1

I am helping a friend install OneNote 2013 64-bit on their Windows 7 (64-bit, SP1) system.

We went to the official Microsoft OneNote website, www.onenote.com, clicked on 'Windows' (just to the right of 'Get OneNote for free on all your devices'), then clicked on 'Other download options' towards the bottom of the page. This displays a 'Free Download' link, which, when clicked, downloads the MS installer for the 64-bit version.

The URL of the installer is:

https://c2rsetup.officeapps.live.com/setuponenotefreeretail.x64.en-us_.exe

We scanned the downloaded file using Avast 2015, and there were no problems reported. We then ran the program, and Avast brings up its big alert stating "Virus Found" (object: onenote.exe, process: officeclicktorun.exe). The infection name is "Win64:Malware-gen".

Can other people try this out and see what happens. We are not sure how to proceed at this point. How do you tell if this is an infection or a false positive?

  • Just in case this doesn't get answered and someone comes along looking for information about this, it appears this has been cross-posted on the Avast forums. – apnorton Nov 2 '14 at 4:31
  • @anorton Can you try it out and see what happens? – spaghetti Nov 2 '14 at 4:56
  • virustotal.com/en/url/… virustotal has this down as 0/60 detection rate... – Rоry McCune Nov 2 '14 at 12:16
  • @RоryMcCune Thank you for running that scan. Unfortunately, virustotal only scans the installer, and not what the installer downloads and actually installs. – spaghetti Nov 2 '14 at 18:34
1

This appears to be an issue with the Generic/Heuristic detection in Avast. It has been raised by others in Avast forum as well : https://forum.avast.com/index.php?topic=158789.0

https://forum.avast.com/index.php?topic=152101.0

Since the download link you posted is legitimate, it is less likely that it is a malicious download. It can be confirmed by scanning the downloaded file on virustotal.

The only possible reason I can think of is a possible false positive trigger. there are some known malwares that affect OneNote, but these infections are on machines which have OneNote pre-installed. http://answers.microsoft.com/en-us/office/forum/office_2007-onenote/onenote-related-malware-plants-sirefefn-trojan/32a25d09-5ad4-45d3-abc0-6b9a97b601d3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.