Downloaded Imgburn won't run

[ptoye]

I downloaded the Imgburn setup program from this site and the CRC checked OK. But when I ran it I got a message saying the it wouldn't run (see screenshot). then, about 10 secs later, the program disappeared from the File Explorer window, which then hung until I'd dismissed the error message.

What on earth is going on?

[LIGHTNING UK!]

Your AV software probably removed it. See if you can get it to actual notify you of what it's doing and not just do it.

[ptoye]

Thanks. You're right. Why on earth does this happen? I'll ask Mr Kaspersky.

[dbminter]

Hey, good to see you from the Reflect forums!

 

I'll tell you why it probably happened.  PUP's.  Potentially Unwanted Programs.  While I never had a Kasperksy product (ZoneAlarm Free Firewall's free AV version) quarantine ImgBurn's installer in the past, many AV software do.  Because their programmer are lazy.  PUP's are NOT viruses, but are treated as such because it's easier on them.

[ptoye]

Hi God (as it says). The issue seems to be the Fusion.dll which is included in the distro. See the attached Kaspersky log (I tried it twice).

As far as PUPs are concerned - you yourself warned me to install only from this site. or are we at cross-purposes here?

I've read articles which say that fusion.dll is often distributed in corrupt versions to allow malware into the machine. e.g. https://www.completelyuninstallprogram.com/fusion-dll/

Is assume this accounts for Kaspersky's paranoia.

But other articles (including one by Microsoft) imply that it's a necessary part of Windows. I seem to have 8 copies 9different sizes) on my machine!

Imgburn.txt

[dbminter]

If I may quote The Lawnmower Man: "I AM GOD HERE!"

 

Yes, but I also told you not to get click happy because ImgBurn's installer may offer you other software you won't want to install.  That's probably what Fusion.dll does in this case.  In the old days, it was OpenCandy, which went out of business.  Now, it's something else.  It will offer you other software installs because that's how ImgBurn can remain free software.  Fusion.dll is actually called by Microsoft's .NET Framework, which powers many applications today.

 

Other mirrors are a bit more insidious about how they might force unwanted programs on you.  That's why I suggested Mirror 7.

 

I admit, I failed to mention on the Reflect forums the possibility an AV software package flagging ImgBurn as a "virus" because of PUP's.  They're not viruses but because people get click happy and don't read what they're agreeing to, they often times get unwanted programs installed by free software.  So, rather than do the work themselves to flag PUP's as PUP's, AV vendors flag them as viruses, even though it's generally the users' fault that they got something they didn't want.

[ptoye]

I don't think I was click happy. I downloaded from Mirror 7. Checked CRC and then manually with Kaspersky, and then double-clicked on the file. Immediately got the error screen in my original post. No extra clicks.

Edited March 16, 2020 by ptoye
clarification

[dbminter]

You'd get that behavior regardless of it you were or weren't click happy or the mirror you downloaded it from.  Your AV package is flagging fusion.dll as an apparent PUP.

 

There might be a way to exclude that false positive or add the file to a white list, but I don't know how to do that in Kaspersky.  At the worst, you can temporarily disable your AV scanner long enough to install the application and then re-enable it, but I can't guarantee Kaspersky won't flag trying to run ImgBurn itself as something that isn't kosher, even though it is.

 

[ptoye]

But why is fusion.dll there at all? I've already got 8 copies on my machine, all in Windows-related folders. I hate to say it, but if ImgBurn causes a number of different AV products to flag it, people aren't going to use it...

It's not just Kaspersky, I gather. 35 AV engines flag it.

[dbminter]

35 AV engines flag it which just meant 35 AV engine programmers are lazy.  It's not a virus and AV software should not be judging what is a PUP or not all on their arbitrary own.

 

But what you say has some weight.  People might panic and not install ImgBurn, particularly if they CAN'T install it if their AV package refuses to allow it through.

 

As I said, fusion.dll is basically there for anything that uses Microsoft .NET framework.  To avoid conflicting versions of the DLL, some applications install the version it was compiled with.  That's why there are multiple copies of the file.  A long time time ago, Visual Basic was a common culprit of this practice.  Many times, your base VB DLL was out of date and an application wouldn't run, requiring you to manually replace your copy with the latest version.  To avoid repeating such problematic mistakes of the past for the novice user, multiple copies of DLL's get installed in different places now.

 

Or fusion.dll could be a necessary part of the installation process if ImgBurn's installer uses Microsoft .NET Framework.  However, I'm more likely to go with the wrapper (Which I will describe below.) theory.   That if fusion.dll is being flagged as a PUP, it's based on the wrapper around the ImgBurn installer.

 

Fusion.dll is probably part of the package known as IronS something that replaced OpenCandy.  OpenCandy was the wrapper around the software that phoned home and offered users free software as "advertising."  That's how ImgBurn remained free software.  Then, OpenCandy went out of business and IronS something stepped up in its place.