My win10 thinks u2 "direct download " (google drive) has a virus

[mstram]

my win10 thinks u2 "direct download " (google drive) has a virus

It’s deleting the file after I download it saying it has the “Oneeva.Alml” trojan script

[Quasi_Stellar]

Download it to a folder you exclude from windows defender

[LorikEolmin]

One day Win10 will call itself a virus and erase itself. That’s probably the day Win11 is out.

[hoover]

I wonder why people still bother with AV at all, it just doesn’t seem worth the trouble and complications. I’m using Linux for most productivity stuff and fire up win10 mostly for BMS (not everything works as smoothly as I would like to on my WINE setup yet) and rfactor2, all the productivity stuff happens on Linux 100% of the time. Heck, if you use some common sense while browsing, handling email and downloading stuff with some decent browser extensions (ublock, flashblock, privacy badger for vivaldi in my case) and use a non-admin account you should be pretty safe even on a win10 system these days. I really don’t see what AV would add apart from lulling you into a false sense of security because “Microsoft handles this for me” (or insert your AV “dealer” of choice here :))

All the best,

Uwe

[airtex2019]

This is just crazy … the zip file Seifer posted a few days ago is still present in my Downloads folder. At the time, I got no warnings upon download with MS Edge … and I unzipped it and scanned the directory explicitly, then … no problems.

Today, opening that same zip file triggers Defender detecting Trojan:Script/Oneeva.A!ml and it got moved away to quarantine.

There is/was only one file inside that zip, the exe for the U2 installer.

I already had that zip file extracted, again, still sitting in my Downloads folder. I just did an explicit scan on it, and Defender found “no problems”.

What the heck is going on…

Is it remotely possible a random series of bytes in the zip file is triggering a false positive match for a virus (apparently a new one updated in the last few days)?

I just re-zipped the EXE (using builtin Windows shell send-to compressed file command) and it doesn’t seem to trigger AV.

[Jackal]

@LorikEolmin:

One day Win10 will call itself a virus and erase itself. That’s probably the day Win11 is out.

Hope this day come soon, bro.

So we can begin to fight 11 at last.

With best regards.

[airtex2019]

For the avoidance of doubt, I uploaded Seifer’s zip file to VirusTotal for a comprehensive scan … no problems found.

https://www.virustotal.com/gui/file/4d7cbfa67afbb14ccac7f50ecd2998e9e8d5dbc2d53a7bbf9e70f05d6457c285/detection

Including a green check mark from “Microsoft” so what the heck is going on… I don’t know.

[airtex2019]

A few minutes of googling “Oneeva” turns up a few similar false positives, in zip files, over the past couple years … releases from github, and firefox browser extensions, and other presumably trustworthy sources. Always in the zip itself, not the unzipped payload.

Don’t know what it is about this particular virus/trojan, and zip files, and Windows Defender … and apparently it’s a Linux trojan ffs. So, a very very false positive.

[Seifer]

For the record, my zip was the same one used for seeding the torrent. One can md5 it to confirm.

[airtex2019]

For the updates, the torrent distribution is just the raw EXE right? (Falcon_BMS_4.35.2_Incremental.exe) No problems there, the Oneeva false positive seems to come from the zip file itself, not the contents.

The irony here is not lost on me … in another similar thread I made a case to stop distributing unsigned EXE files, just ZIP files, to avoid browser-download warnings and flagging.

Sigh, now this… Apparently there’s just no winning.