IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

CB Defense: Why is Filezilla installer seen as malware?

CB Defense: Why is Filezilla installer seen as malware?

Environment

  • CB Defense Sensor: All Supported Versions
  • Microsoft Windows: Supported Versions
  • Filezilla FTP Server: 3.45.1

Question

Why is Filezilla installer seen as malware?

Answer

The 3.45.1 Filezilla installer has adware offers in their sponsored / bundle versions of the installer. These are additional programs that are installed by default. Due to this, the installer is currently getting the Reputation of Known Malware. 

Additional Notes

  • Some installers for application give the option of installation of additional applications, enabled by default
  • Setting following Permission allows installer to run with defaults for installer: 
Application at path: **\(installer file name)
Operation Attempt: Runs or is running, communicates over network
Action: Allow & Log
  • Installer file can be added to Company Whitelist by Hash value to set higher Reputation

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
6442
Contributors