The program then scans the selected locations and displays the results as a treemap, with rectangles of various sizes and colors representing the files on the drive. When the program is launched, a dialog box asks users to select the drives or folders they want to analyze. The program's interface is plain and utilitarian.
WinDirStat Portable is a lightweight program that lets users quickly identify the biggest space hogs on their machines and then take action to tidy things up.
Conclusions Reddit Is Malwarebytes Still Good For Free Now I don’t have the time to investigate into what exactly this thing is doing, but it bears all the hallmarks of malware and therefore from my perspective that file isn’t a false positive. Holy moly, Batman! Someone actually trojanized WinDirStat and it looks like EPO 4 just from a brief look.Īgain, this file is named windirstat.exe and to the naked eye it looks like the Unicode build from the 1.1.2 installer, but in actuality this is a trojanized version of the genuine file.
So I loaded the genuine file into IDA Pro and the entry point looked like this:Īnd when I did the same on the trojanized file it looked like this:
The size matched, the timestamp in the PE header matched, just some things like the sections and a whole lot of code or data had been changed in the middle of the file. And what struck me was that all external traits shown by this file matched closely the Unicode build from the 1.1.2 installer.
Now I didn’t have that file in my release archive so I asked for the file 3 and was then able to look at the actual trojanized file. It turned out that the file aforementioned Swedish user had inquired about wasn’t under detection, but another file with the MD5 hash a84aad50293bf5c49fc465797b5afdad. So I got a contact for the malware research at MalwareBytes and was able to inquire about the file. We’ve had this before, but this time it was a slightly different case. That is the installer with the following two cryptographic hashes 2: I assumed false positive and it turned out that it was at least for the particular file that the Swedish user had (SHA1: 26e14a532e1e050eb20755a0b7a5fea99dd80588) 1 – which was the genuine file from the genuine version 1.1.2 installer. Now, the report I got from a WinDirStat user from Sweden (thanks again!) was that MalwareBytes had detected WDS once again. Choose from a variety of plans starting at just $39.99 for the first year. Norton offers online protection for your computer, tablet or smartphone. However the damage is done by a virus that then conceals it, and malwarebytes only reveals the damage upon removal. If there is a virus dug into your computer and malwarebytes tears it out, yes it can damage your computer. It's a scanner with a paid anti-malware suite. There's a reason we're the number recommended removal tool on r/techsupport (not run by a Malwarebytes employee). Malwarebytes Employee 1 year ago As my flair states, I'm an employee so obviously I'm biased, but we're definitely still one of the best. Well, actually it isn’t the genuine WinDirStat but a trojanized version posing as WinDirStat and it’s masquerading under the disguise of the good Unicode version of windirstat.exe which is contained in the installer.