1382573 - ESET reports Firefox Unbranded Installer as containing a trojan

Status: RESOLVED WORKSFORME

(Release Engineering :: Release Automation: Other, defect)

Description

[erosman]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Build ID: 20170623154118

Steps to reproduce:

ESET Smart Security reports and cleans firefox-54.*.en-US.win32-add-on-devel.installer as having "Win32/Spy.Ursnif.BH trojan"

Comment 1

[Chris AtLee [:catlee]]

Looking at http://archive.mozilla.org/pub/firefox/tinderbox-builds/mozilla-release-win32-add-on-devel/1496944705/firefox-54.0.en-US.win32-add-on-devel.installer.exe

https://www.virustotal.com/en/file/030a0db380d884b05b384621145ea4b1a2119cee13bf4135e04fe0d34adde039/analysis/

1/64 scanners detected an issue.

Most likely a false positive, we've hit those before. Will continue to investigate.

Comment 2

[Chris AtLee [:catlee]]

bugs 1181116, 1247732 are other recent false positive reports.

Comment 3

[erosman]

It is a false positive since I had already downloaded and installed those versions before. It has recently been added to ESET detection list.

The versions that I have on HD are FF54.0 b2 & b6
firefox-54.0.en-US.win32-add-on-devel.installer.exe

Comment 4

[Chris AtLee [:catlee]]

refreshing the scan adds one additional identification:
https://www.virustotal.com/en/file/030a0db380d884b05b384621145ea4b1a2119cee13bf4135e04fe0d34adde039/analysis/1500556899/

 Malware.Heuristic!ET#82% (cloud:EgKJNdohKwU)

Comment 5

[Chris AtLee [:catlee]]

ESET on virustotal now reports that this file is safe.

Comment 6

[erosman]

> ESET on virustotal now reports that this file is safe.
I updated the virus database an hour ago and it is still marking them as unsafe.
Virus signature database version 15798 (20170724)