Trojan in Calibre portable 4.91? - Page 2

stumped · 01-26-2020, 03:13 PM

I am confused by the competing and contradictory claims. We have a link to a page at virustotal saying all clean.
But then, We have a different link to the same site in a post saying 16 positive detection reports, but I only count 8 on the actual link page.
What is it that 8, or 16, different virus engines find suspect?
Why does virustotal seem to change its verdict depending on how the question is phrased?
Why is everyone so glib about ignoring 8 different positives and so willing to disbelieve them all.
I don't for one minute suppose that Kovid deliberately adds Trojans to his programs, but files can be compromised after being placed on servers for public access

KevinH · 01-26-2020, 03:46 PM

Virustotal provides the sha256 sum of the binary it tested in that link report, There are 3 places to download calibre-portable from, but at least one of those alternate sites lists a completely different sha256 sum for that file (i could not find a sha256 checksum for the other two sites).

So perhaps the person who downloaded the file has an already compromised system or uses a download manager that is compromised which results in an infected download?

Not sure either way but if the original is clean (which I believe to be true given Kovid's test results posted) and the sha256 sum of what was tested in the next differs from the original then they are testing two different things.

joelack99 · 01-26-2020, 07:58 PM

Quote:

Originally Posted by kovidgoyal

calibre-portable.exe is built from a single file, https://github.com/kovidgoyal/calibr...ows/portable.c

that has not changed in 6 months, so I suggest following the advice in https://manual.calibre-ebook.com/faq...a-virus-trojan

If it hasn't changed why does virus scanner (which also hasn't changed) all of a sudden think it's corrupt? Yes, the file was downloaded from the update prompt in the running app.

DNSB · 01-26-2020, 09:10 PM

Just for the heck of it, I went to calibre-ebook.com and downloaded calibre-portable.exe from the 3 links provided. I then generated a SHA-256 for each file with the following results ( I added the site to the filename manually ):

Code:

Name: calibre-portable-installer-4.9.1_calibre.exe
Calibre-ebook download link
Size: 98105792 bytes (93 MiB)
SHA256: 5D51BA530DBBBA84F4AA80DC785228FCB043AC1EAE19DF45788350C5AE99BDB7

Name: calibre-portable-installer-4.9.1_fosshub.exe
Fosshub download link  This one has an expiry timer
Size: 98105792 bytes (93 MiB)
SHA256: 5D51BA530DBBBA84F4AA80DC785228FCB043AC1EAE19DF45788350C5AE99BDB7
Note:  the SHA-256 on Fosshub matches the locally generated one.

Name: calibre-portable-installer-4.9.1_github.exe
Github download link
Size: 98105792 bytes (93 MiB)
SHA256: 5D51BA530DBBBA84F4AA80DC785228FCB043AC1EAE19DF45788350C5AE99BDB7

Since the SHA-256 values matched, I then headed over to VirusTotal.com and checked the file. I found the file had been previously checked with no detections so I forced a re-detection. Still no hits other than Fireeye timing out and Cylance and Symantec Mobile Insight which couldn't process the filetype. I also ran the .exe through Jotti's malware scan and MetaDefender Cloud which—drumroll, please—found no detections.

I'd say that it is safe to install calibre-portable from any of the three links on Kovid's site.

kovidgoyal · 01-26-2020, 09:48 PM

Quote:

Originally Posted by joelack99

If it hasn't changed why does virus scanner (which also hasn't changed) all of a sudden think it's corrupt? Yes, the file was downloaded from the update prompt in the running app.

How do you know the virus scanner hasn't changed? I posted actual evidence that calibre-portable.exe has not changed. And I posted evidence showing that virus scanners all think calibre-portable-installer.exe as hosted on the calibre download server, is clean. That installer contains calibre-portable.exe. If you or anyone else install calibre-portable-installer and then find calibre-portable.exe contains a trojan then the chances are it picked up that trojan from the system it was installed on.

thiago.eec · 01-27-2020, 07:38 AM

Quote:

Originally Posted by DNSB

Just for the heck of it, I went to calibre-ebook.com and downloaded calibre-portable.exe from the 3 links provided. I then generated a SHA-256 for each file with the following results ( I added the site to the filename manually ):

...

