469988 - Avast detects Win32:Trojan-gen(Other) in 2008-12-17 nightly

Status: RESOLVED WORKSFORME

(Release Engineering :: General, defect)

Description

[Lupatrian]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20081216 Minefield/3.2a1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2a1pre) Gecko/20081216 Minefield/3.2a1pre

On today's Minefield build installer (Win), Avast AV stopped the download, saying that a virus was detected (and not "MIGHT be a virus", but "IS a virus"). The download was 75-80% complete when it tripped. I let it abort/didn't install. Any reason that the new build would trip Anti-Vi? 

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[(not currently active) Ted Mielczarek]

Not a build config bug.

I would suspect with high certainty that it's a false positive.

Comment 2

[Mike Beltzner [:beltzner, not reading bugmail]]

We should probably run a scan across whatever machine we use to produce the windows nightlies. I, too, suspect false positive, but one can never be too certain.

Nothing suspicious looking in the pushlog ...

Comment 3

[Johnathan Nightingale [:johnath]]

http://www.virustotal.com/analisis/9f0797cd4a413bd72da0dd3d6c817aa0

VirusTotal confirms that Avast and GData (and only those two) see W32:Trojan-gen in it.  That could be because they use the same signatures (eSafe just says "suspicious") or because they're particularly ahead of the curve, but no other scanners corroborate it.

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

Can we get details from Avast about what pattern it matched?

Comment 5

[Peter Lairo]

BTW: I downloaded the ZIP file, and that worked fine.

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central/

NB: I just reported this in mozilla.dev.apps.firefox

Comment 6

[Chris AtLee [:catlee]]

I've seen virus scanners think NSIS code was a trojan.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

We did take a new NSIS patch recently ...

Comment 8

[Robert Strong (they/them - no direct email)]

Avast has in the past reported false positives on NSIS. Previously this has been due to some antivirus vendors trying to catch a program that uses one of the NSIS plugins which we share with other applications that use NSIS and not due to any changes to our installer code. We also added additional file info of the installer for antivirus to more easily identify that our installer shouldn't be flagged in bug 445276.

Comment 9

[Robert Strong (they/them - no direct email)]

I looked around for reports of NSIS along with Win32:Trojan-gen and haven't seen anything recent. It may be that Avast is detecting something else like the 7-Zip self extracting archive... when launching the exe does it display the extracting dialog?

Comment 10

[Lupatrian]

For me, it never got as far as installation; Avast tripped during the download itself (installer package, not zip). Not sure if that was a Q: for me.

Comment 11

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

(In reply to comment #11)
> User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
> rv:1.9.2a1pre) Gecko/20081216 Minefield/3.2a1pre
> Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
> rv:1.9.2a1pre) Gecko/20081216 Minefield/3.2a1pre

The same executable downloaded to my WinXP machine at home, and passed cleanly a scan by a fully updated Norton Internet Security v15.5.0.23. Also, I believe that we also have automated scans of ftp.m.o, before builds are visible, but let me verify that.



Not sure where this bug should live, but it doesnt feel like a RelEng issue at this time.

Comment 12

[Peter Lairo]

(In reply to comment #9)
> when launching the exe does it display the
> extracting dialog?

IIRC: No. The error message comes right after double-clicking the exe.

Comment 13

[[e-mail] (:bhearsum)]

(In reply to comment #11)
> Also, I believe
> that we also have automated scans of ftp.m.o, before builds are visible, but
> let me verify that.
> 

We don't. bug 394069 was put on hold due to issues with unionfs.

Comment 14

[[e-mail] (:bhearsum)]

beltzner suggested running a virus scan on the machine that produced this build - I think this is a good idea, though I agree it's probably a false positive.

Anyone have a bit of time to do this?

Comment 15

[Lupatrian]

Attachment: Screen shot of Avast alert message

Comment 16

[Lupatrian]

Today's build: Avast tripped as soon as I hit SAVE for the download; Win/installer. I aborted. I did a vi-scan yesterday: nothing. Norton misses things.

Comment 17

[Lupatrian]

Update: I did a "thorough" (vs Quick) vi-scan, incl archives, and did get a hit. After vi-file was deleted, I retried downloading the Minefield installer and had no problems. So, anyone who got a virus message while attempting to download the trunk should suspect a PC infection and do a full virus scan. Thanks.

Comment 18

[Xavier Vincent]

Same thing occurs with Seamonkey 2.0 Alpha 2: http://download.mozilla.org/?product=seamonkey-2.0a2&os=win&lang=en-US (all mirrors)

Details:
Win32:Trojan-gen {Other}
Virus/Ver
VPS Version: 081221-0, 21/12/2008

Comment 19

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

From talking with justdave, all files on ftp.m.o are scanned by ClamAV soon after being posted. The ClamAV installation has signatures refreshed hourly. Each of the files described in this bug have scanned cleanly on ftp.m.o, and so also has everything else on ftp.m.o.

This might be a problem with Avast, or, based on comment#17, it sounds like a user's machine was infected. Doesnt seem to be anything here for RelEng to do, so closing. 

If I've misunderstood, please reopen with details.

Comment 20

[Peter Lairo]

I just did a (involuntary) new install of my WinXP machine. I just downloaded and installed the nightly EXE build successfully with no virus warnings.

ftp://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central/

--> WFM too.