trojan in 5.10.1

[ownedbycats]

Originally Posted by BetterRed

Did you upload that calibre-64bit-5.10.1.msi to VT?

I just uploaded the calibre-64bit-5.10.1.msi I got from github this morning, and I got this from VT ==>> https://www.virustotal.com/gui/file/...c1797/behavior

Nothing written to Windows only user Local\Temp

Note - I didn't get the Microsoft Sysinternals Sysmon option (the one your link goes to), I only got the VirusTotal Jujubox option. I have no idea why.

I uploaded calibre.exe (5.10.1) from the application folder.

[kovidgoyal]

Originally Posted by ownedbycats

I uploaded calibre.exe (5.10.1) from the application folder.

calibre.exe by itself is just a thin wrapper, responsible for loading actual code, if you uploaded it by itself, there is no way in hell it would have even run, let alone done anything else. There's the entire source code for it https://github.com/kovidgoyal/calibr...windows/main.c

all it does is load calibre-launcher.dll which it cannot even do given you didnt upload it.

And calibre-launcher.dll is in turn a thin wrapper that starts the python interpreter that loads the actual calibre codebase, from the bypy-frozen file in the installation folder.

[ownedbycats]

I figured it was just a wrapper (filesize isn't that big), I just uploaded it because it was one of the files mentioned as being flagged.

[banana22]

Good news , Avira is no longer detecting anything from Calibre on my computer.When re scanning on virustotal they are still flagged. I can only assume because they have been flagged before there must be a problem updating the info and they are not actually being re scanned.
Thanks Kovid Goyal for the great program : )

[varis1]

as banana 22 posted:
avira has corrected the false positve detection.
This is support!!!

[JSWolf]

Regardless, Avira is known to noticeably slow down the computer. Avia, AVG, Norton, McAfee, FSecure are all sloths.

[banana22]

Originally Posted by JSWolf

Regardless, Avira is known to noticeably slow down the computer. Avia, AVG, Norton, McAfee, FSecure are all sloths.

You really should get your facts straight before posting negative untruths with such anger
If you read the latest reports from by far the biggest and independent AV testing site, you will see that not only did the windows defender you keep banging on about was the worst for performance it was near the bottom for false positives too.
https://www.av-comparatives.org/test...-october-2020/

https://www.av-comparatives.org/test...eptember-2020/

[JSWolf]

Originally Posted by banana22

You really should get your facts straight before posting negative untruths with such anger
If you read the latest reports from by far the biggest and independent AV testing site, you will see that not only did the windows defender you keep banging on about was the worst for performance it was near the bottom for false positives too.
https://www.av-comparatives.org/test...-october-2020/

https://www.av-comparatives.org/test...eptember-2020/

I don't have false positives with Windows Security. I also find Windows Security not to be slow. I've looked up Avira and it is found to be slow. So no, I don't trust that site. They've got it wrong.

[BetterRed]

Originally Posted by banana22

You really should get your facts straight before posting negative untruths with such anger
If you read the latest reports from by far the biggest and independent AV testing site, you will see that not only did the windows defender you keep banging on about was the worst for performance it was near the bottom for false positives too.
https://www.av-comparatives.org/test...-october-2020/

https://www.av-comparatives.org/test...eptember-2020/

Originally Posted by BetterRed

The only malware I've had in a decade came with Piriform's CCleaner soon AFTER it was bought by Avast, VT didn't find it, MS Defender found it. And it wasn't a false alarm, the CEO of Avast published a mea-culpa - speculation was it was put there by a disgruntled Piriform exec who didn't get to keep their job.

BR

The VT (VirusTotal) suite included Avira, and AVG, Bitdefender, Kasperky and all the usual suspects, and Avast itself of course. But none of them detected the trojan that Avast distributed in its newly acquired CCleaner. Obviously MS Defender was not included in the VirusTotal suite. Whenever they have included it the howls of protest from the anti-MS crowd force them to remove it --- I wonder if they are the same crowd who claim the SARS-Cov2 pandemic is a conspiracy perpetrated by Bill Gates.

An occasional false positive might be acceptable, but a missed positive much less so.

To their credit, on being informed of the problem Avast removed the infected CCleaner from their downloads page immediately, predictably the crappy click-bait laden download sites like CNN didnt. The reputational damage was borne by CCleaner and its sister products - most people still don't know Avast gobbled up Piriform.

That wasn't the first time a program acquired in an M&A deal was deliberately infected by a disgruntled employee.

BR

[ownedbycats]

A few years back, Handbrake (an open-source video encoder) had their download server compromised and the Mac package replaced with a trojan. It was after that happened that I started verifying the file hashes even if the file comes from a trusted source.

[JSWolf]

Originally Posted by ownedbycats

A few years back, Handbrake (an open-source video encoder) had their download server compromised and the Mac package replaced with a trojan. It was after that happened that I started verifying the file hashes even if the file comes from a trusted source.

How do you validate the file hash if the site doesn't give the hash? How do you know if the hash given is correct for a clean copy of the program?

[ownedbycats]

Originally Posted by BetterRed

I wonder if they are the same crowd who claim the SARS-Cov2 pandemic is a conspiracy perpetrated by Bill Gates.

Here in Canada, some cell phone towers were set on fire by idiots who believed that somehow 5G was the cause of COVID-19.

The best part is that none of the the cell towers were 5G.

[ownedbycats]

Originally Posted by JSWolf

How do you validate the file hash if the site doesn't give the hash? How do you know if the hash given is correct for a clean copy of the program?

Unfortunately, I can't. But if there's a mismatch between hash and file, it's a red flag.

[hobnail]

Originally Posted by ownedbycats

Here in Canada, some cell phone towers were set on fire by idiots who believed that somehow 5G was the cause of COVID-19.

Don't they cause brain cancer?

[DNSB]

Originally Posted by ownedbycats

Here in Canada, some cell phone towers were set on fire by idiots who believed that somehow 5G was the cause of COVID-19.

Originally Posted by hobnail

Don't they cause brain cancer?

What I loved was the group a few years back who protested having WiFi in schools since WiFi was linked to diseases and cancers. The same kids who are wandering around with their cellphones glued to their ears. Sadly, most of their links that "proved" their claim ranged from anecdotal to bad science.