7-zip ZS flagged as malware by Microsoft Defender and 4 other products

[Hermholtz]

FYI

7-Zip ZS 25.01 - v1.5.7 - Release 4, 7z25.01-zstd-x64-ndm.exe.

https://www.virustotal.com/gui/file/61f450281a18efa708680bd8ef106bb75163a2913917e3e34603bd463ad6a531

Please check if it's legitimate and check if one of you haven't been infected with supply-chain attack.

[mcmilk]

NO - It's not my job to chase after this stupid snakeoil manufacturers.

You can check yourself that these downloads are generated on the fly within the Github Actions on this Microsoft owned site. So when there are really viruses, then they are generated by computers running within Microsoft Data Centers ;-)

You can download all the genereated files within the actions tab yourself.

For example, the current released version, you can see here:

• it's the one with tag v25.01-v1.5.7-R4
• click on Adjust Blake3 MAX_SIMD_DEGREE
• scroll down to the Artifacts section
• all the windows binaries are within this ZIP file: 7-Zip ZS Release binaries.zip
• check if the SHA256 hashsums are the same as the files of the release

Just for reference:

• v1.5.7 - Release 4 x64 executable flagged as trojan by Windows Defender #452
• 7-zip ZS flagged as malware by Microsoft Defender and 4 other products #451
• 7zip has virus/malware? #436
• Please, update up to 7-Zip 23.01 STABLE #337
• VirusTotal flags the latest release win64 intstaller as malware. #279
• Please remove viruses .. #230
• Panda Security Virus Detected (W32/Exploit.gen) #213
• Latest Release being flagged as Malware by Emsisoft & Possibly Bitdefender #206
• VirusTotal detections & MS Defender SmartScreen blocks #124
• 7z1700-zstd-x64.exe identified by Symantec Endpoint Protection as untrustworthy #15
• Unable to download 7z1604-zstd-x64 #5

I will add it to the README.md - that I don't want these issues anymore.

[sebres]

People, one could surely search across issues or simply google for that before one posts it.
Dup of #436 and co (almost annual report in the meantime).

Please check if it's legitimate and check if one of you haven't been infected with supply-chain attack.

The hashes are public available and the release was created from this GH-build - the SHA256 hash of "7z25.01-zstd-x64-ndm.exe" in "7-Zip ZS Release binaries.zip" from build artifacts is 61f450281a18efa708680bd8ef106bb75163a2913917e3e34603bd463ad6a531 (the same as showed by virustotal).
Thus it shall be GHA and/or VisualStudio installed in GHA-container (both belonging to MS) infected... You can open a ticket by MS support.