Fwd: clamtk detects setuptools-0.6c11-py2.7.egg Packer.MingwGcc-2 virus

2013-07-23 Thread M Rusli
Hi Please take note of the issues. Thank you. -- Forwarded message -- From: M Rusli Date: Wed, May 8, 2013 at 12:54 AM Subject: Fwd: clamtk detects setuptools-0.6c11-py2.7.egg Packer.MingwGcc-2 virus To: Dave M -- Forwarded message -- From: Tom Judge

Re: clamtk detects setuptools-0.6c11-py2.7.egg Packer.MingwGcc-2 virus

2013-05-06 Thread Tom Judge
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Rusli, I have sent this information over to the ClamAV detection team, to validate that the signature is correct. Could you please send me a copy of the file off list? Thanks Tom Judge - -- Senior Research Engineer Sourcefire Vulnerability Rese

Re: clamtk detects setuptools-0.6c11-py2.7.egg Packer.MingwGcc-2 virus

2013-05-04 Thread M Rusli
Hi Dave, Thanks! Clamav scan engine have been updated to 0.97.8. On Sat, May 4, 2013 at 7:54 PM, Dave M wrote: > Hi, > > It's okay to check things with PUA settings - sometimes they really > are "unwanted" applications. You did the right thing by asking others > to verify and submitting it

Re: clamtk detects setuptools-0.6c11-py2.7.egg Packer.MingwGcc-2 virus

2013-05-04 Thread M Rusli
Hi Dave, I did another scan and this time I disable the PUA settings. And clamtk did not detect any virus. I did double confirm with virustotal. And it did not detect anything. But when I do a scan again with PUA, it detected as PUA.Win32.PackerMingwGcc-2 virus. By the way, clamav have an updat

clamtk detects setuptools-0.6c11-py2.7.egg Packer.MingwGcc-2 virus

2013-05-04 Thread M Rusli
Hi I did a full scan on my computer with up-to-date virus of clamtk. It indicates that the /usr/local/lib/python2.7/site-packages/setuptools-0.6c11-py2.7.egg contains PUA.Win32.PackerMingwGcc-2 virus. Can you verify whether this is a PUA virus? Thank you. Rusli

Re: clamtk detects setuptools-0.6c11-py2.7.egg Packer.MingwGcc-2 virus

2013-05-04 Thread Dave M
Hi, I'm not sure what that file is, but you could verify with that package owner's upstream that it's good to go. Keep in mind that the "threat" name is "PUA" (for potentially unwanted application) and seems to be warning based on the type of packer or compiler used. In fact, you probably have t