Hi,
I’m getting a warning in Chrome that latest.zip appears to be malicious. See screen:
(bottom left)
Is it safe?
Thanks!
(bottom left)
I’m a potential new Piwik user, about to install it on my server, and the chrome message “latest.zip appears malicious” stopped me in my tracks. I found this topic, and the answer “Yes it is safe.” did not exactly reassure me. And then I searched around a bit and found the following topic indicating that latest.zip was in fact infected less than a year ago with a real and malicious hack: 301 Moved Permanently
I’m still interested in the software but no way I’m willing to use it unless we can get a bit more clarity on WHY “it is safe” now.
The tried to contact Google / StopBadware.com regarding this issue and can’t do much against the warning right now. We (the core devs) have investigated this issue and can confirm that the latest.zip has not been touched since its release and does not contain any malicious code changes.
We are not sure, why Chrome is complaining about the file!
We got dozens of reports in the last few weeks about this Virus alert on Google Chrome on windows. I have today tweeted on the piwik account to try and get help from someone in power at Google. Thank you in advance @google for helping out here!
Chrome is complaining about the location of the download, and not about the file itself.
As I noted in another forum, I was able to use Firefox, Safari, Internet Explorer, and Opera to download the file with no complaints whatsoever. In each case, the downloaded file was scanned with Avast and no problems were found. I also used Chrome to download the file, and told Chrome to keep the “infected” file anyway. It was scanned with Avast, and no problems were found.
When I uploaded the file just downloaded with Chrome to my own server, using FileZilla, and then used Chrome to download that same file from my server, Chrome did not complain. Chrome also didn’t complain when the same test was done with files downloaded by the other browsers.
Conclusion: Chrome doesn’t like the Piwik download site.
@Matt:
You can do a simple test. Just make a copy of the “infected” file somewhere else, and then try to use Chrome to download the file from that alternate location. I suspect that Chrome (or Google) has a black list of dodgy sites. It’s probably Google.