Re: miktex update flagged as containing malware - false positive or not?

"George N. White III" <[email protected]>
Newsgroups gmane.comp.tex.miktex
Message-ID <CAKTOP46vtcQ2NuKuvGW02d7yq-==ORGs2rBGNoEYqqwDBpmNPA@mail.gmail.com>
On Fri, Nov 11, 2016 at 10:31 AM, Barraclough, Dominic (ext. 414) <
[email protected]> wrote:

> Hi
>
> Before approaching my companies IT people (not the most light hearted and
> easy going group) I'm seeking help on the following.
>
> I have very recently installed Miktex on a win 7 system and now wish to
> perform an update on the installation, however it appears that the
> antivirus software running on all incoming downloads is flagging the update
> as containing a possible virus. I'm assuming that this is a false positive.
> Can any body through any light on this issue? Additional information could
> improve my case with the IT department to have the file download unblocked.
>
> For what its worth, the scanner provide the following rather cryptic feed
> back
> Virus/PUS: "PUS:Downloader.Win32.DownMan.hl" found!
> URL: http://www.pirbot.com/mirrors/ctan/systems/win32/miktex/tm/p
> ackages/miktex-bin-2.9.tar.lzma


1.  Enter the URL at https://www.virustotal.com and print the results to
PDF so you can attach them to your IT ticket.

2.  A malware site may detect access from virustotal and provide an
uninfested file, or something close to your PC could be redirecting http
URL's to bad sites. Try to download the same file from a CTAN mirror at a
major university using rsync if possible, otherwise, use ftp.  If the AV
scanner gives the same response, chances are high that you have a false
positive.

MiKTeX is quite widely used.  Most AV vendors act quickly to eliminate
false positives, so the problem may go away in a few days even if you do
nothing.

-- 
George N. White III <[email protected]>
Head of St. Margarets Bay, Nova Scotia
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi
_______________________________________________
Q: How can I leave the mailing list?
A: See http://docs.miktex.org/faq/support.html#leavingml
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.