trojan in 5.10.1

varis1 · 01-22-2021, 01:41 PM

my visrsscanner found a signatur TR/Crypt.XPACK.Gen in the downloaded 5.10.1 from the calibr homepage.

why????

https://mobileread.cdn.speedyrails.n...lies/frown.gif

cvkemp · 01-22-2021, 02:15 PM

are you using windows or macOS. I am using the MacOS and I haven't got the trojan. My AV scans the downloads, as well as the install of the program.

varis1 · 01-22-2021, 02:17 PM

the trojan ist in the files calibre.exe, ebook-viewer.exe, ebook-edit.exe and lrfviewer.exe

varis1 · 01-22-2021, 02:20 PM

its win 10, the file calibre.exe, ebook-viewer.exe, lrfviewer.exe and ebook-edit-exe, the scanner is avira pro

cvkemp · 01-22-2021, 02:26 PM

No issues with MacOS version of calibre. I just did a rescan of the whole system

theducks · 01-22-2021, 02:29 PM

If you used the official site: Can you say FALSE POSITIVE? (might be time to ditch that A/V package)

If you used other sites to get your download, who knows what tampering was done

ownedbycats · 01-22-2021, 02:43 PM

Assuming that you downloaded Calibre from the official website, could be that F-Secure is using heuristic scanning.

It's a bit of a double-edged sword that. It can catch malware that hasn't been identified yet (or has been modified so that trying to fingerprint it doesn't work), but depending on how sensitive it is you can get a lot of false positives of legitimate software doing 'suspicious' behaviour.

JSWolf · 01-22-2021, 06:35 PM

Quote:

Originally Posted by varis1

its win 10, the file calibre.exe, ebook-viewer.exe, lrfviewer.exe and ebook-edit-exe, the scanner is avira pro

Delete Avira Pro. It's worthless. Run Windows Security instead as it works much better. Any AV that thinks Calibre is infected when direct downloaded from the Calibre website is not a good idea to use.

ownedbycats · 01-22-2021, 06:53 PM

Quote:

Originally Posted by varis1

its win 10, the file calibre.exe, ebook-viewer.exe, lrfviewer.exe and ebook-edit-exe, the scanner is avira pro

calibre.exe: https://www.virustotal.com/gui/file/...722e/detection

ebook-viewer.exe: https://www.virustotal.com/gui/file/...1955/detection

ebook-edit.exe: https://www.virustotal.com/gui/file/...93b0/detection

lrfviewer.exe: https://www.virustotal.com/gui/file/...88c5/detection

DNSB · 01-22-2021, 07:16 PM

Never mind. Ownedbycats beat me to it.

ReaderX · 01-23-2021, 02:39 AM

Quote:

Originally Posted by varis1

my visrsscanner found a signatur TR/Crypt.XPACK.Gen in the downloaded 5.10.1 from the calibr homepage.

why????

I have experienced the same issue here, on Windows 10 with F-Secure "Safe Online". Prompted for an update by the Calibre app - as so many times before - I downloaded calibre-5.10.1.msi from the Calibre website (guided there by the app). Whilst installing, F-Secure had branded calibre.exe as "Trojan.TR/Crypt.XPACK.Gen". NB: all this happened silently on the background. I only noticed something was wrong when I tried to add a new e-book and was prevented to do so.

I almost immediately assumed we're dealing with a false positive here, but F-Secure kept on removing it, even after I excluded it (and even temporarily turned protection off altogether).

Long story short: I had to uninstall Calibre (even that was somewhat complicated since F-Secure had hijacked the calibre.exe file) and reinstall Calibre 4.17.0.

Be it what it may be, methinks it would be a good idea if Calibre and F-Secure got their heads together and straighten this issue out. The result is that Calibre 5.10.1 is unusable in this setting. And I'm guessing this will affect many more Calibre-users running F-Secure on Windows 10.

BoerOpi · 01-23-2021, 03:32 AM

Quote:

Originally Posted by varis1

my visrsscanner found a signatur TR/Crypt.XPACK.Gen in the downloaded 5.10.1 from the calibr homepage.

why????

https://mobileread.cdn.speedyrails.n...lies/frown.gif

Same here on windows 10 64 bit
Scanned by avira

Reinstall previous version does not work because hidden directory /program files/calibre2 is not accesible

Had to restore entire comp from recent backup.

kovidgoyal · 01-23-2021, 03:35 AM

As always, with antivirus' false positives: https://manual.calibre-ebook.com/faq...a-virus-trojan

Report it to your anti-virus vendor, realize they wont care, move to a better vendor.

Sirtel · 01-23-2021, 05:21 AM

Quote:

Originally Posted by ReaderX

Long story short: I had to uninstall Calibre (even that was somewhat complicated since F-Secure had hijacked the calibre.exe file) and reinstall Calibre 4.17.0.

I would have uninstalled F-Secure, not Calibre.

