Skip to main content
1-Visitor
October 16, 2012
Question

Mathcad Prime 2.0 M010 - Backdoor bot???

  • October 16, 2012
  • 2 replies
  • 6619 views

After/while installing Mathcad Prime 2.0 M010, Malwarebytes Anti-Malware ist reporting

[ProgramDir]\PTC\Mathcad\Mathcad Prime 2.0\Help\jre\win32\jre\javaws\javaws.exe

as infected with

Backdoor.Bot.citdl

Not really building confidence!!!

System ist Windows XP SP3, 32Bit

Uploading the file to virustotal.com resulted in an appeasing 0:40 ratio, meaning that none of 40 used virus scanners found something suspicious.

So I would consider it a false alarm, but a drop of bitterness remains.

2 replies

1-Visitor
October 18, 2012

Same efffect here and I am a somewhat upset and unsettled by it. Anybody can help and explain what the cause for this false alarm (which it hopefully is) is?

Another, more severe case is the secret installation of that "PTC quality agent" which sends back home to PTC a lot of information. I want to be informed about that and have an option at installation time to be able to avoid the installation of that "goodie".

BTW, I also don't like the software (MCP2 now) to insert an icon in the quickstart without my permission. Generally the installation routine needs some polishing, I think. If You want M010 to be installed in the same directory as the previous F001 (program files\Mathcad\Mathcad Prime 2.0) and not the newly suggested PTC-dir, you have to set the installation directory to "Program files\" only, because the dirs Mathcad\Mathcad Prime 2.0 will be created newly in any case. Thats rather unusual as is the way to change the install dir - I had to look for quite a while to find the way to change the install dir.

Furthermore, apart from not informing the user about that agent program, the default setting is to _enable_ the agent and the default filter is to send roughly abaut any information to PTC thats possible.

You have to find out yourself by chance about that program and that you are able to disable its function in the Mathcad options and filter what kind of informations it sends by calling the agent itself (why not all in one place - oh my god!). Or do it as I did and uninstall the agent complete.

As I found out by searching around is, that useres of the demo-30-days (and possible the express version afterward) are not allowed to disable and filter the agent! Possible edu-licenses too ???

I also found the information, that Creo refuses to work if the agent is not installed - can not confirm that but hope, this will not happen to Mathcad.

After all, in my opinion the introduction of that "quality" agent spyware and especially the way it was done, is a severe abuse of confidence. If PTC really would be interested in improving their software including their costomers it would have been a good starting point to listen to the users in this forum and comply to the users requests and the for long years standing wishes. Don't have the feeling that Prime was a step in the right direction and the secret underhanded introduction of that agent is simply unacceptable and inexcusably.

19-Tanzanite
October 18, 2012

Another, more severe case is the secret installation of that "PTC quality agent" which sends back home to PTC a lot of information. I want to be informed about that and have an option at installation time to be able to avoid the installation of that "goodie".

I agree with this. It is a gross violation of privacy. I am surprised installing this with no explicit notification and no opt-in (not opt-out!) option is even legal.

24-Ruby III
October 22, 2012

winfrod rager wrote:

...Backdoor.Bot...

This is called "Quality Agent". You can delete this application after installing service release M010 of Mathcad Prime 2.0. In the attachments you can find a quote from "Data Collection Policy".

rag1-VisitorAuthor
1-Visitor
October 22, 2012

VladimirN. schrieb:

winfrod rager wrote:

...Backdoor.Bot...

This is called "Quality Agent".

No! The file which is Malwarebyte AntiMalware is complaining about does not belong to "Quality Agent".

Nonetheless the latter could be called malware, too. Especially looking at the way in which it is introduced.

You can delete this application after installing service release M010 of Mathcad Prime 2.0. In the attachments you can find a quote from "Data Collection Policy".

I don't want this spyware to be installed automatically on my computer without my approval in the fist place.

Before I uninstalled that thing i realized, that i would not be able to filter any of the data beeiing sent to PTC - all greyed out.

24-Ruby III
October 22, 2012

winfrod rager wrote:

...I don't want this spyware to be installed automatically on my computer without my approval in the fist place...

I agree with this.