2

I am helping a friend install OneNote 2013 64-bit on their Windows 7 (64-bit, SP1) system.

We went to the official Microsoft OneNote website, www.onenote.com, clicked on 'Windows' (just to the right of 'Get OneNote for free on all your devices'), then clicked on 'Other download options' towards the bottom of the page. This displays a 'Free Download' link, which, when clicked, downloads the MS installer for the 64-bit version.

The URL of the installer is:

https://c2rsetup.officeapps.live.com/setuponenotefreeretail.x64.en-us_.exe

We scanned the downloaded file using Avast 2015, and there were no problems reported. We then ran the program, and Avast brings up its big alert stating "Virus Found" (object: onenote.exe, process: officeclicktorun.exe). The infection name is "Win64:Malware-gen".

Can other people try this out and see what happens. We are not sure how to proceed at this point. How do you tell if this is an infection or a false positive?

Improve this question
4
  • Just in case this doesn't get answered and someone comes along looking for information about this, it appears this has been cross-posted on the Avast forums.
    – apnorton
    Commented Nov 2, 2014 at 4:31
  • @anorton Can you try it out and see what happens?
    – spaghetti
    Commented Nov 2, 2014 at 4:56
  • virustotal.com/en/url/… virustotal has this down as 0/60 detection rate...
    – Rory McCune
    Commented Nov 2, 2014 at 12:16
  • @RоryMcCune Thank you for running that scan. Unfortunately, virustotal only scans the installer, and not what the installer downloads and actually installs.
    – spaghetti
    Commented Nov 2, 2014 at 18:34

1 Answer 1

Reset to default
1

This appears to be an issue with the Generic/Heuristic detection in Avast. It has been raised by others in Avast forum as well : https://forum.avast.com/index.php?topic=158789.0

https://forum.avast.com/index.php?topic=152101.0

Since the download link you posted is legitimate, it is less likely that it is a malicious download. It can be confirmed by scanning the downloaded file on virustotal.

The only possible reason I can think of is a possible false positive trigger. there are some known malwares that affect OneNote, but these infections are on machines which have OneNote pre-installed. http://answers.microsoft.com/en-us/office/forum/office_2007-onenote/onenote-related-malware-plants-sirefefn-trojan/32a25d09-5ad4-45d3-abc0-6b9a97b601d3

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .