Kaspersky warns that odrivesync.6608.exe is Malware and deletes it

Troubleshooting
1

Kaspersky warns that odrivesync.6608.exe is Malware and deletes it. I tried it on numerous PCs and its the same on all, thnx

2

Hi @epekarik,
Thanks for reporting this.

This is a false positive. I can see that Kaspersky is the only engine that is detecting this: https://www.virustotal.com/gui/file/f32dc461560261ee06c9064bd9eedf74827f8c4aab6edfdc3a2de5cef6f472a5/detection

I am going through their portal now to have them re-analyze.

3

Actually, Kaspesky complains about the URL used for download.

16.06.2020 13.47.34;Dangerous URL blocked;https://dba0rg1h0v09q.cloudfront.net/odrivesync.6608.exe;https://dba0rg1h0v09q.cloudfront.net/odrivesync.6608.exe;URL;Kaspersky Security Network information;Google Chrome;06/16/2020 13:47:34

4

Hi @epekarik,
I’m guessing that the URL is flagged because the exe has been flagged and that is the only URL that the exe is downloaded from. The exe is hosted on AWS S3, using AWS Cloudfront for distribution.

I will submit the URL, as well, although I think they are going to need to analyze the exe to determine where the false positive is so it is not detected again on our next release.

5

thank you Tony, I just disable kaspersky , download, install, than re enable kaspersky
thank you again
Endre

6

Sure thing! Thanks for reporting this so that we can address it.

7

Actually, once I put kaspersky back , it immediately quarantined odriveapp.exe as PDM:Exploit.Win32.Generic.nblk I restored it from quarantine with kaspersky … so far its ok /Endre

8

Thanks @epekarik. I am hoping to hear back from Kapersky soon about this. I will update this thread once I do.

9

I wanted to update that Kaspersky has identified the false positive and will address it in their next release.