trojan in 5.10.1

[varis1]

i use calibre portable, but it was only a little problem to reinstall 5.9 because the 4 incriminated files were locked. maybe you can try to install to a different directory or use portable.

[varis1]

Originally Posted by JSWolf

Delete Avira Pro. It's worthless. Run Windows Security instead as it works much better. Any AV that thinks Calibre is infected when direct downloaded from the Calibre website is not a good idea to use.

you give the best tips, avira definitely isn't worthless, and keep me away from this microsoft s...

[Leonatus]

It seems to me that at the install process, Calibre creates the directory itself. I seem to not beeing able to control this.



Edit: Hm, strange. Now, I de-activated Avira once more, re-started the computer, making sure that Avira is still de-activated, and re-installed Calibre. This time it worked. No idea what had happened.

[JSWolf]

Originally Posted by ReaderX

I have experienced the same issue here, on Windows 10 with F-Secure "Safe Online". Prompted for an update by the Calibre app - as so many times before - I downloaded calibre-5.10.1.msi from the Calibre website (guided there by the app). Whilst installing, F-Secure had branded calibre.exe as "Trojan.TR/Crypt.XPACK.Gen". NB: all this happened silently on the background. I only noticed something was wrong when I tried to add a new e-book and was prevented to do so.

I almost immediately assumed we're dealing with a false positive here, but F-Secure kept on removing it, even after I excluded it (and even temporarily turned protection off altogether).

Long story short: I had to uninstall Calibre (even that was somewhat complicated since F-Secure had hijacked the calibre.exe file) and reinstall Calibre 4.17.0.

Be it what it may be, methinks it would be a good idea if Calibre and F-Secure got their heads together and straighten this issue out. The result is that Calibre 5.10.1 is unusable in this setting. And I'm guessing this will affect many more Calibre-users running F-Secure on Windows 10.

There's no need for Kovid to get together with the F-Secure people. The problem is 100% on the F0Secure side of things.F-Secure is garbage, It need to be uninstalled/deleted and never used again. I've using Windows 10 and Windows Security and I have not once had an issue with a false positive with Calibre.

So say goodbye to F-Secure and never look back.

One other thing. If you are going to run Calibre 4 after running Calibre 5, you HAVE to install Calibre 4.23 because Calibre 5 has a new database format and Calibre 4.23 is the only Calibre 4 version that's compatible.

[JSWolf]

Originally Posted by BoerOpi

Same here on windows 10 64 bit
Scanned by avira

Reinstall previous version does not work because hidden directory /program files/calibre2 is not accesible

Had to restore entire comp from recent backup.

Say goodbye to Avira as it's garbage. It's time to take out the trash.

Any AV that thinks Calibre is a virus/trojan garbage and needs to be deleted.

[JSWolf]

Originally Posted by Leonatus

Windows 10, 32 bit. Avira (free).
At downloading/installing Calibre 5.10, I got the same message that varis1 reported. I tried some things, at last de-activated Avira and tried to install Calibre again. But now, access to the directory "Calibre2" is denied: I need rights (which ones is not declared). Of course, I'm administrator and have verified this. But nothing helps.
Someone who could give some advice? - gratefully appreciated!

Edit: Also install of a former Calibre version doesn't work.

Obviously you don't get it. Avira is messing with Calibre and your computer. It's garbage. Uninstall it and delete any traces of it. Just run Windows Security. That's all you need to do.

Originally Posted by Leonatus

It seems to me that at the install process, Calibre creates the directory itself. I seem to not beeing able to control this.


Edit: Hm, strange. Now, I de-activated Avira once more, re-started the computer, making sure that Avira is still de-activated, and re-installed Calibre. This time it worked. No idea what had happened.

It worked because Avira is not running. just get rid of it. Avira is blocking access to the Calibre directory and Calibre. It is taking over. Uninstall it forever.

[JSWolf]

Originally Posted by varis1

you give the best tips, avira definitely isn't worthless, and keep me away from this microsoft s...

Avira is garbage/worthless. Just look at the problems that @Leonatus is having. Also, it thinks Calibre is a problem when it's not. Microsoft Security has never once found Calibre to be a problem. Also, MS Security does not slow down the computer as much as some AV does. When an AV finds a clean copy of Calibre to be a problem, the problem is with the AV, not Calibre.

