Avira sees TR/Crypt.XPACK.Gen2 in May1-11 Nightly

General discussions about Inkscape.
sherianne
Posts: 2
Joined: Wed May 04, 2011 4:17 pm
Location: Toronto

Avira sees TR/Crypt.XPACK.Gen2 in May1-11 Nightly

Postby sherianne » Wed May 04, 2011 5:20 pm

Hi Everyone;
I am getting a virus detection or false positive in:
May1-11 Win32 Nightly Build download archive: inkscape_r10194-201105011046.7z
from: Inkscape Win32 Snapshots
Avira (product + profile updated May3-11) sees: TR/Crypt.XPACK.Gen2
in files: inkview.exe, inkscape.exe

It is likely a false positive but I cannot risk it having just recovered from a virus storm and stealth rootkit. I could not find a single contact email anywhere on the Inkscape site and it is not practical for me to have to join a discussion list or use IRC. Perhaps there needs to be a way to bring such things to the attention of those handling the main and nightly releases.


I understand there have been false positives before:
1. Inkscape. Draw Freely
AntiVirus False Positive with Trojan.Zlob
July 3, 2006 - A few users are reporting that Windows anti-virus programs (Norton Antivirus and Symantec Scanner) are giving a false positive on the Inkscape Windows binary. These programs are erroneously giving indicators of Trojan.Zlob. It is thought that the NSIS installer we use for installing Inkscape on Windows was incorrectly listed as a trojan by the antivirus vendors, but this is not yet confirmed; others have reported that there were similar problems reported in other Open Source applications that use NSIS on Windows. This problem appears to be affecting only some Windows machines. We don't know what the best work around is, but make sure to use the latest antivirus definitions (it may already been fixed).
2. Kaspersky reporting Trojan • Topic • InkscapeForum.com


I realize this is not a support forum.
This is also my 1st post. I have been planning to join for quite awhile and this prompted me. I am preparing to work on an illuminated mss digitally to be produced on papyrus also. The Inkscape Calligraphy tool is the best I have been able to find despite some issues. I have small and large Inkscape wishlists and some useful tools that may be of interest to others practicing the Art of Inkscapistry.

May the Sun Be with You!

User avatar
brynn
Posts: 10309
Joined: Wed Sep 26, 2007 4:34 pm
Location: western USA
Contact:

Re: Avira sees TR/Crypt.XPACK.Gen2 in May1-11 Nightly

Postby brynn » Thu May 05, 2011 3:47 am

Hi sherianne,
Image
Welcome to the forum!

I'm sorry you've had some trouble with viruses. I agree that it is probably a false positive, but I also think one can't be too careful. I'm not sure who is responsible for this type of problem. There are a handful of developers who participate here, but likely those who handle this won't see this message. Maybe ~suv would know, who hopefully will see this and reply? I know I've been unsure how to answer other messages about virus scan results.

Do you have any other anti-virus scanners? Or would you consider using an online scan? If so, would a potentially clean result from an online scan be reassuring to you? Or if there is some kind of deadline, would you be able to use the last stable release of 0.48.1, just until the next nighly/dev comes out?

I realize this is not a support forum.

I guess it depends which forum you mean. If you're speaking of this "General Discussions" forum, it's not really for support, although a lot of support topics end up getting answered here. But if you're talking about InkscapeForum.com, yes this forum/website IS a support forum! But the place to ask for help using Inkscape, is the "Help with using Inkscape" forum. (I hope that made sense.)

Have you looked at the Inkscape Wiki yet? http://wiki.inkscape.org/wiki/index.php/Inkscape I'm thinking there might be something there about it false positive virus reports..... I'm sorry, I wish I could be more help :(

~suv
Posts: 2272
Joined: Sun May 10, 2009 2:07 am

Re: Avira sees TR/Crypt.XPACK.Gen2 in May1-11 Nightly

Postby ~suv » Sat May 21, 2011 7:47 pm

It's a false positive.

I just talked to UweSch who builds, packages and uploads the release versions as well as the development snapshots of the Windows port of Inkscape:
  1. All packages are tested and scanned (with up-to-date database) before getting uploaded to sourceforge or modevia
  2. UweSch downloaded and tested the mentioned archive (inkscape_r10194-201105011046.7z) from modevia and confirms that it is free of any viruses / trojans (i.e. it is safe to use)


Return to “General Discussions”