% of user will install this malware. I suggest to make a fork project without the toolbar…

By: Andrea

Andrea — Sun, 05 Sep 2010 11:03:11 +0000

I really appreciate, thanks

By: Jean Lewis

Jean Lewis — Sun, 27 Jun 2010 10:39:54 +0000

Thank you so much for your helpful post about the PDF toolbar. That message has been annoying me for several months – now it’s gone and all thanks to you for pointing out where the trouble lay. I’m very grateful.

By: hinchbox

hinchbox — Sun, 27 Jun 2010 00:04:42 +0000

What has happened at Sourceforge? A few years ago they sent you a rebuke about compromising their site’s security when you forgot your password, and now they are allowing spyware to be uploaded to, and downloaded from their servers?

By: julie

julie — Thu, 10 Jun 2010 11:48:45 +0000

thanks for posting this!

i installed the updated version recently (not being as cautious as usual based on past experience with product–my mistake).

anyway, i wanted to mention (so that others searching for info can make correlation) that this issue was brought to my attn by mcafee alerting me that a program was seeking outbound connection. it was located in program files as a benign-sounding applicationupdater.exe, referencing spigot and the version #

*******
File Information

File Name: ApplicationUpdater.exe
File Size: 380928
File Path: C:\Program Files\Application Updater\
Version: 1.1
First seen: 1/8/2010
Recognized safe program

Manufacturer: Unknown
******

i had already removed the crap before locating your article but found your research/info to be of obvious interest since I only had made the general association. (your article saved me lots of time i would have spent duplicating efforts) so…

…thanks again for sharing your findings!
~julie

By: faargenwelsh

faargenwelsh — Wed, 12 May 2010 12:05:00 +0000

I’ve just finished running a KlamAV (free open source anti-virus software for linux) scan while checking my windows drive (I have a dual-boot install) for problems.

All executables under C:/Program Files/PDFCreator/ are highlighted as containing “Trojan.VB.Chinky-1″.

Man, I was using this program for like several years now! What a shame, really…