I'd say that it is safe to install calibre-portable from any of the three links on Kovid's site.

Hi, DNSB.

I just downloaded calibre portable from calibre-ebook.com. I scanned calibre portable installer (calibre-portable-installer-4.99.4.exe, beta, 94.3MB) and it came clean.

Then, I installed it and scanned just the executable (calibre-portable.exe, 152KB). Now it is detected by VirusTotal (and my local antivirus, BitDefender).

I ran a system scan and it found nothing else.

Could you please check if your calibre-portable executable (152KB) is detected by VirusTotal (or other AV)?

JSWolf · 01-27-2020, 07:47 AM

Quote:

Originally Posted by thiago.eec

Hi, DNSB.

I just downloaded calibre portable from calibre-ebook.com. I scanned calibre portable installer (calibre-portable-installer-4.99.4.exe, beta, 94.3MB) and it came clean.

Then, I installed it and scanned just the executable (calibre-portable.exe, 152KB). Now it is detected by VirusTotal (and my local antivirus, BitDefender).

I ran a system scan and it found nothing else.

Could you please check if your calibre-portable executable (152KB) is detected by VirusTotal (or other AV)?

Your problem is that BitDefender is garbage and you really need to dump it.

thiago.eec · 01-27-2020, 08:59 AM

Quote:

Originally Posted by JSWolf

Your problem is that BitDefender is garbage and you really need to dump it.

Ok. Very useful information.

TechRadar
AV-Test
PCMag

JSWolf · 01-27-2020, 09:06 AM

Quote:

Originally Posted by thiago.eec

Ok. Very useful information.

TechRadar
AV-Test
PCMag

BitDefender has too many false positives. Plus, two of those articles rated Norton second and Norton is also garbage. So really, two of those articles are not to be trusted.

Seriously, if you want Calibre to not work because BitDefender thinks is infected, then keep using it. But i it was me, BitDefender would be gone.

thiago.eec · 01-27-2020, 09:29 AM

Quote:

Originally Posted by JSWolf

BitDefender has too many false positives. Plus, two of those articles rated Norton second and Norton is also garbage. So really, two of those articles are not to be trusted.

Ok. That's your opinion. What are your credentials to put you above AV-Test, for instance? They say BitDefender has lower False Positives than the average of the market.

Quote:

Originally Posted by JSWolf

Seriously, if you want Calibre to not work because BitDefender thinks is infected, then keep using it. But i it was me, BitDefender would be gone.

I will not uninstall calibre. I know the program is safe and that's not the point.

I'm just intrigued by theses results and asked someone else to test it on another machine, so I can see if it is an isolated problem, affecting just my system. Maybe my system is infected. Maybe the AV is wrong... Don't know for sure right now.

I am investigating so I can identify the problem. Assuming that the AV is garbage and considering it solved is not very wise. That's really dumb, actually.

JSWolf · 01-27-2020, 10:12 AM

[QUOTE=thiago.eec;3946213]Ok. That's your opinion. What are your credentials to put you above AV-Test, for instance? They say BitDefender has lower False Positives than the average of the market.[/uote]

Experience.

Quote:

I will not uninstall calibre. I know the program is safe and that's not the point.

I'm just intrigued by theses results and asked someone else to test it on another machine, so I can see if it is an isolated problem, affecting just my system. Maybe my system is infected. Maybe the AV is wrong... Don't know for sure right now.

I am investigating so I can identify the problem. Assuming that the AV is garbage and considering it solved is not very wise. That's really dumb, actually.

It's not Calibre that should go. It's Bitdefender that should go. Bitdefender is giving off too many false positives. Any program that gives Calibre a false positive is lousy.

DNSB · 01-27-2020, 10:32 AM

Quote:

Originally Posted by thiago.eec

Hi, DNSB.

I just downloaded calibre portable from calibre-ebook.com. I scanned calibre portable installer (calibre-portable-installer-4.99.4.exe, beta, 94.3MB) and it came clean.

Then, I installed it and scanned just the executable (calibre-portable.exe, 152KB). Now it is detected by VirusTotal (and my local antivirus, BitDefender).

I ran a system scan and it found nothing else.

