
hi, my Avira antivirus program says that there is a trojan in the bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded bamse-0.9.5 from hackage today, and now avira says less specificly that there are "some viruses and/or unwanted programs" inside. Since I have some trojan trouble for a few days now, bamse might be the reason for that, but I am not sure. Maybe it is a false alarm, I can't determine this. (bamse is a framework for building Windows Installer, so it might contain code that looks like a virus or alike wrongly?) Does anybody know if this is really a virus/trojan? Best regards, Daniel

Am 07.11.2009, 16:28 Uhr, schrieb Daniel van den Eijkel
hi,
my Avira antivirus program says that there is a trojan in the bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded bamse-0.9.5 from hackage today, and now avira says less specificly that there are "some viruses and/or unwanted programs" inside.
.Gen usually means that the file isn't a known virus but some heuristics triggered. This can also happen if a file is compressed with an executable packer that the virus scanner can't decompress, which wouldn't be strange for an installer tool. I don't know if that's the problem in this case but I had a lot of trouble with virus scanners in combination with executable packers so it might be. -- Jannis

Thank you for that answer. All I could find out is that the file that causes the alarm is named "folder.exe" (size: 82kb). I don't know for sure what that is, but since I don't need the package I simply deleted it. Probably it was just a coincidence that I had some trojan problems just after zipping and unzipping that hackage torrent... Regards, Daniel Jannis (jix) Harder schrieb:
Am 07.11.2009, 16:28 Uhr, schrieb Daniel van den Eijkel
: hi,
my Avira antivirus program says that there is a trojan in the bamse-0.9.5 package. I downloaded the hackage-torrent a week ago, and Avira says "TR/Crypt.CFI.Gen" is in bamse. To be sure, I downloaded bamse-0.9.5 from hackage today, and now avira says less specificly that there are "some viruses and/or unwanted programs" inside.
.Gen usually means that the file isn't a known virus but some heuristics triggered. This can also happen if a file is compressed with an executable packer that the virus scanner can't decompress, which wouldn't be strange for an installer tool. I don't know if that's the problem in this case but I had a lot of trouble with virus scanners in combination with executable packers so it might be.
-- Jannis
_______________________________________________ Haskell-Cafe mailing list Haskell-Cafe@haskell.org http://www.haskell.org/mailman/listinfo/haskell-cafe
participants (2)
-
Daniel van den Eijkel
-
Jannis (jix) Harder