Description: Hi, May I trust LibreOffice_6.1.4_Win_x64 if a trojan is detected in the help pack? I download them from : http://download.documentfoundation.org/libreoffice/stable/6.1.4/win/x86_64/LibreOffice_6.1.4_Win_x64_helppack_fr.msi and from https://www.libreoffice.org/donate/dl/win-x86_64/6.1.4/fr/LibreOffice_6.1.4_Win_x64.msi Thank you very much Steps to Reproduce: 1.download in/from a windows computer under W10 V 1809 with edge 2. 3. Actual Results: smartscreen complain. And if a force the download, windows defender delete the msi file Expected Results: good downlaod Reproducible: Always User Profile Reset: No Additional Info: from windows defender : webfile: C:\Users\noel\Downloads\LibreOffice_6.1.4_Win_x64_helppack_fr.msi|https://mirror.cyberbits.eu/tdf/libreoffice/stable/6.1.4/win/x86_64/LibreOffice_6.1.4_Win_x64_helppack_fr.msi|pid:4784,ProcessStart:131906539640813010 file: C:\Users\noel\Downloads\LibreOffice_6.1.4_Win_x64_helppack_fr.msi->libreoffice1.cab->bookmarks.js containerfile: C:\Users\noel\Downloads\LibreOffice_6.1.4_Win_x64_helppack_fr.msi
We would need to know the actual mirror your download came from. Otherwise you should verify the HASH value(s) of your download. Dispose of if it does not match the published HASH (any or all SHA256, SHA1, or MD5) and review the Properties -> Digital Signatures of these signed installers. If they don't match, or look suspect delete and download again until they do. https://downloadarchive.documentfoundation.org/libreoffice/old/6.1.4.2/win/x86_64/LibreOffice_6.1.4.2_Win_x64_helppack_fr.msi.mirrorlist https://downloadarchive.documentfoundation.org/libreoffice/old/6.1.4.2/win/x86_64/LibreOffice_6.1.4.2_Win_x64.msi.mirrorlist
hello, i download from : https://mirror.cyberbits.eu/tdf/libreoffice/stable/6.1.4/win/x86_64/LibreOffice_6.1.4_Win_x64_helppack_fr.msi Each time i put this link in the bar address of Edge, i get "warning : virus". Please, can you try this link? Thank you
OK, confirmed. Using the mirror indicated. Overriding the Edge download, a local Windows Defender AV scan hits on Win32/Spursint.F!cl and then deletes the installer package before I can check HASH. identifies this path in the package: file: C:\Users\vsfoote\Downloads\LibreOffice_6.1.4_Win_x64_helppack_fr.msi->libreoffice1.cab->bookmarks.js Download same MSI directly from projectarchive and it scans clean and matches HASH. Email sent to officesecurity@lists.freedesktop.org
Mike, you have solved the same problem with Avast, or not the same?
Well - downloading from the URL indicated in comment 2 today, I get the file that has checksums identical to those at http://downloadarchive.documentfoundation.org/libreoffice/old/6.1.4.2/win/x86_64/LibreOffice_6.1.4.2_Win_x64_helppack_fr.msi.mirrorlist I use Windows Defender, and it doesn't throw any detections (possibly because of signatures updated since comment 3, or maybe the mirror now has the proper file?). So either the mirror is fixed, or that was a false positive. Closing WORKSFORME.