New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 778121 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

Chromium is detected as malware by several programs (injection type malware).

Reported by gigabyte...@gmail.com, Oct 25 2017

Issue description

Chrome Build         : 511377
URLs (if applicable) : https://download-chromium.appspot.com; https://www.virustotal.com/en/file/7cb235d530c73c3076c7a08f9aa6be77e5703288683fc7dba0a148209c69e4ae/analysis/1508910570/

What steps will reproduce the problem?
(1) Extract chrome-win32.zip or open chrome.exe

What is the expected result?
Chromium will extract or launch

What happens instead?
My antivirus detects malware in the latest build of chromium (chrome.exe and UI test).
12/66 antivirus also detect the malware in chrome.exe on virustotal.
The mini installer does not cause any issues.

Please provide any additional information below. Attach a screenshot if
possible.

 
virus.PNG
22.2 KB View Download
After running for a while, my antivirus has blocked the mini installer files as well. I don't know about the appspot link but the mini installer came from the google APIs.
Components: Services>Safebrowsing
Labels: Needs-Milestone Needs-Feedback TE-NeedsTriageHelp
Could you please confirm is this issue is seen only with chromium browser? How about chrome market builds?  Re routing to services team for further triage.

Could some one look in to this issue?

Thanks!

Labels: -Pri-3 SafeBrowsing-Triaged Pri-2
Owner: vakh@chromium.org

Comment 4 by vakh@chromium.org, Oct 27 2017

Cc: mjcastner@google.com
+mjcastner -- let's discuss this offline.
This issue only occurs with Chromium, which is the browser I want to use. Google Chrome Stable, Beta, Dev and Canary have no issues when it comes to antivirus.
Project Member

Comment 6 by sheriffbot@chromium.org, Oct 29 2017

Cc: brajkumar@chromium.org
Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "brajkumar@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Just to clarify, I still cannot install chromium even after updating my antivirus. It is still detected. If I use the mini installer, before chrome.exe is detected as malware, I get this message from AV:
Bitdefender moved a threat to quarantine. File name: c:\users\ispl0it3r\appdata\local\temp\scoped_dir11452_2616\d11452_10000\default\cache\index. It is recommended that you run a System Scan to make sure your system is clean.

Comment 9 by vakh@chromium.org, Oct 30 2017

Thanks for the detailed analysis.
Please know that I am working with VirusTotal to resolve this but since it has third-party dependencies, it is somewhat complicated and slow.

Comment 10 by vakh@chromium.org, Oct 30 2017

Labels: -TE-NeedsTriageHelp -Needs-Milestone M-62
Status: Started (was: Unconfirmed)

Comment 11 by vakh@chromium.org, Oct 31 2017

The number of false positives have dropped from 12 to 1. See https://www.virustotal.com/en/file/7cb235d530c73c3076c7a08f9aa6be77e5703288683fc7dba0a148209c69e4ae/analysis/
My antivirus is updating, hopefully fixing the problem. It may still be an issue to fix the false positive from CAT-QuickHeal but if the antivirus companies have fixed it themselves, then it is in their hands, not yours.

Comment 13 by vakh@chromium.org, Nov 1 2017

Status: Fixed (was: Started)
All cleaned up: https://www.virustotal.com/en/file/7cb235d530c73c3076c7a08f9aa6be77e5703288683fc7dba0a148209c69e4ae/analysis/

Marking as Fixed.
Thank you very much.

Sign in to add a comment