Windows 10 Anniversary Update found LibreOffice as malware

users
#1

So, i have Windows 10 with Anniversary Update and today Windows Defender
quarantined soffice.bin, because it thinks it's a Trojan. Is this a known
issue? Should i report it as a bug? I haven't found anything about this with
google search.

#2

Hi:

I suggest you to unable window defender (I don't think it is a bug). Then download LibreOffice, install it and then activate again wd.

Regards,

Jorge Rodriguez

#3

Or switch to a real antivirus. :slight_smile:

#4

Hi,

So, i have Windows 10 with Anniversary Update and today Windows Defender
quarantined soffice.bin, because it thinks it's a Trojan. Is this a known
issue? Should i report it as a bug?

yes please report it with Microsoft as their bug :wink:

thanks,
Cor

#5

FWIW, I have 3 instances of LibreOffice installed on W10 without problem.
Maybe this is a repeat of the old DR-DOS bug, where when Windows 3.1 was
installed on DR-DOS, it would complain about some bogus problem. :wink:

https://en.wikipedia.org/wiki/AARD_code

#6

​Yes, it should be reported as a bug to microsoft (don't know how to do
that though).

Although it is easy to see this as a "strategic move" from MS, it is also
very possible that it is just the result of some heuristics; no doubt they
(MS) have seen quite a few version of the soffice.bin file since
LibreOffice have a lot of version around simultaneously.

There's also the remote possibility that a real trojan stepped in and
infected the file. Uninstalling, checking the system and reinstalling might
fix this, but hopefully this isn't the case.

#7

What is the "Windows 10 Anniversary Update" ? I have not seen that wording when I update my Windows 10 partitions on three systems [Home, and Pro editions]. Of course, I only use/update them a few times a month. I prefer using the packages on Ubuntu.

I use the following free packages, and others to keep my Windows systems "healthy":

Comodo Internet Security Software
      Windows, Linux, and even for Android

IObit Malware Fighter 4 Free - - Remove 100,000,000+ malware
       Windows

IObit Advanced SystemCare 9 Free - - Make PC up to 300% faster
       Windows

For Windows, I do not use Defender, since the Malware Fighter works fine.
I have been using Comodo Internet Security Software for years. It is both Anti-virus and Firewall.
The Advanced SystemCare fills in for much of the rest of the Windows system needs to keep "healthy".

There are free versions for all of these packages, but if you want to pay for the newest and most powerful versions, that is also an option.

As for the issue with LibreOffice and Windows security errors, I have not seen it since the beginning 4.0.x versions. Actually I think I decided to dump Defender around the same time.

Of course, I saw an error with Ubuntu/Debian Linux a few years ago. This was an issue with installing the Language packs using both the "Ubuntu Software Center" and the Terminal to try to install it. Both gave me errors for the install process.

#8

http://lmgtfy.com/?q=Windows+10+Anniversary+Update

Brian Barker

#9

​I can confirm that I have installed LibreOffice (5.2.3.1) on several
machines running Windows 10 version 1607 (aka the «Anniversary Update»)
with Windows Defender activated​ (
​in addition to having the suite installed on several machines running
Linux Mint 18) ; on n​one of them have I hitherto encountered any problems
of the type described by the OP....

Henri

#10

Due to the nature of these antivirus, it is very possible that both of
these happened in quick sequence:
- an update to their virus tables/heuristics/whatever got pushed, and
caused LibreOffice to be detected as a malware
- a later update was quickly pushed to fix that

People having the first updates without the second one will have issue,
while people not having the first update, or directly getting the second
one, will not have any problem. These kind of false positive are somewhat
common with antivirus, and usually gets fixed quickly.

There's also the remote possibility that a malware carrier actually
targeted libreoffice binary and caused a bunch of people to actually be
infected; but since most report of trouble are about a ransomware, and that
none of the complaints resulted in unusable files, it's unlikely :slight_smile:

#11

​I can confirm that I have installed LibreOffice (5.2.3.1) on several
machines running Windows 10 version 1607 (aka the «Anniversary Update»)
with Windows Defender activated​ (
​in addition to having the suite installed on several machines running
Linux Mint 18) ; on n​one of them have I hitherto encountered any problems
of the type described by the OP....

Due to the nature of these antivirus, it is very possible that both of
these happened in quick sequence:
- an update to their virus tables/heuristics/whatever got pushed, and
caused LibreOffice to be detected as a malware
- a later update was quickly pushed to fix that

People having the first updates without the second one will have issue,
while people not having the first update, or directly getting the second
one, will not have any problem. These kind of false positive are somewhat
common with antivirus, and usually gets fixed quickly.

For some reason, it seems that MS states that the "anniversary" update is officially out in November. They "say" that for those who installed Win10 last year, the update files/packages will be doled out over a few months of Tuesday releases for update/fixes and not as one package on a single date.

There's also the remote possibility that a malware carrier actually
targeted libreoffice binary and caused a bunch of people to actually be
infected; but since most report of trouble are about a ransomware, and that
none of the complaints resulted in unusable files, it's unlikely :slight_smile:

I wonder if you have tried scanning the install files via Comodo's anti-virus for Linux? If, for whatever reason, the downloaded file[s] does not pass Comodo Internet Suite [free for Windows and Linux] then something messed up somewhere. On Windows, I use a standalone malware package and not have Defender activated. I do not like to use a MS created protection system, for some personal reasons.

I know that it seems to be a bug in MS's Defender, but some people may think MS included LibreOffice in their "black list" for the malware database. I know some people there would have tried to add competition packages into that database to show that LibreOffice has included malware or virus, etc., and not to be trusted as a package or trusted organization. [did I say it right?]