Jump to content

Virus detected on image from imgburn.com +/ SHA-1 does not match from other sites


Recommended Posts

Posted

Hi!

(" My") Windows 10 Security detected a virus when downloading v2.5.8.0 from imgburn.com - and thus the downloaded file is immediately discarded. This does not happen when downloading from other mirrors - I tested 4 of them.  In addition, neither CRC32 nor SHA-1 match the value stated in your downloading page.

Posted

Which mirrors did you use?  There are 7.  Always choose Mirror 7 if you didn't choose it before.  That's one maintained by ImgBurn.com and the least likely to be altered by the other providers to include PUP's.

Posted

Hi! The site from where I downloaded (what it seems to be a v.2.5.8.0 infected by threat according to Windows 10 Defender) is indeed the mirror 7, managed by imgburn.com. As I have told, Edge have destroyed it before I had access to it.

Using the same tools - and the same browsing section -, I tried other mirrors to download v.2.5.8.0. They were: majorgeeks (mirror 6), techspot (5), free-codes (4) and softpedia (3). They all passed the Windows Defender screening and they all delivered the same image (i.e., all presented the same SHA-1 value). Nonetheless, the SHA-1 value does not match the one presented at the download page. The software used to calculate SHA-1 belongs to 7-zip, v19.00.

Posted

Sure would have been nice of Microsoft to actually SAY what the virus was.  Without it saying, there's no way of knowing if it's an actual virus or just a PUP positive.

 

I downloaded the file from Mirror 7 and scanned it with Avast and Malwarebytes with no positive results.  So, Microsoft is most likely detecting some Potentially Unwanted Program (PUP).  They're not viruses but people blindly click and install them.  Some AV programs are lazy and don't differentiate between viruses and PUP's.

 

As for the hash discrepancy, LUK might have had to put in a replacement for OpenCandy, the PUP, which was discontinued.  And he just forgot to update the SHA value on the page.  Until he chimes in on the subject, it's up for debate.

Posted

Yep, just as I thought.  It's a PUP.  They're not viruses.  LUK must have updated the installer package to replace OpenCandy with something else?  Anyway, you could normally avoid it, but your AV scanner is deleting the file before it can be used.  I don't know anything about Windows Defender, so I can't tell you how to exclude the file.  Just be aware when you run the installer to uncheck things you don't want installed along with ImgBurn.  Or, before running the installer if you ever get it, turn off your Internet connection until the installer in finished.  That way, it can't phone home to a server for free offers.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.