Sublime Forum

Sublime text installation blocked as rootkit

#1

Hello,
I have been using ST3 for some time and there were no problems. Today, I got the message about plugin_host problem that I need to restart program to get rid of error. After trying few times. I decided to uninstall and install the program again, but I got strange things. Avast blocked installation because it refers for the dangerous rootkit win32.evo-gen hidden in the Sublime installation package. I thought that this is false alert, but found online that this is a real danger. I downloaded ST3 from this website 3047 version for my Win 7. By the way, I am using free version.

Thank you

0 Likes
#2

What do you mean that you found online that it’s a real danger?

0 Likes
#3

I mean that “win32.evo-gen” file that was blocked by Avast antivirus as the part of the Sublime installation package. I mean that I was looking is win32.evo-gen dangerous, and people say that this is a rootkit. Anyway, I even try to mark it as the false virus file to make the program download and when I opened the program I had the same error message about bout plugin_host problem again. So, I do not know how to get rid of two problems together.

0 Likes
#4

I think you should ask the Avast developers to verify that there’s not a false positive on the Sublime Text installer package.

0 Likes
#5

Agree, but how to install Sublime again without any errors and rootkits?

0 Likes
#6

I’m no malware expert, but I strongly suspect this is a false positive. The “win32.evo-gen” detection is apparently a generic detection, so Avast is just guessing that it has detected some malware. From forum.avast.com/index.php?topic= … #msg925646:

[quote]Evo Gen is a new system which helps avast! to identify new unknown malwares even if they have never been seen.
See here it’s clearly explained : blog.avast.com/2012/12/03/new-toy-research-lab/
It may cause some FP but generally avast! team are really fast to fix them.[/quote]

If it’s a false positive the way to work around the problem is to get Avast to fix the false detection, disable Avast, or use some other antivirus. If you believe there’s actually malware in the ST installer (or believe there’s enough of a risk for that), then my suggestion would be to not install ST until you get an indication that that the malware has been removed.

Some people use a site like VirusTotal to help decide if a malware detection is valid or not.

You’ll have to use your own judgement to decide which of these actions to take.

0 Likes
#7

Thank you for providing me a useful link. Surprisingly, I just installed Sublime and there were no issues. :smiley:

0 Likes