MobileRead Forums
Register Guidelines E-Books Today's Posts Search

Go Back   MobileRead Forums > E-Book Software > Calibre
Reload this Page Malware found in calibre-portable.exe v5.5.0

Notices

Reply
Page 1 of 2 1 2
 
Thread Tools Search this Thread
Old 11-19-2020, 04:27 AM   #1
peter0conor
Member
peter0conor began at the beginning.
 
Posts: 16
Karma: 10
Join Date: Jun 2018
Device: inkBOOK
Exclamation Malware found in calibre-portable.exe v5.5.0
Good morning,
I have calibre v5.5.0 installed in Windows 10. A few days ago, Windows Defender has detected malware within the file:

https://www.microsoft.com/en-us/wdsi...hreatid=274599

I've uninstalled and reinstalled back, but it keeps detecting. I checked the executable file in Virustotal and two engines found malware (Cayunamer.A! within the file). Is anyone else having the same issue?
Thanks
peter0conor is offline   Reply With Quote
Old 11-19-2020, 04:29 AM   #2
Thasaidon
Hedge Wizard
Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.Thasaidon ought to be getting tired of karma fortunes by now.
 
Thasaidon's Avatar
 
Posts: 802
Karma: 19999999
Join Date: May 2011
Location: UK/Philippines
Device: Kobo Touch, Nook Simple
Where did you download this version of Calibre Portable from?
Thasaidon is offline   Reply With Quote
Old 11-19-2020, 04:32 AM   #3
peter0conor
Member
peter0conor began at the beginning.
 
Posts: 16
Karma: 10
Join Date: Jun 2018
Device: inkBOOK
calibre official website

https://calibre-ebook.com/dist/portable
peter0conor is offline   Reply With Quote
Old 11-19-2020, 04:42 AM   #4
pdurrant
The Grand Mouse 高貴的老鼠
pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.
 
pdurrant's Avatar
 
Posts: 74,449
Karma: 318076944
Join Date: Jul 2007
Location: Norfolk, England
Device: Kindle Oasis
Kaspersky's online tool found nothing.

Check the checksum of the file you have.

Code:
SHA-256: 9E4EE7B9E96C92A5DAAA993CF288C6E869501B141BD6CDD1419F6131E4AFF4D8
Most likely it's a false positive.
pdurrant is offline   Reply With Quote
Old 11-19-2020, 04:54 AM   #5
kovidgoyal
creator of calibre
kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.
 
kovidgoyal's Avatar
 
Posts: 45,609
Karma: 28549044
Join Date: Oct 2006
Location: Mumbai, India
Device: Various
https://manual.calibre-ebook.com/faq...a-virus-trojan
kovidgoyal is offline   Reply With Quote
Old 11-19-2020, 04:57 AM   #6
peter0conor
Member
peter0conor began at the beginning.
 
Posts: 16
Karma: 10
Join Date: Jun 2018
Device: inkBOOK
my hash is different:
SHA256 8B4BA65915BADA66485B27F31304202F15E51E1B8E59AACA79 669A3F5A1BA2E8
peter0conor is offline   Reply With Quote
Old 11-19-2020, 05:00 AM   #7
BetterRed
null operator (he/him)
BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.
 
Posts: 22,018
Karma: 30277294
Join Date: Mar 2012
Location: Sydney Australia
Device: none
This morning I installed portable 5.5 on Windows 10 2004, SecIntel version 1.327.1179.0

All three .exe's work fine.

Added : I downloaded from the second Alternative site - Github

BR
Last edited by BetterRed; 11-19-2020 at 05:05 AM.
BetterRed is offline   Reply With Quote
Old 11-19-2020, 05:13 AM   #8
pdurrant
The Grand Mouse 高貴的老鼠
pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.
 
pdurrant's Avatar
 
Posts: 74,449
Karma: 318076944
Join Date: Jul 2007
Location: Norfolk, England
Device: Kindle Oasis
Quote:
Originally Posted by peter0conor View Post
my hash is different:
SHA256 8B4BA65915BADA66485B27F31304202F15E51E1B8E59AACA79 669A3F5A1BA2E8
My hash was for calibre portable, calibre-portable-installer-5.5.0.exe, size 103,047,104 bytes.

I've double-checked locally and with another on-line hash generator.
pdurrant is offline   Reply With Quote
Old 11-19-2020, 05:28 AM   #9
BetterRed
null operator (he/him)
BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.BetterRed ought to be getting tired of karma fortunes by now.
 
