Firewall Alert

[mfoster]

I have just installed Affinity Designer Beta for Window following the install I elected to do a restart which triggered our firewall to do a scan. The result is a little worrisome, has any one else seen this, is this a thing to be concerned with - see attachment.

 

have been a Serif user for a decade and never got and such warning before.

[Patrick Connor]

You should certainly not have seen this. We do not install any Affinity browser plugin.

 

Where are you getting the download installation from?

 

The only valid place is the link in the forum post. If you got it from anywhere else please uninstall it.

[mfoster]

I downloaded the link from the Affinity Web site, details from the exe file are:

 

File Description: Affinity Designer Public Beta Setup

Company: Serif (Europe) Ltd

File Version: 1.5.0.14

Date Created: 8/26/2016 10:04

Size: 225MB

 

I believe the date created may be the date and time I downloaded

[mfoster]

Patrick, Should I post this question on a different forum. An aside issue, I am in BC Canada PST is my time zone.

[Patrick Connor]

That all seems to be correct. As long as your download is digitally signed by Serif then it looks like a false positive. Our software does communicate with us to check for updates, pass crash reports and a few other things (like plugin support for Affinity Photo)

 

I cannot say why you have been presented with that description. It is ott if it is just warning you that we require internet access

[Alfred]

What is odd is that the warning refers specifically to 'Affinity Toolbar', as if it were one of those horrid 'OurToolBar.com' things like the DaisyTrail one that Serif used to promote.

 

The integrity checking details for my Affinity Designer 1.5.0.14 installer file are as follows:

Size: 225 MB (236,564,752 bytes)

MD5: DD86412B0DD7E0E08334A5967A4B876A
SHA-1: 9DE3C55CE75C0B135DB87D3D75B9DFF910B5BCF3
 

[mfoster]

As the Affinity Window is fairly new could this be a clitch in SpyHunter, it lists 3000+ items many of which seem to be application modules like .css files. Does Serif not run applications against malware, spyware checkers, a warning like this could turn many users off of other Serif products. 

[jkehoe]

Hi Everyone,

 

This message caught my attention too and I did a web search on "Affinity Toolbar." I've added a partial screenshot of some of the hits and they look like they're not related to Serif. I did click on one of them but avoided anything more. It looks like a trick to me.

 

Thanks for adding interest to this forum, too!

 

[mfoster]

jkehoe,

 

Thanks for taking the time to check it out at least now I do not all alone in the woods. What is the next step you or anyone would suggest, I have clean installed it twice at get the same results.

 

Should I just ignore the SpyHunter message and assume it is fake. I need to hear from Serif on this subject.

 

My concern is that it be sorted out before Affinity goes public, others WILL get the same/similar message and drop what looks like a winning Serif product.

[Alfred]

Should I just ignore the SpyHunter message and assume it is fake. I need to hear from Serif on this subject.

 

What more do you need to hear?

 

That all seems to be correct. As long as your download is digitally signed by Serif then it looks like a false positive.

 

Follow these instructions to check the digital signature of the downloaded installer file.

[jkehoe]

Mfoster,

 

As I understand your question and situation, your computer has an "Affinity Toolbar" installed and it is causing a security alert in your firewall setup. Serif is the parent company that creates and sells Affinity Photo and Affinity Designer; they don't offer this "Affinity Toolbar." I did another web search on "Uninstall Affinity Toolbar" and included a screen capture below. Please try a web search on your computer and decide which way to go. As I see it, you have a web browser add-on or extension or some other kind of tool that added this toolbar to your web browser and it happens to be called "Affinity Toolbar," no relation to Affinity Photo or Affinity Designer. Web browser extensions, add-ons, etc. are generally uninstalled or disabled from the web browser menu.