Leonatus · 01-23-2021, 06:11 AM

Windows 10, 32 bit. Avira (free).
At downloading/installing Calibre 5.10, I got the same message that varis1 reported. I tried some things, at last de-activated Avira and tried to install Calibre again. But now, access to the directory "Calibre2" is denied: I need rights (which ones is not declared). Of course, I'm administrator and have verified this. But nothing helps.
Someone who could give some advice? - gratefully appreciated!

Edit: Also install of a former Calibre version doesn't work.

01-22-2021, 01:41 PM	#1
varis1 Member Posts: 14 Karma: 10 Join Date: Oct 2016 Device: iriver hd, sony prs2, aura h2o, tolino epos1 epos2	trojan in 5.10.1 my visrsscanner found a signatur TR/Crypt.XPACK.Gen in the downloaded 5.10.1 from the calibr homepage. why???? https://mobileread.cdn.speedyrails.n...lies/frown.gif

01-23-2021, 06:11 AM	#15
Leonatus Wizard Posts: 1,088 Karma: 11502975 Join Date: Mar 2013 Location: Guben, Brandenburg, Germany Device: Kobo Clara 2E, Tolino Shine 3	Windows 10, 32 bit. Avira (free). At downloading/installing Calibre 5.10, I got the same message that varis1 reported. I tried some things, at last de-activated Avira and tried to install Calibre again. But now, access to the directory "Calibre2" is denied: I need rights (which ones is not declared). Of course, I'm administrator and have verified this. But nothing helps. Someone who could give some advice? - gratefully appreciated! Edit: Also install of a former Calibre version doesn't work. Last edited by Leonatus; 01-23-2021 at 06:15 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Trojan in Calibre portable 4.91?	Kefir	Calibre	44	01-28-2020 02:15 AM
Trojan detected in 3.2.1	stretch	Devices	0	07-06-2017 05:39 AM
Android Trojan Horse	sjarrel	enTourage Archive	3	01-02-2011 12:58 PM
New Android Trojan	kennyc	Android Devices	0	12-30-2010 04:38 PM
trojan in calibre 0.5.11?	BookLoverToo	Calibre	5	05-10-2009 02:49 AM

01-22-2021, 02:15 PM	#2
cvkemp Loving life Posts: 1,431 Karma: 7991496 Join Date: Mar 2009 Location: Hot Springs Village, Arkansas Device: PaperWhite 6 SE, Fire HD8	are you using windows or macOS. I am using the MacOS and I haven't got the trojan. My AV scans the downloads, as well as the install of the program.

01-22-2021, 02:17 PM	#3
varis1 Member Posts: 14 Karma: 10 Join Date: Oct 2016 Device: iriver hd, sony prs2, aura h2o, tolino epos1 epos2	the trojan ist in the files calibre.exe, ebook-viewer.exe, ebook-edit.exe and lrfviewer.exe

01-22-2021, 02:20 PM	#4
varis1 Member Posts: 14 Karma: 10 Join Date: Oct 2016 Device: iriver hd, sony prs2, aura h2o, tolino epos1 epos2	its win 10, the file calibre.exe, ebook-viewer.exe, lrfviewer.exe and ebook-edit-exe, the scanner is avira pro

01-22-2021, 02:26 PM	#5
cvkemp Loving life Posts: 1,431 Karma: 7991496 Join Date: Mar 2009 Location: Hot Springs Village, Arkansas Device: PaperWhite 6 SE, Fire HD8	No issues with MacOS version of calibre. I just did a rescan of the whole system

01-22-2021, 02:29 PM	#6
theducks Well trained by Cats Posts: 31,267 Karma: 61916422 Join Date: Aug 2009 Location: The Central Coast of California Device: Kobo Libra2,Kobo Aura2v1, K4NT(Fixed: New Bat.), Galaxy Tab A	If you used the official site: Can you say FALSE POSITIVE? (might be time to ditch that A/V package) If you used other sites to get your download, who knows what tampering was done

01-22-2021, 02:43 PM	#7
ownedbycats Custom User Title Posts: 11,359 Karma: 79528341 Join Date: Oct 2018 Location: Canada Device: Kobo Libra H2O, formerly Aura HD	Assuming that you downloaded Calibre from the official website, could be that F-Secure is using heuristic scanning. It's a bit of a double-edged sword that. It can catch malware that hasn't been identified yet (or has been modified so that trying to fingerprint it doesn't work), but depending on how sensitive it is you can get a lot of false positives of legitimate software doing 'suspicious' behaviour.

01-22-2021, 07:16 PM	#10
DNSB Bibliophagist Posts: 48,175 Karma: 174315444 Join Date: Jul 2010 Location: Vancouver Device: Kobo Sage, Libra Colour, Lenovo M8 FHD, Paperwhite 4, Tolino epos	Never mind. Ownedbycats beat me to it.

01-23-2021, 03:35 AM	#13
kovidgoyal creator of calibre Posts: 45,609 Karma: 28549044 Join Date: Oct 2006 Location: Mumbai, India Device: Various	As always, with antivirus' false positives: https://manual.calibre-ebook.com/faq...a-virus-trojan Report it to your anti-virus vendor, realize they wont care, move to a better vendor.