Norton Blocking ZWO Software Downloads?

rac

After having no such problems until now, Norton 360 blocks any attempt to download ZWO software/firmware saying that it was a "malicious download". I have tried two PCs and two browsers, with the sane results each time.

Zabelski

rac Having the same problem...don't remember encountering this before...

enaiman

Just disable the security software temporary and you will be fine.

multoyayda

And don't ever disable security features/software in your PCs like enaiman tells you. This one wasn't false-positive, trust me.

rac

I think that this is quite recent. It seems to happen for all downloads so possibly the ZWO download site has been black listed by Norton. I thought that maybe ZWO needs to communicate with them about this.

Tech@ZWO

Sorry for the trouble, we fixed it.

rac

I tested just now and I still get the error, even with Norton 360 Auto-Protect and Smart Firewall disabled.

multoyayda

I'm sure ZWO was hacked, and a malicious actor was able to change camera drivers executable with malicious one, which contained RAT (remote access toolkit):

Here's VirusTotal scans for:

Malicious version: https://www.virustotal.com/gui/file/df70aadc4faec3e8ff8f53b3afcee56f07592a51fc24790eec0ee49fd8cfb10c
And version they uploaded the next day (clean): https://www.virustotal.com/gui/file/4fffaf2387de594ba743e54cdc14f566cb243a48b5965f519b2a2d0024e5b87f
Note that malicious version is not digitally signed by ZWO.

@Tech@ZWO can you comment, what you did to not get hacked again, and used to distribute malware to your customers?

enaiman

multoyayda Whatever floats your boat mate - you could have been right on this one (big maybe) but that would be one in a gazillion of false positives.

rac

I get the error when attempting to download any file from the ZWO download site so I don't think that it has anything to do with the file content. I think that is something in general about the download site or download process that rings alarm bells for Norton at the moment.

The problem persists even if I temporarily disable Auto-Protect and Smart Firewall.

Tech@ZWO

I forwarded this to our devs, they will look into this asap.

Admin

Guys, sorry about this issue. We double-checked the download site and the newly uploaded file, it's clean - checked via 20+ virus software. So we go deep about the Chrome Browser, then we got this:

Now, Google Chrome can download normally. We are still fixing this issue on Edge Browser Secure Check.
But now you can still keep the driver file, it's clean.

multoyayda

Admin can you comment how ZWO ended up spreading a malware?

lviathan

Still getting this error on Chrome

rac

It seems to happen no matter which file is downloaded. It's unlikely that they all contain malware, I would think. The "Uncommon Download" warning may mean that the download page or process doesn't respect Googles recommendations, which ZWO probably needs to investigate and remedy.

Strangely, I can download to my iPad (using Safari).

tutendorf

ZWO Tech Support - please advise on the status of this issue. As of today Norton is still reporting that the ZWO camera driver contains malicious code. Thank you!

Tech@ZWO

tutendorf Hi Could you tell us which broswer did you use to download the driver?
Thanks.