[issue19913] TR/Crypt.XPACK.Gen-4 in easy_install.exe

Vinay Sajip added the comment: I've released distlib 0.1.5 on PyPI. This release uses uncompressed launchers which (at the time of writing) pass the checks on virustotal.com. -- resolution: -> fixed status: open -> closed ___ Python tracker

[issue19913] TR/Crypt.XPACK.Gen-4 in easy_install.exe

Vinay Sajip added the comment: This commit in distlib uses uncompressed launcher executables which pass the virustotal.com checks: https://bitbucket.org/pypa/distlib/commits/e23c9e4fd3125fa88063de4dec80367b1ac82aff -- ___ Python tracker

[issue19913] TR/Crypt.XPACK.Gen-4 in easy_install.exe

Vinay Sajip added the comment: It's in the docs at e.g. http://distlib.readthedocs.org/en/latest/reference.html?highlight=launcher#distlib.scripts.ScriptMaker.__init__ and in the code at e.g. https://bitbucket.org/vinay.sajip/distlib/src/a50562ee0b535b2966948f1a657c1cac4c1536eb/distlib/scripts

[issue19913] TR/Crypt.XPACK.Gen-4 in easy_install.exe

Christian Heimes added the comment: How are you creating these files anyway? I can't find any documentation or source files in distlib. -- ___ Python tracker ___ ___

[issue19913] TR/Crypt.XPACK.Gen-4 in easy_install.exe

Vinay Sajip added the comment: Hmmm. I use mpress (http://www.matcode.com/mpress.htm) to compress the executables. These AV results seem to be false positives, given that the files are green-lit by Symantec, Sophos, McAfee, Kaspersky, F-Prot, AVG, Avast and a bunch of other reputable AV produc

[issue19913] TR/Crypt.XPACK.Gen-4 in easy_install.exe

Christian Heimes added the comment: I found the offenders. distlib's wrapper scripts are detected as malicious programs by some anti virus programs. pip/_vendor/distlib/t32.exe https://www.virustotal.com/de/file/d06ad386d9dab9d08bdc01a3a14c713bd90b218ec4893c22da819826bd452e31/analysis/13864298

[issue19913] TR/Crypt.XPACK.Gen-4 in easy_install.exe

Christian Heimes added the comment: 7 of 47 AV programs detect malicious software in PIPs easy_install.exe: Agnitum Packed/MPress 20131206 AhnLab-V3 Trojan/Win32.TesA 20131206 AntiVir TR/Crypt.XPACK.Gen4 20131206 BkavHW32.CDB.9028 20131206 McAfee-GW-Edit

[issue19913] TR/Crypt.XPACK.Gen-4 in easy_install.exe

New submission from Christian Heimes: Since today test_venv fails because Avira Antivir claims that easy_install.exe contains the trojan horse TR/Crypt.XPACK.Gen-4. I haven't seen the issue before. I'm running CPython default on Windows 7 64bit with Avira 13. -- files: easyinstall.png