Posts: 22,018
Karma: 30277294
Join Date: Mar 2012
Location: Sydney Australia
Device: none
Mine is same as pdurrant's

Code:
SHA-256	9E4EE7B9E96C92A5DAAA993CF288C6E869501B141BD6CDD1419F6131E4AFF4D8
BR
Last edited by BetterRed; 11-19-2020 at 05:31 AM.
BetterRed is offline   Reply With Quote
Old 11-19-2020, 05:31 AM   #10
kovidgoyal
creator of calibre
kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.kovidgoyal ought to be getting tired of karma fortunes by now.
 
kovidgoyal's Avatar
 
Posts: 45,609
Karma: 28549044
Join Date: Oct 2006
Location: Mumbai, India
Device: Various
The installers are all signed, there is no need to check hashes, but if you really want to check hashes, the comprehensive list is here: https://calibre-ebook.com/signatures/
kovidgoyal is offline   Reply With Quote
Old 11-19-2020, 07:48 AM   #11
JSWolf
Resident Curmudgeon
JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.
 
JSWolf's Avatar
 
Posts: 80,784
Karma: 150249619
Join Date: Nov 2006
Location: Roslindale, Massachusetts
Device: Kobo Libra 2, Kobo Aura H2O, PRS-650, PRS-T1, nook STR, PW3
Quote:
Originally Posted by peter0conor View Post
my hash is different:
SHA256 8B4BA65915BADA66485B27F31304202F15E51E1B8E59AACA79 669A3F5A1BA2E8
Then you have a serious problem.
JSWolf is online now   Reply With Quote
Old 11-19-2020, 09:14 AM   #12
ownedbycats
Custom User Title
ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.
 
ownedbycats's Avatar
 
Posts: 11,359
Karma: 79528341
Join Date: Oct 2018
Location: Canada
Device: Kobo Libra H2O, formerly Aura HD
https://www.virustotal.com/gui/file/...f4d8/detection
Last edited by ownedbycats; 11-19-2020 at 09:20 AM.
ownedbycats is offline   Reply With Quote
Old 11-19-2020, 09:28 AM   #13
ownedbycats
Custom User Title
ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.
 
ownedbycats's Avatar
 
Posts: 11,359
Karma: 79528341
Join Date: Oct 2018
Location: Canada
Device: Kobo Libra H2O, formerly Aura HD
Quote:
Originally Posted by peter0conor View Post
my hash is different:
SHA256 8B4BA65915BADA66485B27F31304202F15E51E1B8E59AACA79 669A3F5A1BA2E8
That's the hash for calibre-portable.exe (the launcher for the portable version), not the portable installer: https://www.virustotal.com/gui/file/...a2e8/detection

Only two engines detect it, both detections seem to be rather generic heuristic ones, and at least Bkav is known for heavy false positives.

I ran calibre-portable.exe through Hybrid Analysis. Aside from the "identified as a virus by a piece of shit masquerading as an antivirus" there isn't really much indicating malicious behaviour. If I recall correctly, the import address thing is a standard practice - otherwise you'd get errors when trying to load libraries that don't exist on your particular version of Windows.
Last edited by ownedbycats; 11-19-2020 at 09:51 AM.
ownedbycats is offline   Reply With Quote
Old 11-19-2020, 09:57 AM   #14
pdurrant
The Grand Mouse 高貴的老鼠
pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.pdurrant ought to be getting tired of karma fortunes by now.
 
pdurrant's Avatar
 
Posts: 74,449
Karma: 318076944
Join Date: Jul 2007
Location: Norfolk, England
Device: Kindle Oasis
So a false positive, as expected.
pdurrant is offline   Reply With Quote
Old 11-19-2020, 10:04 AM   #15
ownedbycats
Custom User Title
ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.ownedbycats ought to be getting tired of karma fortunes by now.
 
ownedbycats's Avatar
 
Posts: 11,359
Karma: 79528341
Join Date: Oct 2018
Location: Canada
Device: Kobo Libra H2O, formerly Aura HD
I once compiled a batch file I had to an executable for some reason or another, and just out of curiosity threw it up on VirusTotal. Some of the antiviruses flagged it because they had never seen it before.

There's also apocryphal stories about Norton Antivirus attempting to quarantine itself.
Last edited by ownedbycats; 11-19-2020 at 10:26 AM.
ownedbycats is offline   Reply With Quote
Reply
Page 1 of 2 1 2

« Previous Thread | Next Thread »

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Possible Calibre Portable 5.5 bug - adding an exe file as a book firefoxxy Calibre 2 11-17-2020 01:40 PM
Calibre Portable - Shouldn't PORTABLE Viewer and PORTABLE Editor open WITH the ebook? Highlighter Calibre 2 10-31-2020 06:48 AM
Can ebook-viewer.exe be portable? odonterla Calibre 0 02-07-2020 06:23 AM
Calibre portable exe Fetzel Library Management 3 12-28-2017 05:15 PM
(Suggestion) Move ebook-viewer.exe to the main directory next to calibre-portable.exe avid01 Library Management 6 07-03-2014 04:55 AM


All times are GMT -4. The time now is 07:59 AM.

Contact Us - FAQ - Guidelines - Privacy - Top

MobileRead.com is a privately owned, operated and funded community.