Anti Virus Warnings for Plex downloads

server-windows

#1

New Plex install in windows to support Roju 3. Why am I getting this warning several times a day?

 

Same file name every time. I have accepted the downloads, but the warnings continue. Are you sending these d/l's? Why?

 

An image of the message did not post! Why?  Whats with this program?


#2

Why doesn't the copied message show on previous topic?


#3

Where are the downloads coming from? 

Is it the metadata for new library items?

What is the filename? Stop accepting them for now.


#4

I cannot copy or attach. I am thinking pooorly of this system.


#5

Don't think poorly of the system, thousands of people use the system (both the forums and Plex) and have no problems.

Can you TYPE the message? 

(Hit the "More Reply Options" in the bottom left for ways to attach.)


#6

It is long and detailed. Trying to attach as a text file. No success.  Can't attach a word doc or a text file. Why not? Never had this type of problem on a forum. Been doing this since mid 80's.  I am old.

I do appreciate your help.

File is Libeay32.dll.

From  http:// nine. plugins.plexapp.com/system/bundles/4832/….

That’s all I can read.


#7

here it is I think?


#8

Maybe this will work.

If you save it --then open with Word...


#9

Are you trying to install Plugins from a third party site?

Where did you get your Plex server installation files from?

That website is not a Plex site that I am aware of. I may be wrong though.

Not sure what that website is (nine.plugins.plexapp.com), I have never seen it. 

I would stop downloading it until someone can tell you what it is.


#10

No I am not downlown loading anythingI.

I  down loaded and installed from the plex website. Same as this forum.  Since they don't supply support except for the forum,(that's unbelievable and a first for me) does anyone from Plex look at this? I doubt it, since you are the only one who replied.

As I said before I am seriously unimpressed. Their operation is  crap.

Looking at all the problems on this forum, I suspect their software is also.

I do really thank you for your help.

And I just got the message again.


#11

It is not "crap" as you put it, it is very good software.

Yes they do look here but this is the user forum. It is their support model.

I would go ask over at nine.plugins.plexapp.com for answers since that is the website that it is downloading from.

As I stated, I ma not sure twhat that site is. Why don't you go there and ask for assistance?


#12

This is covered by this topic https://forums.plex.tv/topic/98048-nineplugins/

The nine url is probably an old name still being used going back to Plex Nine which I recall coming across on the old support site

I think it is just Avast that is complaining and one should just accept the download


#13

Thanks sa2000. Will tuck that away for future reference.


#14

Initially I did think it was an Avast issue and I had accepted the download, but it kept coming back. That is when I asked the question.

Still if the developers at Plex left this tidbit out there, I have to question their abilties. And to not hear from one of them on this forum I find grossly unacceptable.

I appreciate your help and comments, but the real test of service is when something goes wrong. So far they are failing.


#15

Initially I did think it was an Avast issue and I had accepted the download, but it kept coming back. That is when I asked the question.

Still if the developers at Plex left this tidbit out there, I have to question their abilties. And to not hear from one of them on this forum I find grossly unacceptable.

I appreciate your help and comments, but the real test of service is when something goes wrong. So far they are failing.

Edited 

Some further thoughts ....

May be there is an incomplete download. we have had numerous cases of incomplete downloads when downloading the Plex Media Server install file and one check it out by looking at the file properties and seeing that there is a Digital Signatures tab with an entry for Plex Inc

eg checking file properties for Plex-Media-Server-0.9.914.531-7eef8c6-en-US.exe

The Digital Signature is in the last block of the file and only if it is showing that one can take it that the download file is most likely a complete file

I am mentioning this because the error that Avast reported for file libeay32.dll also says: Digital Signature not present

So C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe has downloaded a libeay32.dll file that has no Digital Signature.

Without checking all the server debug logs and system / framework log file I do not know why PlexScriptost.exe is downloading this dll which is a dll within the standard software installed at the time of installing Plex Media Server. In fact, the standard libeay32.dll does have a Digital Signature and you can check that by looking at file

c:\program files (x86)\plex\plex media server\resources\plug-ins\framework.bundle\libeay32.dll and checking its file properties to see that a Digital Signature tab and entry for Plex Inc do exist

Edit: It is actually updating the framework.bundle and libeay32.dll is part of that bundle. So it is probably an incomplete/corrupt download - like what we often see from users with a slow connection to the Plex download servers.

PlexScriptHost.exe runs python scripts which is what the Plex Channels is written in - as well as the internal system/framework bundles python code

So things to look into -

Are there are channels you installed that may be need libeay32.dll and downloading the wrong dll file - one without a Plex Digital Signature?

Is the download being done by plex media server system code as part of update and it is corrupt? I do not use the software update facility as it is not reliable so I do not know how it updates the Plex Media Server installed software

Is Avast telling the truth when it is saying Digital Signature Not Present?

Edit: The bundles update download goes into a staging area - one can check the file there for a digital signature. The path can be determined from looking at the log file

.....\Logs\PMS Plugin Logs\com.plexapp.system.log

To dig deeper into this, you could set verbose and debug logging, restart Plex Media Server and when the Avast warning is displayed, capture the log files:

Plex Media Server.log and zip of the whole Logs\PMS Plugin Logs folder

Get a screenshot again of the error and the whole screen to show the time as well and upload all the files. You could zip the whole set into one file


#16

The plot thickens.... 

For my setup 

The libeay32.dll that I have as part of the framework.bundle has no Digital Signature

Version 0.9.8.12  

31 July 2014

Folder Path

%LOCAPPDATA%\Plex Media Server\Plug-ins\Framework.bundle\Contents\Resources\Platforms\Windows\i386\Libraries\OpenSSL

The dll that is part of the installed Plex Media Server does have a Digital Signature

Path

C:\Program Files (x86)\Plex\Plex Media Server\Resources\Plug-ins\Framework.bundle\Contents\Resources\Platforms\Windows\i386\Libraries\OpenSSL

Version 0.9.8.12

8th September 2014

Interesting


#17

The particular file mentioned is part of the "Framework.bundle" package, which is a system component. It is one of the [dynamically updated server components](https://support.plex.tv/hc/en-us/articles/203088737-Dynamically-Updated-Server-Components) and those updates will come from nine.plugins.plexapp.com.

The bundle packages aren't digitally signed. I would recommend setting your Avast to perhaps ignore updates in your [Plug-ins folder](https://support.plex.tv/hc/en-us/articles/201106098-How-do-I-find-the-Plug-Ins-folder-) to avoid notices in the future.


#18

I run my Plex server on Linux Mint and it hasn't had any problems until the other day. I have Comodo anti-virus running on this system and it keeps detecting trojware. The location suggest that it is coming from the Plex server. I have been keeping my system updated to the most current version of Plex Server so I am unsure what is going on. Other than that my server has been running fine. Has anyone else had this problem?


#19

Please provide more precise clues. There is no single 'Plex' location.
There are at least a Plex 'program' folder and a Plex 'data' folder.

Knowing the exact folder path would help pinpointing the issue, particularly whether it is a false-postive or a genuine finding which may be caused by an unsupported 3rd-party plug-in.

A good test to recognize false-positives would be to submit the file in question to https://www.virustotal.com where it will get scanned by several dozens of different anti virus engines.


#20

/usr/lib/plexmediaserver/Resources/Plug-ins-b4605f76e/Framework.bundle/Contents/Resources/Versions/2/Python/Framework/api/threadkit.py