5

I downloaded FileZilla from SourceForge on February 16, install was OK, but recently my antivirus said that the file contains a virus (MalSign.Generic.550). Previously there was no notification about a virus in this software. Is it a false positive or does FileZilla contain a virus?

enter image description here

I'm using Free AVG with latest database update.

4
  • 2
    You tell us. Submit the file to VirusTotal if more then 30% register it as a virus then thats likely an accurate detection. Its worth pointing out AVG has a high false detection rate. I wouldn't trust it to protect my worst enemies computer.
    – Ramhound
    Feb 27, 2014 at 5:03
  • Switch out AVG with Avast! Antivirus.
    – Jon
    Feb 27, 2014 at 5:52
  • 1
    Just don't use AVG... Too many bad experiences. Feb 27, 2014 at 14:49
  • After years of using it, i've decided to remove it .. it become very fishy and looks like it has a maleware .. the same notification came from ESET as well. Mar 19, 2018 at 10:56

8 Answers 8

13

No. IF you get the file from https://filezilla-project.org/, you are safe.

If you get filezilla from other site, maybe, could be infected.

https://blog.avast.com/2014/01/27/malformed-filezilla-ftp-client-with-login-stealer/

Malformed FileZilla FTP client with login stealer

Beware of malformed FileZilla FTP client versions 3.7.3 and 3.5.3. We have noticed an increased presence of these malware versions of famous open source FTP clients.

The first suspicious signs are bogus download URLs. As you can see, the installer is mostly hosted on hacked websites with fake content

Malware installer GUI is almost identical to the official version. The only slight difference is version of NullSoft installer where malware uses 2.46.3-Unicode and the official installer uses v2.45-Unicode. All other elements like texts, buttons, icons and images are the same.

The installed malware FTP client looks like the official version and it is fully functional! You can’t find any suspicious behavior, entries in the system registry, communication or changes in application GUI.

The only differences that can be seen at first glance are smaller filesize of filezilla.exe (~6,8 MB), 2 dll libraries ibgcc_s_dw2-1.dll and libstdc++-6.dll (not included in the official version) and information in “About FileZilla” window indicates the use of older SQLite/GnuTLS versions. Any attempt to update the application fails, which is most likely a protection to prevent overwriting of malware binaries.

Edit August, 06 2014 : As rmflow say, SourceForge is not trusted source anymore, so I edit this to remove the reference

3
  • This is the only worth while answer to this question. Good Work
    – Ramhound
    Mar 15, 2014 at 23:06
  • 1
    Just a note - getting file from trusted source doesn't make it "auto-magically" safe. There are known cases of infected files being distributed from official sites. Jun 19, 2014 at 5:25
  • 1
    SourceForge is no longer a trusted source, see sourceforge.net/blog/…
    – rmflow
    Jun 24, 2014 at 8:08
9

SourceForge is wrapping the actual program in a crapware installer. This might well trigger your AV scanner.

To circumvent this, select the "Show additional download options" link on the FileZilla homepage. The link on this page has the ?nowrap parameter and should be free of unwanted additions.

3

Quick analysis

In this case the antivirus warning was probably triggered by some generic malware signature, hence the name MalSign.Generic.550.

Scanning the FileZilla_3.7.4.1_win32-setup.exe file with VirusTotal doesn't detect anything, meaning that AVG probably fixed the issue in the meanwhile.

Keep in mind that even if some file comes up clean from multiple antivirus scans, that doesn't necessarily mean that the file is 100% safe, rather than no antivirus was able to find anything malicious.

Conclusion

AVG has just too many false positives. Consider getting an alternative.

Also, make sure to always get the programs from the official site, and avoid SourceForge whenever possible: since July 2013 the site started encouraging top projects in using a custom installer bundled with adware/spyware (or otherwise useless garbage).

Further reading

1

It is the setup installer from SourceForge. Try downloading the .zip instead. There is no problems with AVG and the .zip of FileZilla.

0

I had to delete filezilla from two different vm machines as the installer was installing hooks which caused vmware to slow down and consistantly reboot the os. If its the installer or not doesn't concern me, as the opensource community is responsible for both. I'd be very wary in anything downloaded by sourceforge as any bad apple can seed files to their hearts content.

-1

Well I'll just start by saying, I'm using AVG AntiVirus Free Version 2013.0.03462. Virus database version 3722/7168(Saturday, 8 March 2014, 6:40PM). I just now checked via its interface panel and it says my AVG is up-to-date.

I downloaded 'FileZilla_3.7.3_win32-setup.exe' from SourceForge and AVG is repeatedly nagging me that it's infected with 'MalSign.InstallCore.AFD'. Searched that exact term on the AVG website - returned nothing useful.

I downloaded 'FileZilla_Server-0_9_43.exe' from SourceForge and it is fine - nothing picked up by AVG.

I downloaded 'FileZilla_3.7.4.1_win32-setup.exe' from Softpedia and it is fine - no virus warning from AVG.

I then downloaded another copy of 'FileZilla_3.7.4.1_win32-setup.exe' (which I have renamed to allow being in the same folder) from the filezilla-project org as mentioned above which redirects back to SourceForge for the actual download link.

All these files I have sitting in the same folder and AVG is scanning them in the background because periodically it pops up its screen telling me there is a virus in version 3.7.3 but none of the others.

Interestingly the file size of version 3.7.3 is showing as 645kb, but version 3.7.4.1 is showing as 4710kb - a significant difference. I think there is something wrong with the 3.7.3 version file from SourceForge.

Finally I used a Shell Extension Scan of the same folder and AVG again detected a problem only with the version 3.7.3 file in there. So I think just delete that file and get a 'clean' copy of version 3.7.4.1.

I would agree however that AVG has sometimes been problematic as I have experienced some of it's occassional false positives.

-1

It's Sourceforge autodownloading an infected file. If you use the direct link, it's fine. And to be honest, I'd rather have a false positive than enter client ftp details into a phishing app. All it did was make me actually look twice, and get a clean version. If it hadn't, who knows what damage could have been done.

-2

I test ran the sourceforge version, I'm thinking AVG was picking up on the bloat/spyware it "encourages" you to install. If you decline a few spyware programs, it downloads the actual filezilla installer. Due to it basically trying to install spyware and only downloading the real file, I think that's why it shows as an installcore virus. I'll run a virus scan now that JUST the filezilla is installed and see if it picks up anything, but I'm suspecting not

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .