Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Microsoft Security Essentials detected Google Chrome as a Password Stealer:

PWS:Win32/Zbot

Category: Password Stealer

Description: This program is dangerous and captures user passwords.

Recommended action: Remove this software immediately.

Security Essentials detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the Allow action and click Apply actions. If this option is not available, log on as administrator or ask the security administrator for help.

file:%LocalAppData%\Google\Chrome\Temp\source\Chrome-bin\chrome.exe

I can't tell if it's a particular extension that I tried to synch from my other machine, the chrome application itself, or just a false positive. I've run a full scan on the another machine that Chrome is synched with and nothing was detected.

Should I be worried? What can I do to get rid of it?

share|improve this question
    
Discussion on google chrome forum (which still doesn't have a solution as of this comment posting) google.es/support/forum/p/Chrome/… –  pettys Sep 30 '11 at 15:52

3 Answers 3

up vote 8 down vote accepted

As a workaround for now, the current Chrome Beta doesn't trip the MSE stuff.

UPDATE: Microsoft confirms it's a false positive and releases a fix, read about it.

share|improve this answer
    
Thank you pettys. I couldn't find very much about it this morning (GMT). –  PabloC Sep 30 '11 at 17:44

This is how I fixed it:

  1. Delete the entire Chrome directory under %LocalAppData%.
  2. Download the Google Chrome installer using another browser.
  3. Disable Microsoft Security Essentials.
  4. Install Google Chrome.
  5. Enable Microsoft Security Essentials.
share|improve this answer

I do believe Chrome launches its extensions in a secured environment within itself.

I would disable/delete all your extensions and scan the same file. If it is not detected as the same file, then an extension is the cause, and could be a real threat.

Of course MSE does use behavioral detection, so the chances of it beng a false positive is very high, I would simply use a website that uses several scanners to verify the file.

PWS:Win32/Zbot is also a generic threat.

share|improve this answer

protected by Community Sep 30 '11 at 15:48

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.