We're calling on all EU-based Mozillians with iOS or iPadOS devices to help us monitor Apple’s new browser choice screens. Join the effort to hold Big Tech to account!

Avatar for Username

Søg i Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Læs mere

Denne tråd blev arkiveret. Stil et nyt spørgsmål, hvis du har brug for hjælp.

Win.MxResIcn.Heur.Gen

  • 1 svar
  • 1 har dette problem
  • 1 visning
  • Seneste svar af James

Łukasz Urbański
Łukasz Urbański
more options

Hi. I'm using Linux Mint 20. I wanted to go back to Windows 10. Under Linux I downloaded the latest version of Firefox. I checked the installation file on the VirusTotal page. VirusTotal showed that the exe file contains the Win.MxResIcn.Heur.Gen trojan and the msi file contains Attention.APT-Bait.ContainShellCode! 1.9E28. Earlier installation files also contained some surprises. I don't think my Linux system contains any viruses. Installations of other browsers such as Opera or Chrome do not have these "add-ons". Interestingly, if I paste the link to the installation file into VirusTotal - there are no surprises. What is going on?

Hi. I'm using Linux Mint 20. I wanted to go back to Windows 10. Under Linux I downloaded the latest version of Firefox. I checked the installation file on the VirusTotal page. VirusTotal showed that the exe file contains the '''Win.MxResIcn.Heur.Gen''' trojan and the msi file contains '''Attention.APT-Bait.ContainShellCode! 1.9E28'''. Earlier installation files also contained some surprises. I don't think my Linux system contains any viruses. Installations of other browsers such as Opera or Chrome do not have these "add-ons". Interestingly, if I paste the link to the installation file into VirusTotal - there are no surprises. What is going on?
Vedhæftede skærmbilleder

Alle svar (1)

James
James
  • Moderator
  • Top 10 Contributor
more options

It is a false positive. If it was truly infected with something it would not have only one result but multiples. Cylance, Antiy-AVL, Clam and Norton has been among a short list that has given plenty of false positives at Virustotal and in AV client over the years with Firefox setups and especially the small stubs for windows.

I checked en-CA 78.0.2 win64 firefox .exe and MaxSecure was green though it was the only one red for en-US locale.

Other locales do not get this single false positive while the en-US may with MaxSecure on Virusetotal based on some research. It looks like it is having the usual issues with 7zS.sfx if you look on details page.

Firefox setups for Windows have been self-extracting 7z since Firefox 0.8 (Feb 2004). 7zS.sfx is the 7-ZIP self extractor stub from 7-ZIP that is used by Mozilla to pack the actual Firefox program with the 7-ZIP archive utility.

ex: https://www.reddit.com/r/privacytoolsIO/comments/gptqzf/windows10_firefox_malware_check/ https://www.reddit.com/r/firefox/comments/hni6cr/is_the_official_firefox_installer_infected_by/

ex: Bug#1468067 - Firefox installer doesn't pass VirusTotal test

Ændret af James den