Avast antivirus show Malware alarm when starting cocos studio

Maybe it just me but i just download cocos studio and each time i open something my antivirus showing about malware url
the cocos.exe is trying to request .
this is the url :

hxxp://cs.ucenter.appget.cn/csas

here is image attached

See Help me please with cocostudio

I’d say this is a false positive I tried installing with ClamWin enabled and it did not detect anything. I am going to ask our engineering department to have a look at this thread, however.

I’m facing the same problem when trying to do anything in cocos studio. I am not going to use it until there is definitive proof that the website appget.cn does not contain any malware. Hope, it would be resolved soon.

Can you not download it directly from us versus another site? http://www.cocos2d-x.org/download

I did download it from http://www.cocos2d-x.org/download/ . But, after installing, whenever I open cocos studio, or try to do anything (click on tutorial, cocos store, or create a new project, etc. etc.) my antivirus informs me that the app is trying to connect to an infected site: http://cs.ucenter.appget.cn/csas and the infection has been blocked!

Any news?
I have the same problem :frowning:
Is that some kind of repository for the Coco Studio Apps? I guess it cannot be a malware…
I just signaled it as a false positive to Avast…

@sprintingkiwi
Wait for version 3.7 according to @walzer cocos will have major changes in structure / policy / editor .
i guess it will be fixed also as it going to be one of there flagship product .

Ok, I’ll wait. Thank you! :smile:

After having the same issue, a quick investigation into this brought me to the following conclusion. Basically, Cocos is collecting and reporting user statistics to that web address ( cs.ucenter.appget.cn/csas ), in addition to Google Analystics.

What statistics?

-Cocos install ID and version
-OS Name and version + screen resolution
-When you click links in the launcher such as to sign up or add a new plugin.
Note: it does NOT track personally identifiable information, just “hello, I signed up”
-Every time you change a property on an object/widget within the Studio editor, it reports what the new value is
-Exception information in the event of a crash

So with that said, I don’t see anything malicious about it.
However, I don’t remember agreeing to any terms about that kind of tracking.

1 Like

It is known that some tools are collectiong data. And they know that something should be done.


Sadly there wasn’t any update on this.

I think this subject needs to be chill down , 99% of apps in windows are collection data ,
open Wireshark and watch the show of your apps sending data. connect proxy to your mobile and see the apps sending data.cocos team no exception .
as they promise they will add notice to the next version.

I am getting the malware as same. There should be an option to stop sending them.

Where are you downloading from?

The main site. Here the link http://www.cocos2d-x.org/filedown/CocosForWinWithFramework-v2.3.3.exe

Weird, Clamwin doesn’t show anything about malware.

I did scan the file installer and there was nothing. But after the install finish and launch the app. I got the warning. Guessing the coco.exe send out like submit a report. Basic it trying to connect to the internet when launcher or auto start send out url request. That I didn’t like when I saw it was spamming when trying to run simple that well up to 20+ url request.

We do have some metrics that we track to help facilitate development efforts. This is all we use it for. You can disable it if you like in cocos2d.ini

Cocos team should set popup massage window when application is starting , like in visual studio. or adobe or others
that warn the user that information is been sent , and the user will chose what he want.
also Cocos team should talk with the anti virus company’s to removed them from the black list . this is how it works.
even unity ( not pro) is sometimes detected as virus in nod32 antivirus

Nope the cocos2d.ini didn’t work. It will just ignore and tired it search all with ini.