Arch Linux

new2arch

Member

Registered: 2008-02-25

Posts: 235

Mono package contains a worm??

Hi guys,

Not that I think virus and worms are common on the Linux platform, but I occasionally (twice a year or so) scan my computer with f-prot antivirus for Linux and today I got this report:

/usr/local/bin/fpscan --all

F-PROT Antivirus version 6.2.1.4252 (built: 2008-04-28T16-44-10)
FRISK Software International (C) Copyright 1989-2007

Engine version: 4.4.4.56
Virus signatures: 200909161017923fbda4202631a1487801a059e45ec4
                  (/opt/f-prot/antivir.def)

[Found possible worm] <Heuristic-31 (not disinfectable)>     /var/cache/pacman/pkg/mono-2.4.2-1-i686.pkg.tar.gz->(packed)->etc/mono/2.0/DefaultWsdlHelpGenerator.aspx

[Contains infected objects]    /var/cache/pacman/pkg/mono-2.4.2-1-i686.pkg.tar.gz
[Found possible worm] <Heuristic-31 (not disinfectable)>     /var/cache/pacman/pkg/mono-2.4.2.3-1-i686.pkg.tar.gz->(packed)->etc/mono/2.0/DefaultWsdlHelpGenerator.aspx

[Contains infected objects]    /var/cache/pacman/pkg/mono-2.4.2.3-1-i686.pkg.tar.gz

I bet this is a false positive, but what could've triggered the AV-scanner to believe those packages were infected?

ise

Developer

From: Karlsruhe / Germany

Registered: 2005-10-06

Posts: 404

Website

Re: Mono package contains a worm??

It's a false positive. I have checked the package with Avira AntiVir Pro and clamav. None have shown any warnings or viruses.

Daniel

---

23 page
My blog

new2arch

Member

Registered: 2008-02-25

Posts: 235

Re: Mono package contains a worm??

It's a false positive. I have checked the package with Avira AntiVir Pro and clamav. None have shown any warnings or viruses.

Daniel

Okay, cool to know. Thanks for confirming.

ngoonee

Forum Fellow

From: Between Thailand and Singapore

Registered: 2009-03-17

Posts: 7,362

Re: Mono package contains a worm??

Best place I know to check is to upload the file to Kaspersky's free online scanner.

And its mono . Viruses are the Next Big Thing (tm) to come from that Windows-shackled software.

*Places big sarcasm sign up in case anyone didn't get that*

---

Allan-Volunteer on the (topic being discussed) mailn lists. You never get the people who matters attention on the forums.
jasonwryan-Installing Arch is a measure of your literacy. Maintaining Arch is a measure of your diligence. Contributing to Arch is a measure of your competence.
Griemak-Bleeding edge, not bleeding flat. Edge denotes falls will occur from time to time. Bring your own parachute.