Solved ESET Antivirus detected a potential threat in Winzip Utilities

[3Colors]

Hi all, there is something that ESET detected as a potential threat and I'm not sure which option to take: disinfect it or to ignore it (as this within Winzip folder)
If this within Winzip folder, which I installed from a CD (not downloaded from internet). So it is false or positive ?

I was using the pc as usual, then turn off the monitor (approximately 30 minutes), I turn it on again and i see that message.

 

[Gator]

Hi all, there is something that ESET detected as a potential threat and I'm not sure which option to take: disinfect it or to ignore it (as this within Winzip folder)
If this within Winzip folder, which I installed from a CD (not downloaded from internet). So it is false or positive ?

I was using the pc as usual, then turn off the monitor (approximately 30 minutes), I turn it on again and i see that message.

I believe that is a false positive but you can check.

You can use an online service such as Online MD5|SHA1 Hash Generator For File And Text

At the top right you can browse to the file in question.

Go here Malware scan of WINZIPSSRegClean.exe (WinZip System Utilities Suite) 2e498be0979ea3d16fc25812c29ba7c37a2ac69b - herdProtect and compare md5/sha1 hash. Towards the bottom there is a list of more sha1 hash's for different versions of WinZipSSregclean.exe

If your sha1/md5 don't match with any of them, its possible the file is corrupted in some way.

 

[Jacee]

Registry cleaners are not recommended for any Windows versions .... are you experiencing malware?

 

[3Colors]

Gator : Wow, a little confused there.

Jacee : The Winzip come from a cd of drivers. So I'm not sure if it's virus. I downloaded, installed and uninstalled the CCleaner. Never use it.

 

[Gator]

Gator : Wow, a little confused there.

Jacee : The Winzip come from a cd of drivers. So I'm not sure if it's virus.i downloaded, installed and uninstalled the CCleaner. Never use it.

Sorry I wasn't clear enough. Basically I was going to have you check the hash because if in some way your file has been changed (ie malicious code was added) the hash would be different.

Either way, I believe this is a false positive however you can delete it if you don't use it. It's up to you.

 

[3Colors]

There will be no problem disinfect it and then uninstall it(Winzip)? Since I have installed 7-Zip

It may be that with each new update of antivirus detects something that is hidden ?

Because at the end of last year also in the same way, when I came back after several minutes, I saw this message.
I clicked on disinfect.

 

[Gator]

Yes you can delete it, in fact, if you have 7zip, you can get rid of everything that has to do with WinZip.

A good program to use to uninstall programs from your PC is Revo Uninstaller
Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Find WinZip in the list of programs
Click Uninstall
Click Advanced
Click Next
Select All entries and delete them in the next two windows that pop up
Then click finish

WinZip should be completely removed.

 

[3Colors]

Right now I'm running the antivirus and it detected something...

 

[3Colors]

In the first message I clicked disinfect. Now i see this.

 

[Gator]

In the first message I clicked disinfect. Now i see this.

You can go ahead and let your av program delete that and uninstall WinZip. I'm still under the impression that its most likely a false positive but pretty close to a PUP one way or the other.

 

[3Colors]

I will run the antivirus in the three ways to explore...

 

[Gator]

I will run the antivirus in the three ways to explore...

If you get anything other than the WinZip file, I would also run Malwarebytes and AdwCleaner

(This link will start the download)
https://www.malwarebytes.org/mwb-download/

and AdwCleaner
AdwCleaner Download

If you need help running them just let me know. Post the logs here after they finish.

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[andrew129260]

Eset is a very aggressive program. (Not that this is a bad thing!)

It will mark any program that includes pups (potentially unwanted program) like toolbars etc as a threat. You need to decide if you really trust the application you are installing.

Anything like registry cleaners or optimizers should always be avoided.

 

[Layback Bear]

I could also be flagging something WinZip compressed. Another zipped up program, file or folder.

 

[3Colors]

Eset is a very aggressive program. (Not that this is a bad thing!)

It will mark any program that includes pups (potentially unwanted program) like toolbars etc as a threat. You need to decide if you really trust the application you are installing.

Anything like registry cleaners or optimizers should always be avoided.

I could also be flagging something WinZip compressed. Another zipped up program, file or folder.

The Winzip came from a cd of drivers (which has expired). Now, I not know why that message appears when the program already has a year of being installed ?

That virus is severe to the point of having to restore all the system files ?

 

[andrew129260]

Upload it to virus total.

https://www.virustotal.com/

See what it reports. Most likely a False positive. And since it was a cd, it is very unlikely the files got messed with. Assuming they were virus free when they were burned.

 

[3Colors]

I think it has been removed. I do not see it in the folder.

When installing, maybe those utilities were marked for installation as well.

 

[3Colors]

If you get anything other than the WinZip file, I would also run Malwarebytes and AdwCleaner

(This link will start the download)
https://www.malwarebytes.org/mwb-download/

and AdwCleaner
AdwCleaner Download

If you need help running them just let me know. Post the logs here after they finish.

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

In the three modes I did not find anything.

I could also be flagging something WinZip compressed. Another zipped up program, file or folder.

I did not quite understand

Upload it to virus total.

https://www.virustotal.com/

See what it reports. Most likely a False positive. And since it was a cd, it is very unlikely the files got messed with. Assuming they were virus free when they were burned.

How the files get messed ?



Two final questions:
- That message appeared because the program wanted auto run. ¿ Right ? And change something in the windows folder ?
- And I need change passwords or other things ?



I will mark as solved the issue as the "virus" was eliminated. Thank all for following this topic.

 

[Layback Bear]

If Winzip zipped up something that was infected the anti virus could be picking up the zipped up file and not Winzip itself.

Find the files that are zipped and right tick on them and choose to scan them one at a time.

 

[3Colors]

I was out there looking for information about what ESET detected it. And seems other users happened the same situation (https://forum.eset.com/topic/3125-cwindowsinstaller4a824msi-is-this-a-false-positive/)

It seems that the last update I detect the file as virus.


What do you think ?