PrcViewer malware warning after installing multiAVCHD from videohelp mirror

[rjamesd05]

After installing multiAVCHD from the videohelp.com mirror (as advised on http://multiavchd.deanbg.com/ ) at https://www.videohelp.com/download/multiAVCHD_3.0.exe

I got a warning from my AntiVirus program, McAfee, that "PrcViewer is a PUP (Potentially Unwanted Program) and would I like to have this removed?"

I said yes to have it removed and I got no further messages from McAfee, so I don't know if it was removed or not.

But I wondered what this program is and why is would be classed as a PUP?

Apparently from my research, it is a command line tool for deleting or modifying Windows processes, but why would this be necessary for a video encoding/authoring tool such as multiAVCHD?

It concerns me that I would encounter this situation after downloading what appears to be a respected tool (multiAVCHD) endorsed by-and-from a mirror on a respected website videohelp.com

What also concerns me is the license agreement with multiAVCHD which reads something like "accepts no responsibility for the eventual loss/damage to files" *eventual loss* ???!!! Is this bad English or does this mean that multiAVCHD will eventually damage your files? I would think not but I need to make this point that what appears to be bad English can cause alarm.

Another concern is that no-one else had encountered this problem and searches on google and this forum show no results for this problem.

Thoughts?

(I'm not interested in comments about the AntiVirus I have chosen to use (NAI AntiVirus as well as McAfee reports it, nor am I interested in comments about not using Windows and using a Mac instead).

[johns0]

I checked my multiavchd and no PrcViewer was found,i'll check the file you downloaded.I just checked and theres no PrcViewer in multiavchd,most likely its in your system to start with and got in the dir.

[multiAVCHD]

There is a tool called 'process.exe' in multiAVCHD's tools folder. It makes some AV programs report it as an 'unwanted' application. PROCESS.EXE is used to handle pause/resume/process-priority-change for x264 encoding (when transcoding) and it is not a malware or something that you should worry about.

Dean

p.s. About the 'eventual' folders/files corruption... There was this bug long time ago, which would allow a user to set a "TEMP" folder to the root of a drive (for example C:\), which caused troubles once a temp-clean-up is performed...

multiAVCHD was made fool-proof about a lot of things since then, but I didn't remove the warning.

[rjamesd05]

Thank you for the reassurance and giving some background about why it occurred.

[lordsmurf]

Your av checker is being stupid.
Use http://www.virustotal.com for future questions like this.

[Baldrick]

Now is this back for multiavchd_4.1,
https://www.virustotal.com/en/file/ec3014471093ef785c100269071c1f53cffd35c9ce6dcedd988...is/1378138232/

5 out 44 thinks it's bad and 2 finds Win32/PrcView

So I'm not sure I can host it. I get a complaints from antivirus/spyware robots and they are contacting my host.

[jagabo]

But "PUP" sounds so cute!

[racer-x]

I'm still using MultiAVCHD_3.0. For me, it's the best version. I can create nice custom menus. I let it encode a splash screen, then replace it with my own First-Play video. I just have to edit with CLIPINF_Edit to make it all work...........

Never had any issues after all these years. The PC I use it on is not connected to the web however......

[JNavas]

WARNING: It definitely is possible to get infected from trying to download and install multiAVCHD!
Here is my detailed report to the developer: https://forum.videohelp.com/threads/345670-MultiAVCHD-Adware?p=2289215&viewfull=1#post2289215

[johns0]

Multiavchd is virus free from this site,please don't spam here with multiple warnings.Any crappy site can do that to files that are virus free to begin with.Your warnings aren't needed.

[JNavas]

Multiavchd is virus free from this site,please don't spam here with multiple warnings.Any crappy site can do that to files that are virus free to begin with.Your warnings aren't needed.

If you actually read what I wrote you'll find that what makes this so troubling
is that the link to the infected downloader is on the author's website. This site points to the author's website,
thus making it all too easy for people here to get sent to the infected downloader, hence my warning.

[mgh]

To me PUPs mean only that someone wants to malign that progam.
If a program i wanted to use is classified as PUP by some stupid av, I have not hesitated to use it and have had no problems so far.

[Baldrick]

More and more download sites are adding download managers with adware crap. I have been offered to add that to my mirror downloads also.

[JNavas]

To me PUPs mean only that someone wants to malign that progam.
If a program i wanted to use is classified as PUP by some stupid av, I have not hesitated to use it and have had no problems so far.

In this particular case:
* Stealth install
* Files hidden
* No uninstall
* Reinstall after attempted removal
* Outbound firewall alerts
That's rootkit malware, not PUP.
To be clear, the infection vector in this particular case is a malware installer masquerading as a download manager, still linked from the author's own website despite my emailed report, not multiAVCHD itself.
As for having "no problems so far", I'd be willing to bet you have at least one infection -- more than 80% of the machines I test are infected, even those with current anti-virus software.