[Haskell-cafe] virus/trojan in bamse package?

[Daniel van den Eijkel]

hi,

my Avira antivirus program says that there is a trojan in the
bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and
Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded
bamse-0.9.5 from hackage today, and now avira says less specificly that
there are "some viruses and/or unwanted programs" inside.

Since I have some trojan trouble for a few days now, bamse might be the
reason for that, but I am not sure. Maybe it is a false alarm, I can't
determine this. (bamse is a framework for building Windows Installer, so
it might contain code that looks like a virus or alike wrongly?)

Does anybody know if this is really a virus/trojan?

Best regards,
Daniel
_______________________________________________
Haskell-Cafe mailing list
Haskel...@haskell.org
http://www.haskell.org/mailman/listinfo/haskell-cafe

[Jannis (jix) Harder]

Am 07.11.2009, 16:28 Uhr, schrieb Daniel van den Eijkel <dv...@gmx.net>:

> hi,
>
> my Avira antivirus program says that there is a trojan in the
> bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and
> Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded
> bamse-0.9.5 from hackage today, and now avira says less specificly that
> there are "some viruses and/or unwanted programs" inside.

Gen usually means that the file isn't a known virus but some heuristics
triggered. This can also happen if a file is compressed with an executable
packer that the virus scanner can't decompress, which wouldn't be strange
for an installer tool. I don't know if that's the problem in this case
but I had a lot of trouble with virus scanners in combination with
executable packers so it might be.

--
Jannis

[Daniel van den Eijkel]

Thank you for that answer. All I could find out is that the file that
causes the alarm is named "folder.exe" (size: 82kb). I don't know for
sure what that is, but since I don't need the package I simply deleted
it. Probably it was just a coincidence that I had some trojan problems
just after zipping and unzipping that hackage torrent...
Regards,
Daniel

Jannis (jix) Harder schrieb:

> Am 07.11.2009, 16:28 Uhr, schrieb Daniel van den Eijkel <dv...@gmx.net>:
>
>> hi,
>>
>> my Avira antivirus program says that there is a trojan in the
>> bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and
>> Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded
>> bamse-0.9.5 from hackage today, and now avira says less specificly
>> that there are "some viruses and/or unwanted programs" inside.
>

> .Gen usually means that the file isn't a known virus but some heuristics