False positive in emacs-22.2-bin-i386.zip?

False positive in emacs-22.2-bin-i386.zip?

[Angelo Graziosi]

After unpacking
ftp://ftp.gnu.org/gnu/emacs/windows/emacs-22.2-bin-i386.zip, running under
Cygwin,

$ clamscan -r emacs-22.2

the result is:

...
emacs-22.2/bin/ddeclient.exe: Trojan.Hijacker.Qhost FOUND
emacs-22.2/bin/digest-doc.exe: Trojan.Hijacker.Qhost FOUND
emacs-22.2/bin/hexl.exe: Trojan.Hijacker.Qhost FOUND
emacs-22.2/bin/sorted-doc.exe: Trojan.Hijacker.Qhost FOUND
...

----------- SCAN SUMMARY -----------
Known viruses: 306133
Engine version: 0.93
Scanned directories: 43
Scanned files: 2777
Infected files: 4
Data scanned: 129.43 MB
Time: 32.375 sec (0 m 32 s)

'clamscan' belongs to clamav-0.93-1 package in Cygwin.


Cheers,
   Angelo.

Re: False positive in emacs-22.2-bin-i386.zip?

[Jason Rumney]

Angelo Graziosi wrote:
> After unpacking
> ftp://ftp.gnu.org/gnu/emacs/windows/emacs-22.2-bin-i386.zip, running under
> Cygwin,
>
> $ clamscan -r emacs-22.2
>
> the result is:
>
> ...
> emacs-22.2/bin/ddeclient.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/digest-doc.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/hexl.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/sorted-doc.exe: Trojan.Hijacker.Qhost FOUND
> ...
>   

I fed ddeclient.exe to the online scanner at http://virusscan.jotti.org/ 
(and others which only run one virus scanner on the file). ClamAV was 
the only scanner to report anything, so I think it was likely a false 
positive. The report from the above website was:

 POSSIBLY INFECTED/MALWARE (Note: this file was only classified as 
malware by scanners known to generate more false positives than the 
average scanner. Do not consider these results definately accurate. 
Also, because of this, results of this scan will not be recorded in the 
database.)

Re: False positive in emacs-22.2-bin-i386.zip?

[Jason Rumney]

Angelo Graziosi wrote:
> $ clamscan -r emacs-22.2
>
> the result is:
>
> ...
> emacs-22.2/bin/ddeclient.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/digest-doc.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/hexl.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/sorted-doc.exe: Trojan.Hijacker.Qhost FOUND
> ...
>   

This seems to be resolved in the latest ClamAV virus database. Thanks 
for reporting it.

Re: False positive in emacs-22.2-bin-i386.zip?

[Angelo Graziosi]

On Fri, 6 Jun 2008, Jason Rumney wrote:

> This seems to be resolved in the latest ClamAV virus database.

GOOD news!!!

Thanks,
    Angelo.