 

Best Regards,

John

 

[mfoster]

Hi Jkehoe,

 

Thanks for responding. When I deleted the Affinity Toolbar it also took the 3,479 associated modules which had also been red flagged. My only option is the shut down Spyhunter and do a reinstall of Affinity windows Beta. I am not that knowledgeable to know what Spyhunter will do when restarted.

 

Mike

[mfoster]

Sorry for not getting back to this little problem but have been busy busy. OK. I did a completed check of my system for an Affinity (malware) toolbar and came up empty, Did a new install of Affinity Windows Beta and Lo and behold - I got an Affinity malware error, same one as before, I put it in quarantine and it greyed out my on screen Affinity icon. I guess I will not be able to use the Affinity Windows Beta, amazed that no one else has the same problem as SpyHunter is very popular.

 

Thanks to all who gave me some direction, I am a long time user of Serif products and use them in all my lectures, I will be back!

[Alfred]

Did you check the installer's digital signature? If so, and it was reported as being OK, can't you tell SpyHunter to whitelist the file?

[Sean P]

Hi mfoster,

 

I can assure you this is a false positive and we are not installing any malware with the beta. The problem is that SpyHunter is reporting a false positive based on the presence of the install directory 'C:\Program Files\Affinity' and also the folder '%appdata%\Affinity\' that is used to store Affinity Designer program settings and other data such as brushes, presets and keyboard shortcuts.

 

The reason it is reporting a false positive is because there is a browser toolbar called 'Affinity Toolbar' which actually uses the same two folders mentioned above. To prove this I took a clean installation of Windows 10, created a folder named Affinity in the %appdata% location and then placed a Text file containing one word inside this folder. I then installed SpyHunter and it reported '2 infections'. The reason for the high amount of 'infections' shown in your screenshot is that we have a lot of installed files for the help system so it is reporting each individual file inside that folder.

 

See the attached screenshot for this proof. I am going to try to contact them, however they do not make it easy if you do not own the software or have an account with them. If possible are you able to use their supplied 'Spyware HelpDesk' to contact them about this false positive.

 

But as I said we do not install any malware - this is just an unfortunate coincidence. I hope I have eased your concerns, however should you have any questions don't hesitate to ask.

[mfoster]

Hi Sean,

 

Thank you, your concern, response and testing is a credit to Serif and is a good reason why I have used and demoed Serif products for the last decade or more, and will continue too.

 

I too had come to the conclusion that it was a false positive but could see no way around it unless Spy Hunter make some form of exception to the Serif Affinity Product.

 

I have removed the Affinity Windows Beta from my evaluation VM and will be in contact with Spy Hunter. I would recommend that a letter from Serif HQ VP level may also be a help. 

 

Michael Foster

 

Mike Foster - Senior Instructor, Learning Tree International NA Ops

[Patrick Connor]

Mr Foster,

We will contact them personally. Their website makes email communication very difficult, so it may be snail mail!

[R C-R]

Michael, it would not hurt if when you contacted Spy Hunter you included a link to this topic....  ;)

[mfoster]

Hello Michael, thank you for using SpyHunter!

 

We have forwarded the information about this issue to our Research Team so that they can investigate it.

We will contact you as soon as we have a solution.

In the meantime, if you have any questions or concerns, please don't hesitate to contact us.

All the best, and thanks again!

 

Kevin K.

Technical Support Department

Enigma Software Group

http://www.enigmasoftware.com

 

ps. I also included a link to this topic - will wait and see

 

Mike

[mfoster]

Hi All,

 

Just to update and put a close on this topic.

 

I heard from Enigma Software who seem to have applied a fix for the Affinity Toolbar fire wall issue (see my first warning). Enigma asked me to update my Spy Hunter, then reinstall Affinity Windows Beta and reboot, letting Spy Hunter check my system. On completion all was clean no malware warnings. I am now testing Affinity Windows Beta.

 

I would like to thank all for their assistance, tips and suggestions.

 

Mike

[Sean P]

Thanks for letting us know Mike, that's great news!

Hope you enjoy using Affinity!