R-2.7.2 infected?
For what it's worth, Computer Associates updated their signatures; and eTrust no longer reports the installation program for the Windows version of R-2.7.2 as infected. I found it surprisingly difficult to learn about how the Win32/Adclicker.JO virus operates, and how eTrust detects it. I couldn't even get anyone to admit it was a false positive (though it seems clear now). Regards, Dave
From: r-help-bounces at r-project.org [r-help-bounces at r-project.org] On Behalf Of Ajay ohri [ohri2007 at gmail.com]
Sent: Tuesday, September 23, 2008 1:06 AM
To: Peter Dalgaard
Cc: r-help at r-project.org; Dave DeBarr; Duncan Murdoch
Subject: Re: [R] R-2.7.2 infected?
Sent: Tuesday, September 23, 2008 1:06 AM
To: Peter Dalgaard
Cc: r-help at r-project.org; Dave DeBarr; Duncan Murdoch
Subject: Re: [R] R-2.7.2 infected?
This is what it does. It seems like a false alarm because in case of actual infection it seems quite conspicious Ajay www.decisionstats.com http://www.spywareguide.com/product_show.php?id=2569 Full Name: Win32.AdClicker Websearch Read More Type:Trojan SG Index: 5 [Explain] Removal tools:List of products that detect/remove/protect against Win32.AdClicker: Desktop Anti-malware: Pro User: X-Cleaner Control IM and P2P use, block spyware and other malware: RTGuardian Endpoint Spyware Remediation: Greynet Enterprise Manager IM, P2P control, malware prevention and web filtering in single appliance: Unified Security Gateway Category Description:A Trojan is a program that enables an attacker to get nearly complete control over an infected PC. Frequently used tool by malicious hackers. When this program executes, the program performs a specific set of actions. This usually works toward the goal of allowing the trojan to survive on a system and open up a backdoor . Comment:This Trojan downloads many executable.It changes the autostarter randomly. It also hijacks the desktop and puts a wall paper saying that the system is affected and advertises a sites ?smart-security.info?.It duplicates each and every file which the user creates with the same name and in the same Directory. Properties: Adds other software Autostarts/Stays Resident Installs Through Exploit Opens ports On Tue, Sep 23, 2008 at 1:29 PM, Peter Dalgaard <P.Dalgaard at biostat.ku.dk> wrote: > > Peter Dalgaard wrote: > > Dave DeBarr wrote: > >>> Did you check the md5 checksum on it? > >>> > >> > >> Yes; it matched: 540090dd892657804d1099c54d6f770d > >> > >> > > And it is binary identical to the Austria CRAN one. > >> > >>> You're the first to report it, and 2.7.2 has been out for almost a > >>> month, so I think it's likely that the CRAN copy is uninfected. > >>> > >> > >> Sounds promising. Perhaps it's a false positive from eTrust. > >> > >> > >> > > Likely. A quick Googling indicates that other programs have been > > "caught" too. > > This link is illuminative: > > http://www.cccp-project.net/forums/index.php?topic=2897.0 > > (I wanted to do the same thing with R, but http://www.virustotal.com has > a 20M cap on the file size.) > > -- > O__ ---- Peter Dalgaard ?ster Farimagsgade 5, Entr.B > c/ /'_ --- Dept. of Biostatistics PO Box 2099, 1014 Cph. K > (*) \(*) -- University of Copenhagen Denmark Ph: (+45) 35327918 > ~~~~~~~~~~ - (p.dalgaard at biostat.ku.dk) FAX: (+45) 35327907 > > ______________________________________________ > R-help at r-project.org mailing list > https://stat.ethz.ch/mailman/listinfo/r-help > PLEASE do read the posting guide http://www.R-project.org/posting-guide.html > and provide commented, minimal, self-contained, reproducible code. -- Regards, Ajay Ohri http://tinyurl.com/liajayohri ______________________________________________ R-help at r-project.org mailing list https://stat.ethz.ch/mailman/listinfo/r-help PLEASE do read the posting guide http://www.R-project.org/posting-guide.html and provide commented, minimal, self-contained, reproducible code.