https://www.codecguide.com/download_k-lite_codec_pack_full.htm
I tried updating the codec on my PC through the official website, but Kaspersky thinks it's a virus. Is it really a virus or is it a false detection?
I've been using codecs and Kaspersky for years, but this is the first time it's been identified as a virus.

thanks

 

Welcome to Kaspersky Community.

 

https://www.virustotal.com/gui/file/6e4a5a2168034876e663d71bbd1522594eff7045c9646e69b2b0d887f12db40d?nocache=1

 

Looks like there are a few other av firms detecting that file 🤔

 

Update:

 

https://www.reddit.com/r/msp/comments/1bd1ozd/klite_codec_bundling_malicious_proxy_with_recent/

Hi  @harlan4096 & @Fandy, 

Just as FYI, confirming:

Thank you🙏
Flood🐳+🐋

2 часа назад, Fandy сказал:

Kaspersky thinks it's a virus.

Kaspersky thinks it's "not-a-virus:Downloader.Win32.Agent.nzon". If Safe Browsing is enabled in Chrome, it submits the file to the installed antivirus for scanning, and if there is a detection, it just blocks access to this file and writes "virus detected". Doesn't specify what kind of detection it is. This can be confusing and scary for users.🙂

53 minutes ago, AlexeyK said:

Kaspersky thinks it's "not-a-virus:Downloader.Win32.Agent.nzon". If Safe Browsing is enabled in Chrome, it submits the file to the installed antivirus for scanning, and if there is a detection, it just blocks access to this file and writes "virus detected". Doesn't specify what kind of detection it is. This can be confusing and scary for users.🙂

With Chrome 'Safe-browsing' disabled - the file is still blocked

 

🙄

😵

🤔

24 минуты назад, Flood and Flood's wife сказал:

With Chrome 'Safe-browsing' disabled - the file is still blocked

Allow the download in GC, and the file will be downloaded.

38 минут назад, Flood and Flood's wife сказал:

With Chrome 'Safe-browsing' disabled - the file is still blocked

Yep, after downloading it's still unavailable. But that's not the point. You can pause Kaspersky protection - GC will stop detecting the file even when its safe browsing is enabled. In this case, it's not GC detects the file, but the antivirus provides the information to GC. 

Looks like only the Full pack is involved in the malicious activity.

 

I usually use Mega pack...

 

I can confirm Mega pack is not detected; it was just downloaded with FF and scanned on demand with KES.

27 minutes ago, harlan4096 said:

I usually use Mega pack...

👍

1 час назад, harlan4096 сказал:

Mega pack is not detected

Yes, but: 

@harlan4096 I guess the cause of the detection is found in your link to reddit (see below). In general, there's nothing dangerous in these files, they're not malicious.

Спойлер

During the installation of K-lite Codec Pack 18.3.0 Basic, when using the advanced options, there is a step that says:

 

@AlexeyK

Maybe a FP in DrWeb 🤔 ?

1 час назад, Berny сказал:

Maybe a FP in DrWeb 🤔 ?

No, it also detects previous versions e.g. 19.8.2, 19.8.0 (except Basic). But by Kaspersky these previous Full versions are trusted in KSN. Maybe it's false positive, I've submitted to virlab just in case.

Спойлер

Correct detection:

Спойлер

I usually install K-lite Mega C. pack via PatchMyPC tool, so probably that avoided the detection and that additional software install in my case.

I tried installing Full and Mega, but didn't find any additional software offers. I don't know why this detection was added for this version. Only for Full, because Mega and Standard are Trusted in KSN. Just miracles with these installers.)