Kaspersky Threat Intelligence Portal
Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses
Malicious 7-Zip site distributes installer laced with proxy tool
- Thread starter Parkinsond
- Start date
Still working on Windows 20007-Zip version 26.00 (stable release)
7-Zip / Discussion / Open Discussion: 7-Zip 26.00
sourceforge.net
And is detected as malicious by MD
Attachments
@Parkinsond
No MD flag here (all ASLR rules enabled), maybe a virus definitions database update. latest 1.445.13.0
No MD flag here (all ASLR rules enabled), maybe a virus definitions database update. latest 1.445.13.0
Already posted K result before
Kaspersky Threat Intelligence Portal
Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses
@Parkinsond
Warning from MD : " Microsoft Defender SmartScreen has prevented an unknown app from starting. Running this app may pose a risk to your PC ."
Warning from MD : " Microsoft Defender SmartScreen has prevented an unknown app from starting. Running this app may pose a risk to your PC ."
No mention of SmartScreen on my side.
It was blocked before landing on my drive (using Chrome, not Edge) even before trying to execute and SmartScreen could kick in.
In addition, I have Edge uninstalled.
@Parkinsond
SM-S AND MD are in the same boat, anyway it's a false positive
SM-S AND MD are in the same boat, anyway it's a false positive
@7Oz-64
or the website is compromised and the installer is tampered.
It is not the first time for MD to flag 7-Zip freshly released installer.
To keep on the safe side, I delete the installer and redownload it again a week later.
During such a period, if the website was compromised, it would be discovered and fixed.
If the problem the young age of the installer, it would not be considered young then anymore.
or the website is compromised and the installer is tampered.
It is not the first time for MD to flag 7-Zip freshly released installer.
To keep on the safe side, I delete the installer and redownload it again a week later.
During such a period, if the website was compromised, it would be discovered and fixed.
If the problem the young age of the installer, it would not be considered young then anymore.
Last edited by a moderator:
Indeed and even their own provider Cloudflare warns about them, but it does not block them, because it is technically safe, for now. Maybe it was hacked?!
That is a common behavior detection, usually false, I have seen it many times, especially when related to questionable apps like Nirsoft, ProcessHacker or games.
You may also like...
-
Google's 7-year slog to improve Chrome extensions still hasn't satisfied developers- Started by oldschool
- Replies: 9
-
-
MThreat actors misusing Quick Assist in social engineering attacks leading to ransomware
- Started by Microsoft Threat Intelligence
- Replies: 0
-
Harmony Endpoint by Check Point
- Started by Trident
- Replies: 704
-
Harden Windows Security | Only with official documented methods | Always up to date- Started by SpyNetGirl
- Replies: 76