You are here

Home » Forums » Support Forums » Other Apps Support (Deprecated)

Trojan detected in Blender

9 posts / 0 new
Log in or register to post comments
Last post
September 24, 2009 - 6:48pm
#1
RichA
Offline
Last seen: 11 years 11 months ago
Joined: 2007-01-17 09:01
Trojan detected in Blender

I am sure it is a false positive, but just as an FYI; McAfee is reporting that a virus called "Artemis" http://vil.nai.com/vil/content/v_219587.htm is in Blender.
I scanned the file when I first installed it, and McAfee didn't find anything, but recently I was doing a routine scan of my flash drive as I was on a untrusted PC, and this came up for Blender.
It looks like the post 9/3/09 DAT files starting picking it up.

Sorry, forgot to add that I tested it by downloading Blender, along with using another flash drive I have Portableapps stored on, and it came up with the same thing, so my drive wasn't infected by this PC.

Top
September 24, 2009 - 10:35pm
Zach Thibeau
Zach Thibeau's picture
Offline
Last seen: 11 months 2 weeks ago
Developer
Joined: 2006-05-26 12:08
yes this would considered a

yes this would considered a false positive, this is because sometimes how nsis is being used to redirect calls to make the app portable and because of this it will alarm heuristic scanners easily. Usually a new update on the systems virus definitions will take care of the issue or if not you could submit the file and report it as a false positive to the av company in general.

A good place to look for false positives is online scanners like virustotal or jotti which can scan a file with multiple scanners

your friendly neighbourhood moderator Zach Thibeau

Top
September 25, 2009 - 7:01pm
(Reply to #2)
jamcomm
Offline
Last seen: 14 years 6 days ago
Joined: 2009-07-24 14:51
(As links)

Those as links:

http://www.virustotal.com/

http://virusscan.jotti.org/en

People shouldn't be reporting software to the antivirus companies as a "false positive" though - far better to ask the antivirus company to confirm if it's really infected or not.

Assuming an executable is a "false positive" and free of viruses whenever a virus checker reports it as being infected is pretty damn stupid!

You'd be better off uninstalling your antivirus software if you're just going to ignore it and complain to the antivirus company whenever it tells you it's found an infection!

Top
September 25, 2009 - 8:47pm
(Reply to #3)
Zach Thibeau
Zach Thibeau's picture
Offline
Last seen: 11 months 2 weeks ago
Developer
Joined: 2006-05-26 12:08
your attitude and the way

your attitude and the way your attacking is pretty stupid and uncalled for jammcomm and you are right about asking the antivirus company to confirm though but please in future don't use bold lettering, it makes people feel like you are shouting at them and is highly unproductive

your friendly neighbourhood moderator Zach Thibeau

Top
September 26, 2009 - 9:01am
(Reply to #4)
jamcomm
Offline
Last seen: 14 years 6 days ago
Joined: 2009-07-24 14:51
Dangerous advise

The facts are simple:

Treating a executable which an ANTIVIRUS PROGRAM (yes, shouting that at the top of my lungs!) has told you (emphasis) is infected as being "just a false positive" is stupid (emphasis)

Pointing this out isn't "attacking" anyone - it's a material fact.

Suggesting that when an executable has been identified as infected it must be a false positive (which seems be be routine on this forum; a number of posts have done this recently) - is not only extremely stupid advice, but potentially extremely dangerous advise that can result in (among other things):

  • data loss,
  • corruption of data,
  • loss of personal records
  • loss of "real world" finaces (some virus payloads have been known to monitor their "host" system for banking passwords, etc - passing them on for criminal use)
  • if a work/office computer is infected: loss of business, loss of credibility with your customers, loss of sales, infection of customer systems, legal action being taken due to abject negligence.

The list just goes on and on. It's not just "bits and bytes" or "numbers on a computer" in "cyberspace" that can get destroyed - viruses are very much a real world problem, and a serious risk. Even on a home computer - if you're not particularly computer literate, how much is it going to cost you to pay someone to clean up? How long will it take to reinstall your operating system, all the applications you use, how long to recover yout data from backup - that's assuming you even have a backup

I'm not trying to scaremonger here - virus warnings should not be taken lightly.

Please check any antivirus producer's WWW site for what payloads viruses can potentially contain - they are not toys to be played with

Yes, false positives do happen - as do false negatives (reporting a program "clean" when it's infected) - that's an unfortunate fact, but one which should never be assumed without first checking with th antivirus producer.

wrt bold lettering - I think your use is different than most conventions would dictate: bold text isn't "shouting"; capital letters indicates this. Bold is just a means of emphasis - both in conventional (paper) print, and electronic form.

The use of capitals is almost universally regarded as SHOUTING(!) though:

  • Emphasis
  • Emphasis
  • SHOUTING
  • SHOUTING WITH A HELL OF A LOT OF EMPHASIS!
    Top
    September 26, 2009 - 9:12am
    (Reply to #5)
    Zach Thibeau
    Zach Thibeau's picture
    Offline
    Last seen: 11 months 2 weeks ago
    Developer
    Joined: 2006-05-26 12:08
    well considering half the

    well considering half the people (or nearly half) on this forum are feeling that your are shouting at them and it's not acceptable period and you have been warned by John already. Please don't make this harder on you than it's already is. Tone it down

    your friendly neighbourhood moderator Zach Thibeau

    Top
    September 26, 2009 - 9:37am
    (Reply to #6)
    David Dixon II
    David Dixon II's picture
    Offline
    Last seen: 1 year 7 months ago
    Developer
    Joined: 2007-06-11 22:54
    Okay well you listen here.

    Apparently according to the topic the "virus" as you've been putting it, is a false positive and is in Blender.

      Here's the solution:

    • Shut your trap and get on with life. If you can't find it in your little mind to ignore a false positive, you obviously can't do anything.
    • We don't care for people who yell and make a scene. If you're going to, we suggest you leave the site
    • Just use the app, all we do is make it portable.

    To the owner of this thread: I apologize for having to make this post.

    Na na na, come on!

    Top
    September 25, 2009 - 10:23pm
    (Reply to #7)
    OliverK
    OliverK's picture
    Offline
    Last seen: 2 years 3 months ago
    Developer
    Joined: 2007-03-27 15:21
    let's put it this way, I'm

    let's put it this way, I'm sure its not infected. If you don't like it, don't use it.

    Too many lonely hearts in the real world
    Too many bridges you can burn
    Too many tables you can't turn
    Don't wanna live my life in the real world

    Top
    September 26, 2009 - 1:56pm
    tanisthalon
    tanisthalon's picture
    Offline
    Last seen: 2 years 9 months ago
    Developer
    Joined: 2006-02-11 08:02
    False positive

    Unless you downloaded this from a different location, other than that on the main application list or the development release I have posted, it is a false positive.

    At work we use McAfee and as of late it detects vcomp90.dll and (cannot remember).py as viruses. The files had been compressed with AppCompactor to reduce the size etc. which may well contribute to the error.

    McAfee has been showing this for a few weeks. There was an update to the virus database just lately at work but I have yet to check if the false positive still exists.

    Dell XPS M1530 Laptop
    Intel Core 2 Duo T9300 2.5GHz
    4GB Ram
    256MB GeForce 8600M GT

    Top
    Log in or register to post comments