topic Re: Chrome Extension being flagged as a virus in Gmail Sales Extension

Chrome Extension being flagged as a virus

salesguy2 — Tue, 30 Aug 2022 15:49:02 GMT

I have Kaspersky Security as antivirus and have the Hubspot Sales Chrome Extension on Windows 10. This morning Kaspersky identified a few Javascript files as Trojans. Poking around, it looks like these files belong to the Hubspot Sales Extension (path C:\Users\{my_user}\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd\2.9.0.6826_1\js\init, the files are background.js, gmail.js, Background.js, and Gmail.js). According to the Chrome web store, the extension (link HubSpot Sales - Chrome Web Store (google.com)) was updated yesterday to version 2.9.0.6826. Given the timing, it seems likely that there was something in this update that caused the extension to be flagged as a Trojan, but it also seems possible that this is a legitmate virus. Is anyone else running into this? Can someone else who has the chrome extension on Windows confirm that they also have these files? Is there a better place to post this issue? Thanks

Re: Chrome Extension being flagged as a virus

Jnix284 — Wed, 31 Aug 2022 02:17:08 GMT

Hi @salesguy2 I'm on a mac, so I'm not sure where to see the js files associated with the extension, but I have the latest version and I don't have any trojan viruses...☠️

Re: Chrome Extension being flagged as a virus

MohsenKhosravi — Wed, 31 Aug 2022 07:38:14 GMT

Hi, I have the same problem too.

I don't know if it is because of recent Kaspersky update or because of Hubspot extension update.

Anyway from yestreday, I have permanently received Trojan warning and Kaspersky blocks Hubspot extension from working.

Re: Chrome Extension being flagged as a virus

salesguy2 — Wed, 31 Aug 2022 08:43:51 GMT

Ok good to know that others are seeing it too. Someone else I know also ran into the same issue (running Windows 10, Kaspersky, and Hubspot extension). I assume it can be allowlisted from File Anti-Virus in Kaspersky (haven't tried though because I deleted the extension.)

Re: Chrome Extension being flagged as a virus

mikebang — Wed, 31 Aug 2022 14:04:34 GMT

We are also having the same issue with Kaspersky flagging HubSpot Sales 2.9.0.6826 chrome extension as malware/virus HEUR:Trojan.Script.Generic Trojan.Script.Generic.4!c

In particular it appears background.js and gmail.js are the files in the extension which is being flagged.

Kaspersky deletes the file(s) to disinfect it thus rendering the extension unusable/corrupt by chrome. The moment chrome loads again to fix the corruption, the extension is re-downloaded from the chrome web store and the process repeats itself.

Re: Chrome Extension being flagged as a virus

CBader — Thu, 01 Sep 2022 14:43:10 GMT

We had this issue also. Here is the explanation from HubSpot support:

Google changed their requirement for Chrome extension to Manifest 3, and non-Manifest 3 extensions will be turned off at the beginning of next year. Because of this, at the beginning of this week, our team made some changes as one of the first steps to convert the chrome extension to Google's required Manifest 3 version. As part of that requirement, an extension cannot download additional components as needed as a partial install, but must install the entire extension as one package.

Due to this, our extension went from being a 2MB install to a 22 MB install, and this pinged Kaspersky as a problem. Having such a huge change in file size was flagged by Kaspersky as a reason to believe that the extension had added malware, which isn't the case.

HubSpot support said they were working with Kaspersky to clear up the confusion.

As of this morning, Kaspersky no longer flags the HubSpot Sales Chrome extension as malware. There is no longer any need to add a folder scan exclusion in Kaspersky (allowlisting).

Hope this helps those who were affected by this!

Re: Chrome Extension being flagged as a virus

TitiCuisset — Mon, 05 Sep 2022 12:20:03 GMT

Hi @CBader

Thank you for sharing this with the community!

Best

Tiphaine

Re: Chrome Extension being flagged as a virus

JKashmire — Fri, 19 Jul 2024 11:08:22 GMT

This happened to me as well, and I think it's likely due to recent changes to comply with Google's requirements.

Re: Chrome Extension being flagged as a virus

JKashmire — Fri, 26 Jul 2024 09:44:48 GMT

I know that Kaspersky flagging the Hubspot Sales Chrome Extension after an update could be a false alarm because of the changes in the extension's size and structure.

Re: Chrome Extension being flagged as a virus

JKashmire — Mon, 29 Jul 2024 19:19:49 GMT

But, to be safe, you should run a full scan. If you’re worried about malware, this malware removal guide could help. It's a good resource from an IT security expert to check for any harmful stuff on your system.