Re: [Bug-gnubg] Virus in Windows build !!

[nis]

On 21 Aug 2002 at 9:16, Øystein O Johansen wrote:

>
> > My virus checker (McAfee) warns about a virus (Coke.22231) in
> > the gnubg snapshot available for download from Oysteins page.
>
> Very strange!?!
>
> I simply have a script which uploads the executable snapshots
> to my site. I really can't understand how that virus comes into
> the executable.
>
> Can it be:
> a) a part of any of the libraries? GTK, xml2 or gdbm?
> b) a added from virus from the compiler? gcc-3.1
> c) a virus on my computer which infects the .exe before it
>    gets uploaded?
> d) A false alarm from McAfee?
> e) A virus at Nis' computer which infects the file after
>    he has downloaded.
>
> Let's rule out a) and b), I really trust this software.
> I think c) is very strange, the only thing done after the
> compiler creates the .exe, is that it's copied to the
> file name with the date stamp. Then it's uploaded. (Check
> my update script included in this message.)
>
> d) is still possible. I'm not using McAfee, so I can't say
> how reliable it is. Similar, e) if the virus is at Nis'
> computer, McAfee should report this on the first occurrence
> of the virus, which should not be from gnubg.exe.

I just reran the scan - I see now that it writes in the headline
"Virus Variant found" and in another place "Maybe A Infected File"
(sic) - but in the main text it seems to be certain. It also requests
that I send the file to McAfee.

The virus is polymorphic, so it might be a false alarm triggered by
coincidental likeness.

Anyway, I am sending the file to McAfee now.
--
Nis Jorgensen
Van Bossestraat 29  1, 1051 JS Amsterdam
Home Mobile: +31 (6) 1496 3629
Work: +31 (20) 52 36 202