WinDirStat is free software published under the GNU General Public License, version 2. I checked last night and at least the downloads from SourceForge.net and DownloadBestSoft were genuine. Future releases of WDS will be signed with an Authenticode certificate, so it will also make it harder to trojanize WinDirStat. It turned out that the file aforementioned Swedish user had inquired about wasn’t under detection, but another file with the MD5 hash a84aad50293bf5c49fc465797b5afdad. Even though it has been 19 years since the last official release, WinDirStat has continued to be a staple of many system administrators’ and casual users’ computer toolbelts.
Happy new year – new video featuring WinDirStat
- The program’s goal was to output much information while requiring little user input.
- You folks may want to check it out.
- I checked last night and at least the downloads from SourceForge.net and DownloadBestSoft were genuine.
- So I got a contact for the malware research at MalwareBytes and was able to inquire about the file.
- Either way, please do not trust downloads that may be provided there in the future.
A happy new year to the lot of you and check out this video featuring WinDirStat. … well, time and a lexatrade very active co-maintainer proved me wrong since last year. With his help, I am pleased to announce the release of WinDirStat 2.0.1. WinDirStat 2.2.0 has been released. When Bernhard thought it was complete, he gave it to his sister and watched her interaction with the software. The program’s goal was to output much information while requiring little user input.
- And what struck me was that all external traits shown by this file matched closely the Unicode build from the 1.1.2 installer.
- We had been in touch some time before.
- WinDirStat is Open Source software.
- Even though it has been 19 years since the last official release, WinDirStat has continued to be a staple of many system administrators’ and casual users’ computer toolbelts.
- Again, this file is named windirstat.exe and to the naked eye it looks like the Unicode build from the 1.1.2 installer, but in actuality this is a trojanized version of the genuine file.
WinDirStat Blog
I also include detached PGP signatures (the .asc files) and the latest build will always be available under the name premake4.exe. Now I don’t have the time to investigate into what exactly this thing is doing, but it bears all the hallmarks of malware and therefore from my perspective that file isn’t a false positive. In general this means you are free to do whatever you like with the compiled installer and executable.
New independent file download mirror
Someone actually trojanized WinDirStat and it looks like EPO 4 just from a brief look. So I got a contact for the malware research at MalwareBytes and was able to inquire about the file. We had been in touch some time before. We’ve had this before, but this time it was a slightly different case.
One Response to WinDirStat 2.2.0 Released
Now I didn’t have that file in my release archive so I asked for the file 3 and was then able to look at the actual trojanized file. You can pick any of the .exe files there, they should be code-signed. Submitted the trojanized file to a number of AVs and they are catching up as can be witnessed on VirusTotal. Since I am updating this every now and then, please check that the file is code-signed or check that the PGP signature is valid.
WinDirStat detected as trojan … rightly so
The pacman was not his idea, the extension list is. Use the links below to download the last WinDirStat 1.x release. You can redistribute and/or modify it under the terms of the GNU Public License, version 2 (GPLv2).
One Response to WinDirStat detected as trojan … rightly so
Again, this file is named windirstat.exe and to the naked eye it looks like the Unicode build from the 1.1.2 installer, but in actuality this is a trojanized version of the genuine file. The size matched, the timestamp in the PE header matched, just some things like the sections and a whole lot of code or data had been changed in the middle of the file. And what struck me was that all external traits shown by this file matched closely the Unicode build from the 1.1.2 installer.
WinDirStat 2.2.0 Released
After getting another request to create and offer a PAD file, I looked into the process again. I hope in mid to long term we can join forces rather than having the code bases diverge. You folks may want to check it out. Either way, please do not trust downloads that may be provided there in the future. Check out sourceforge.net/p/windirstatfree/ 1.
WinDirStat is Open Source software. The treemap represents each file as a colored rectangle, the area of which is proportional to the file’s size.
Now, the report I got from a WinDirStat user from Sweden (thanks again!) was that MalwareBytes had detected WDS once again. Whatever the source of the file may be. Hope not too many unsuspecting users fell for this. A code-signed binary can be found here. When I was done filling in the stuff that was relevant to a FLOSS program like WinDirStat, I ended up getting a list of error messages. There’s an online generator software at this address.
Project repositories will move to self-hosted
The color of a rectangle indicates the type of the file, as shown in the extension list. If you’d like your opensource project to be added to this list, please contact us. The list below highlights some of the most significant development contributors over the years.