search

haskell-infra / hl

Haskell web site (old -- see new repo at https://github.com/haskell-infra/www.haskell.org)
http://haskell.org/
BSD 3-Clause "New" or "Revised" License
158 stars 92 forks source link

Trojan:Win32/Cloxer.D!cl in Windows 8.6.3 64-bit Uninstall.exe #249

Closed timhutton closed 5 years ago

timhutton commented 5 years ago

Windows Defender has just identified a virus in Haskell Platform\8.6.3\Uninstall.exe on my machine. I installed the 64-bit Windows version of Haskell Platform 8.6.3.

It's possible that file became infected after the download but please check your files, to be safe.

ndmitchell commented 5 years ago

@gbaz - who prepared this file? Note it's also possible it's a false positive, as it somewhat common with virus scanners.

gbaz commented 5 years ago

This was prepared by @randen who maintains the HP releases. I strongly suspect it is a false positive. (nb the typically correct place to file platform tickets is https://github.com/haskell/haskell-platform/issues)

gbaz commented 5 years ago

(note a number of other hits in google for this string yield other projects wrongly getting flagged -- https://github.com/gildor2/UModel/issues/87 https://www.reddit.com/r/usenet/comments/a97vuo/trojanwin32cloxerdcl_in_sabnzbd236winsetupexe/ and https://gitlab.com/gitlab-org/gitlab-runner/issues/3875)

randen commented 5 years ago

(Just saw this)

I have submitted to Microsoft (Windows Defender Security Intelligence) the uninstall.exe file for analysis.

To @timhutton, is it possible to see if you have the latest definititions for Windows Defender, and to re-scan and see if it is still being flagged? Also, I am assuming you are on Windows 10? (I am on Windows 7 and have Security Essentials but not Windows Defender).

randen commented 5 years ago

From MS: "Analysis completed ... Final Determination ... Not malware"

timhutton commented 5 years ago

I just tried it on a different machine, also with an up-to-date Windows Defender, and got nothing. So I'm closing this as a false alarm.