The report gives this a risk level of "High" (their highest level). If I proceed to Save the file anyway, I get a further warning "Woah[sic], that download is dangerous! We found there might be viruses, spyware or other potentially unwanted programs in the file you are trying to download. Filename: ccsetup526.exe. Domain: files.downloadnow-1.com.
If I click on "Accept the Risk" and continue, it proceeds to download ccsetup526.exe (8,813,488 bytes) digitally signed by Piriform Ltd. on 21 Dec 2016 (SHA1 and SHA256). A separate scan using McAfee Viruscan of the downloaded file itself did not result in any further warnings, so it's apparently the downloadnow-1.com site that's triggering the warning, and not a detected virus in the file itself.
So while it seems like a false positive, I thought I'd post this nonetheless since it's strange to see (I almost never get false positives by McAfee WebAdvisor on downloading executables). Any comments?
some anti viruses will just warn you when you download an executable file, its normal and they will also scan the downloaded file and check in compressed archives as well. Its just a way of telling you to becareful what you download.
I don't get the sequence of events you outline above. If I press the first link in your post it takes me to the Piriform download page, where after pressing the download button under CCleaner free takes me here ...
... where after about 4 seconds the CCleaner download dialogue box appears. There isn't any being passed from one site to another.
Please don't construe that as meaning I don't believe that's what happened to you, but there must be some reason why.
Have any of you other guys experienced what Tango experienced? I've repeated the process half a dozen times and I can't reproduce it. Something amiss here methinks which maybe should be put right.
If other members wouldn't mind trying it to see if they go on that jolly but unwanted jaunt.
From that Intel McAfee analysis it shows the download site as (purposely put into a codebox to make it non-clickable):
downloadnow-1.com
It has nothing to do with the official downloads from Piriform. As always download from official software website's when possible to avoid tampering, and illegal re-packaging which could contain malware.
Edit:
This is what McAfee SiteAdvisor states about Piriform.com (this website), it's all green and good:
