bugGNU Octave - Bugs: bug #57806, Avira detects Trojan in file...

 
 

bug #57806: Avira detects Trojan in file 'libsqlite.3-0.dll'

Submitter:  None
Submitted:  Thu 13 Feb 2020 12:53:40 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Other
Status:  Invalid / Not an Octave Bug Assigned to:  None
Originator Name:  E. Tsoy Originator Email:  -email is unavailable-
Open/Closed:  * Closed Release:  * 5.2.0
Operating System:  * Microsoft Windows Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 29 Feb 2020 08:09:23 AM UTC, comment #6: 

I started this thread. I should inform you that now, after a recent update, Avira does not detect 'libsqlite3-0.dll' as a suspicious file. The issue can be closed. Best wishes and thanks to Octave developers.

Anonymous
Thu 27 Feb 2020 03:56:40 PM UTC, comment #5: 

There is a discussion in the mailing list to handle this issue.

"McAfee whitelist request"
https://lists.gnu.org/archive/html/octave-maintainers/2020-02/msg00148.html

"Worthwhile to submit installers for AV whitelisting?"
https://lists.gnu.org/archive/html/octave-maintainers/2020-02/msg00131.html

And the issue is getting worse. At this moment I'm reading 18 / 71 false positives.
https://www.virustotal.com/gui/file/e1656cdb03908796a9c90eb7409ca44f8e859ab73f44a498cadc68c00a3b5ff8/detection

I vote to keep this bug report open.

Armin Müller <arm_in>
Thu 27 Feb 2020 02:22:42 PM UTC, comment #4: 

Dear all:

It took a while, because of upload problems, but Sophos has confirmed this to be a false positive and has updated their scanning profiles so it is no longer seen as infected.

I urge others who have this problem with other virus scanners to alert them of the problems.

Olaf Bousche <olaf789>
Thu 20 Feb 2020 01:46:45 PM UTC, comment #3: 

Dear all:

Any positive virus signal must be dealt with in the proper manner. Even if a file originates from a reliable source does not guarantee it is not infected. Anyone can be hacked. I recommend to not close the issue until you have actually verified through independent means that there is no real problem.

In the mean time: I have submitted the problem to Sophos who does our company virus scanner. Perhaps others can do this for their virus scanners?

Olaf

Olaf Bousche <olaf789>
Thu 13 Feb 2020 07:18:11 PM UTC, comment #2: 

FYI, Virustotal says:

"7 engines detected this file"


Avast => FileRepMalware
AVG => FileRepMalware
F-Secure => Trojan.TR/AD.TrickBot.byik
Ikarus => Trojan.TrickBot
McAfee => Artemis!699A782FC1BD
McAfee-GW-Edition => BehavesLike.Win64.AdwareTskLnk.bh
Qihoo-360 => Generic/Trojan.BO.b3c

Armin Müller <arm_in>
Thu 13 Feb 2020 06:54:53 PM UTC, comment #1: 

Thanks for the bug report. This is likely a false positive from your anti-virus software. You might want to take this up with Avira, send them a copy of the SQLite library DLL and tell them that the scanner falsely detects a virus signature.

Mike Miller <mtmiller>
Group Member
Thu 13 Feb 2020 12:53:40 PM UTC, original submission:  

I have downloaded a zip-file octave-5.2.0_1-w64.zip (~530MB) from GNU Octave website. During extraction of files from the zip-file, antivirus program Avira detected and qurantined a suspicious file 'libsqlite3-0.dll'. Avira says that the file has trojan 'TR/AD.TrickBot.byik'. When I start Octave via octave.vbs, the program gives a message window (since Avira removed the library from Octave folder):
"Octave Documentation: Could not copy help collection to
temporary file. Search capabilities may be affected. Cannot load sqlite database driver."
However, it seems that Octave works fine except of Documentation or Help feature.
I use Windows 8, Avira Product Version: 15.0.2001.1707.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by olaf789 (Posted a comment)
  • -email is unavailable- added by arm_in (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-02-13 mtmiller StatusNone Invalid / Not an Octave Bug
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code