Could you please check if your calibre-portable executable (152KB) is detected by VirusTotal (or other AV)?

I get the 16 detections on VirusTotal for the 4.9.1 calibre-portable.exe file.

When I analyze it running in a VM, I do not find any files being written in unexpected locations, no unexpected registry changes, etc. I did get a warning about the launching of executables but that's the whole purpose in life of calibre-portable.exe.

OTOH, some viruses detect when they are running in a VM and do not launch the malicious payload.

On yet another hand, you could always compile calibre-portable.exe yourself and see what VirusTotal, etc. complain about. Though that can be fun--when I played with it, I ran a Linux VM and then ran the VM needed for the Windows compile inside that. To put it gently, it was rather slow.

BetterRed · 01-27-2020, 11:02 AM

Quote:

Originally Posted by thiago.eec

Hi, DNSB. …

Quote:

Originally Posted by JSWolf

Your problem …

Quote:

Originally Posted by thiago.eec

Ok. Very useful …

Quote:

Originally Posted by JSWolf

BitDefender has too …

Quote:

Originally Posted by thiago.eec

Ok. That's …

Quote:

Originally Posted by JSWolf

Experience. …

Quote:

Originally Posted by DNSB

I get the …

:yawn:

Does anyone have any irrefutable evidence or firmly held beliaf that calibre is infested with malware

BR

stumped · 01-27-2020, 11:22 AM

yawning is not helpful

post #27 test results have moved the debate much further forwards than lots of speculation.

specifically, its independent evidence that the file offered for download is clean ( as many have asserted) but that once it is allowed to install, then 16 engines find it suspicious. It's not something that only happens on the OPs PC

that may be an unpalatable truth for some but it shouldn't be yawned away.

And Lots of beating up on one disliked AV does not explain why 15 others agree with it ( and yes I do accept that many say its still OK)

I would ( still) like to see a reasoned explanation of why 16 different engines find something suspicious once the program has installed.

stumped · 01-27-2020, 11:30 AM

small update. a little test of my own, as no one else seemed to have tried malwarebytes pro( which I trust a lot)
I downloaded & installed portable then scanned the install folder:
[ also scanned the downloaded .exe which was clean)

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 27/01/2020
Scan Time: 16:26
Log File: c3ca4c0e-4121-11ea-91fb-90b11c5f3c4f.json

-Software Information-
Version: 4.0.4.49
Components Version: 1.0.785
Update Package Version: 1.0.18282
Licence: Premium

-System Information-
OS: Windows 10 (Build 18362.592)
CPU: x64
File System: NTFS
User:xxx

-Scan Summary-
Scan Type: Custom Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 925
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 0 min, 5 sec

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

01-26-2020, 09:10 PM	#19
DNSB Bibliophagist Posts: 46,355 Karma: 169098492 Join Date: Jul 2010 Location: Vancouver Device: Kobo Sage, Libra Colour, Lenovo M8 FHD, Paperwhite 4, Tolino epos	Just for the heck of it, I went to calibre-ebook.com and downloaded calibre-portable.exe from the 3 links provided. I then generated a SHA-256 for each file with the following results ( I added the site to the filename manually ): Code: Name: calibre-portable-installer-4.9.1_calibre.exe Calibre-ebook download link Size: 98105792 bytes (93 MiB) SHA256: 5D51BA530DBBBA84F4AA80DC785228FCB043AC1EAE19DF45788350C5AE99BDB7 Name: calibre-portable-installer-4.9.1_fosshub.exe Fosshub download link This one has an expiry timer Size: 98105792 bytes (93 MiB) SHA256: 5D51BA530DBBBA84F4AA80DC785228FCB043AC1EAE19DF45788350C5AE99BDB7 Note: the SHA-256 on Fosshub matches the locally generated one. Name: calibre-portable-installer-4.9.1_github.exe Github download link Size: 98105792 bytes (93 MiB) SHA256: 5D51BA530DBBBA84F4AA80DC785228FCB043AC1EAE19DF45788350C5AE99BDB7 Since the SHA-256 values matched, I then headed over to VirusTotal.com and checked the file. I found the file had been previously checked with no detections so I forced a re-detection. Still no hits other than Fireeye timing out and Cylance and Symantec Mobile Insight which couldn't process the filetype. I also ran the .exe through Jotti's malware scan and MetaDefender Cloud which—drumroll, please—found no detections. I'd say that it is safe to install calibre-portable from any of the three links on Kovid's site. Last edited by DNSB; 01-26-2020 at 11:14 PM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Calibre Portable with a portable python install, is it possible?	Vlash	Calibre	9	11-23-2019 10:24 PM
Trojan spyware in calibre mac OS build	zaster	Calibre	9	06-28-2019 03:38 AM
Calibre Portable and Assigned Letter to Portable Drive issue	nkle1128	Library Management	1	03-11-2017 04:11 PM
How do I import Calibre settings from regular Win Calibre to Calibre Portable?	ABW	Calibre	9	05-20-2013 02:34 PM
trojan in calibre 0.5.11?	BookLoverToo	Calibre	5	05-10-2009 01:49 AM

