virus/trojan in bamse package?

[Daniel van den Eijkel-2]

hi,

my Avira antivirus program says that there is a trojan in the
bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and
Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded
bamse-0.9.5 from hackage today, and now avira says less specificly that
there are "some viruses and/or unwanted programs" inside.

Since I have some trojan trouble for a few days now, bamse might be the
reason for that, but I am not sure. Maybe it is a false alarm, I can't
determine this. (bamse is a framework for building Windows Installer, so
it might contain code that looks like a virus or alike wrongly?)

Does anybody know if this is really a virus/trojan?

Best regards,
Daniel
_______________________________________________
Haskell-Cafe mailing list
Haskell-Cafe@...
http://www.haskell.org/mailman/listinfo/haskell-cafe

[Jannis (jix) Harder]

Am 07.11.2009, 16:28 Uhr, schrieb Daniel van den Eijkel <dvde@...>:

> hi,
>
> my Avira antivirus program says that there is a trojan in the  
> bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and  
> Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded  
> bamse-0.9.5 from hackage today, and now avira says less specificly that  
> there are "some viruses and/or unwanted programs" inside.

.Gen usually means that the file isn't a known virus but some heuristics
triggered. This can also happen if a file is compressed with an executable
packer that the virus scanner can't decompress, which wouldn't be strange
for an installer tool. I don't know if that's the problem in this case
but I had a lot of trouble with virus scanners in combination with
executable packers so it might be.

--
Jannis

_______________________________________________
Haskell-Cafe mailing list
Haskell-Cafe@...
http://www.haskell.org/mailman/listinfo/haskell-cafe

[Daniel van den Eijkel-2]

Thank you for that answer. All I could find out is that the file that
causes the alarm is named "folder.exe" (size: 82kb). I don't know for
sure what that is, but since I don't need the package I simply deleted
it. Probably it was just a coincidence that I had some trojan problems
just after zipping and unzipping that hackage torrent...
Regards,
Daniel

Jannis (jix) Harder schrieb:

> Am 07.11.2009, 16:28 Uhr, schrieb Daniel van den Eijkel <dvde@...>:
>
>> hi,
>>
>> my Avira antivirus program says that there is a trojan in the
>> bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and
>> Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded
>> bamse-0.9.5 from hackage today, and now avira says less specificly
>> that there are "some viruses and/or unwanted programs" inside.
>
> .Gen usually means that the file isn't a known virus but some heuristics
> triggered. This can also happen if a file is compressed with an
> executable
> packer that the virus scanner can't decompress, which wouldn't be strange
> for an installer tool. I don't know if that's the problem in this case
> but I had a lot of trouble with virus scanners in combination with
> executable packers so it might be.
>
> --
> Jannis
>
> _______________________________________________
> Haskell-Cafe mailing list
> Haskell-Cafe@...
> http://www.haskell.org/mailman/listinfo/haskell-cafe
>

_______________________________________________
Haskell-Cafe mailing list
Haskell-Cafe@...
http://www.haskell.org/mailman/listinfo/haskell-cafe