I've just installed the newly released update7, for TIA Portal V13 SP1.

Unfortunately, Microsoft Defender picked up 'Win32/Zbot' password stealer software in the Portal file system.

I'm not sure if it was hidden as part of the V13 SP1 Update 7 installation files.

It was successfully removed by Defender. 

Watch out for this!

C:\Program Files (x86)\SIEMENS\Automation\Portal V13\Bin\Siemens.Simatic.Hmi.Device.PC677DWTpb15P_PE0904.dll

Hello,

you didn't test it before install with some antivirus SW?

Edit: But I will recommend to not automaticaly download new updates, better will be wait for experts to test it and then after some recomendations install it.

Dear Users,

the following information was forwarded from the product management according to the message:

Product Management

Thank you for your information. We have checked this with our Siemens ProductCERT department and got the following response:

 

We are aware of the DLL Anti-Virus flagging by Microsoft Defender. After analysis, the Anti-Virus flagging was identified as a false positive. We got in touch with Microsoft and they confirmed the false positive. Microsoft removed it from their Anti-Virus signatures, including Microsoft Defender.

Additionally, we are in the progress of removing the false positive from McAfee, Kaspersky, Symantec and TrendMicro Anti-Virus scanners.

 

Best regards

CS Moderator