Windows 10: OneDrive Update seems odd.

On my computer, I get this message pop up "Microsoft One Drive - An update is required, to continue using OneDrive, you need to update it.". When I click on Update oneDrive, the PC downloads an exe file from https://oneclient.sfx.ms/OneDriveSetup.exe

Does anyone know if this is legitimate and how can I tell? I'm normally used to updates coming from Software Updater.

Thank you

:)

 

Doesn't This Seem Odd?

All of this I know. You will have noticed, surely, that my previous post reads in part

"I just had Windows Defender Antivirus protect me from downloading the Microsoft Safety Scanner.

Is that supposed to happen?"

So, obviously, I am not relying on Microsoft Safety Scanner (MSS) alone.

I often use Defender's offline scan capability as well as running full scans with it.

Sometimes I like to do a quick scan with safety scanner (which is considered tougher than that monthly add-on known as the Malicious Software Removal Tool. Not surprising when you consider it is updated
more frequently).





And, finally, while you and I might abbreviate it MSS please remember that Microsoft does not.





To them it is MSERT.EXE

What I asked was why was Windows Defender Antivirus blocking the download?

(Which it no longer is).

 

Doesn't This Seem Odd?

Most likely the copy you were downloading was damaged in some way, either as it was stored on the server or more likely by a network event that occurred during that particular download.

This is actually the more important reason that such executable files are now digitally signed in the first place, since this ability to insure the integrity of the file serves to protect not only from potential corruption by malware, but also any other
possible damage due to network, disk storage or other technical failures.

Introduction to Code Signing (Windows)

Note that nothing specifically stated that the item was detected as malware, SmartScreen simply indicated it wouldn't allow the item to launch because the publisher was unknown, which indicates either an unsigned or damaged file.

Whether it was malware or not, you wouldn't want something as potentially dangerous to your system's operation as a security scanning application to malfunction, since the results are potentially as bad as what malware itself might do.

Rob

 

Norton Safe Web says the page is OK, and DNS resolution says it's an Akamai edge server (something MS uses quite often for file distribution).



That said, I don't see anything about grabbing a file from akamai instead of WU for One Drive anywhere. I tried to grab the file for virus inspection but it's apparently no longer available. When in doubt, though -- and you had good reason to feel that way -- you're ALWAYS better off not downloading (or installing) a suspect or potentially suspect file.
Interestingly if you check the name of the .exe file it corresponds to the download for the One Drive Sync Client for which the following item appears online at Welcome to Microsoft OneDrive:



It says that Windows 10 doesn't need to install this, so that would amplify your concerns about installing this item on a system running Windows 10.
HTH,
--Ed--