Re: Problem with Windows install files newer than 2.5.2 - Flagged as Virus?

David Fenske wrote:
>
> Thanks for the suggestions, sumlabi@gmail.com. On your suggestion about
> looking at security software, I checked my Watchguard firewall logs.
> Apparently, Watchguard suspects that there is a virus contained in the
> Windows executable. I'm sure this is just some code component that's a
> false positive, but if it helps anyone else, here is the logged message
> from the firewall:
>
> Jan 16 07:50:25 p
> roxy disp="Deny"
> pri="3"
> policy="svc:21"
> src_ip="192.168.1.14"
> dst_ip="130.89.175.51"
> pr="http/tcp"
> src_port="54391"
> dst_port="80"
> src_intf="eth1-Trusted"
> dst_intf="eth0-WAN0"
> src_ip_nat="165.236.180.130"
> src_port_nat="31350"
> rc="594"
> msg_id="262184"
> msg="ProxyDeny: HTTP Virus found"
> proxy_act="HTTP-Proxy" virus="Trojan.Agent-65355"
> host="www.abisource.com"
> path="/downloads/abiword/2.6.5/Windows/abiword-setup-2.6.5.exe"
> I don't know the easiest way to submit this to the code maintainers, but
> they should know that a very common firewall is flagging the executable
> as containing a virus.
>
> Thanks, David
>

Doesn't surprise me - I don't recall hearing much about that firewall,
though, so I wonder how common it is. In any case, a number of
low-quality antivirus engines frequently flag installers made with the
software we use (NSIS) as containing viruses, simply because some
viruses/trojans use that software as well (since it is powerful and
customizable). The problem is with your antivirus, and there is nothing
we can do: you might want to submit a complaint and/or change products
to something more reliable.

PS. You got it to the code maintainers.

Ryan

-- 
Ryan Pavlik
www.cleardefinition.com
#282  +  (442) -  [X]
A programmer started to cuss
Because getting to sleep was a fuss
As he lay there in bed
Looping 'round in his head
was: while(!asleep()) sheep++;
-----------------------------------------------
To unsubscribe from this list, send a message to
abiword-user-request@abisource.com with the word
unsubscribe in the message body.