Do you really want to run Avira when you know it doesn't like Calibre? Having Avira/any AV ignore Calibre is not a good idea because if your system did become infected and Calibre got infected, you'd want to know.

It was free. You didn't pay for it. So you lose nothing but gain the ability to run Calibre by uninstalling it.

[ownedbycats]

I wonder, though, what change was made so at least two antiviruses are flagging it.

VirusTotal notes that calibre.exe does write to a file inside of the Windows folder (udhisapi.dll, universal plug & play), which may be seen as a red flag. But I think older versions did this too.

Executable compression, perhaps? Antiviruses also like to complain about that as they're often used by bad actors.

[theducks]

Originally Posted by ownedbycats

I wonder, though, what change was made so at least two antiviruses are flagging it.

VirusTotal notes that calibre.exe does write to a file inside of the Windows folder (udhisapi.dll, universal plug & play), which may be seen as a red flag. But I think older versions did this too.

Executable compression, perhaps? Antiviruses also like to complain about that as they're often used by bad actors.

There are fingerprints that the AV community use. somehow there is a match to some part (module) that is common in the open software community.

[DiapDealer]

Running another full-blown, realtime antivirus scanner on top of Windows Defender on Windows 10 almost invariably causes more issues than it catches. And any antivirus software that makes it difficult or impossible for users to completely exempt executables/folders should not be trusted.

Unless you're in the habit of taking ridiculous risks, there really is no need to run anything other than the built-in Defender on Windows 10. And if you ARE in the habit of taking ridiculous risks, no amount of antivirus protection is going to save you anyway.

[varis1]

Originally Posted by JSWolf

Avira is garbage/worthless. Just look at the problems that @Leonatus is having. Also, it thinks Calibre is a problem when it's not. Microsoft Security has never once found Calibre to be a problem. Also, MS Security does not slow down the computer as much as some AV does. When an AV finds a clean copy of Calibre to be a problem, the problem is with the AV, not Calibre.

Do you really want to run Avira when you know it doesn't like Calibre? Having Avira/any AV ignore Calibre is not a good idea because if your system did become infected and Calibre got infected, you'd want to know.

It was free. You didn't pay for it. So you lose nothing but gain the ability to run Calibre by uninstalling it.

You are talking about things you don't know/understand!

avira pro is not free, has a competent support and works very well!

why you always talk about the windows security, which is working not good, has no support and you are always sending your personnel data to richmond?

are you paid by microsoft???

[ownedbycats]

Originally Posted by varis1

are you paid by microsoft???

No, he has very strong opinions that are difficult to change.

[BetterRed]

Originally Posted by ownedbycats

I wonder, though, what change was made so at least two antiviruses are flagging it.

VirusTotal notes that calibre.exe does write to a file inside of the Windows folder (udhisapi.dll, universal plug & play), which may be seen as a red flag. But I think older versions did this too.

Really, did they say which udhisapi.dll, the one in System32 or SysWOW64?



I just installed calibre 5.10.1 and neither appears to have changed. My records show I installed Windows security update (KB4577266} on 2020-09-09 which is the date the udhisapi.dll files were last updated.

BR

[JSWolf]

Originally Posted by varis1

You are talking about things you don't know/understand!

avira pro is not free, has a competent support and works very well!

why you always talk about the windows security, which is working not good, has no support and you are always sending your personnel data to richmond?

are you paid by microsoft???

My mistake. It was @Leonatus who is running the free version of Avira. But both versions have the same underlying flaw.

I know what I am taking about. I've read about Windows Security from a number of different reliable sites and they say it is good. Windows Security does have a lot of support from Microsoft. They update it quite often. It is not noticeably slow and it has a very good track record for not finding false positives.

I talk of Windows Security because it works well and does not get in the way of Calibre. I have used the AV that comes with Windows since the free version of AVG noticeably slowed down my computer. And that was with Windows 7. So iIve been running Windows Defender/Security for a rather long time.

Tom's Guide is a well respected tech website and they give Microsoft's AV a good review.

https://www.tomsguide.com/uk/reviews/windows-defender

[JSWolf]

Originally Posted by ownedbycats

No, he has very strong opinions that are difficult to change.

But do you disagree with me?