01-26-2020, 03:13 PM	#16
stumped Wizard Posts: 3,305 Karma: 10259306 Join Date: May 2016 Device: kobo forma, Kobo Libra, Huawei media Tab, fire HD10, PW3 HDX8.9,	I am confused by the competing and contradictory claims. We have a link to a page at virustotal saying all clean. But then, We have a different link to the same site in a post saying 16 positive detection reports, but I only count 8 on the actual link page. What is it that 8, or 16, different virus engines find suspect? Why does virustotal seem to change its verdict depending on how the question is phrased? Why is everyone so glib about ignoring 8 different positives and so willing to disbelieve them all. I don't for one minute suppose that Kovid deliberately adds Trojans to his programs, but files can be compromised after being placed on servers for public access

01-26-2020, 03:46 PM	#17
KevinH Sigil Developer Posts: 8,804 Karma: 6000000 Join Date: Nov 2009 Device: many	Virustotal provides the sha256 sum of the binary it tested in that link report, There are 3 places to download calibre-portable from, but at least one of those alternate sites lists a completely different sha256 sum for that file (i could not find a sha256 checksum for the other two sites). So perhaps the person who downloaded the file has an already compromised system or uses a download manager that is compromised which results in an infected download? Not sure either way but if the original is clean (which I believe to be true given Kovid's test results posted) and the sha256 sum of what was tested in the next differs from the original then they are testing two different things.

01-27-2020, 11:22 AM	#29
stumped Wizard Posts: 3,305 Karma: 10259306 Join Date: May 2016 Device: kobo forma, Kobo Libra, Huawei media Tab, fire HD10, PW3 HDX8.9,	yawning is not helpful post #27 test results have moved the debate much further forwards than lots of speculation. specifically, its independent evidence that the file offered for download is clean ( as many have asserted) but that once it is allowed to install, then 16 engines find it suspicious. It's not something that only happens on the OPs PC that may be an unpalatable truth for some but it shouldn't be yawned away. And Lots of beating up on one disliked AV does not explain why 15 others agree with it ( and yes I do accept that many say its still OK) I would ( still) like to see a reasoned explanation of why 16 different engines find something suspicious once the program has installed.

01-27-2020, 11:30 AM	#30
stumped Wizard Posts: 3,305 Karma: 10259306 Join Date: May 2016 Device: kobo forma, Kobo Libra, Huawei media Tab, fire HD10, PW3 HDX8.9,	small update. a little test of my own, as no one else seemed to have tried malwarebytes pro( which I trust a lot) I downloaded & installed portable then scanned the install folder: [ also scanned the downloaded .exe which was clean) Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 27/01/2020 Scan Time: 16:26 Log File: c3ca4c0e-4121-11ea-91fb-90b11c5f3c4f.json -Software Information- Version: 4.0.4.49 Components Version: 1.0.785 Update Package Version: 1.0.18282 Licence: Premium -System Information- OS: Windows 10 (Build 18362.592) CPU: x64 File System: NTFS User:xxx -Scan Summary- Scan Type: Custom Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 925 Threats Detected: 0 Threats Quarantined: 0 Time Elapsed: 0 min, 5 sec -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 0 (No malicious items detected) Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end)

Advert

Advert