You are here

GIMP: New F-Secure False Positive

8 posts / 0 new
Last post
KevinTMC
Offline
Last seen: 8 years 8 months ago
Joined: 2006-04-14 10:45
GIMP: New F-Secure False Positive

F-Secure has long since fixed the last, Avast-style problem; but this morning it went and "found" a virus in one of the GIMP .exe files:

2006-11-28  06:44:43-04:00  F-Secure Anti-Virus  1.3.6.1.4.1.2213.11.1.12
Malicious code found in file
J:\PORTABLEAPPS\GIMPPORTABLE\APP\GTK\BIN\GSPAWN-WIN32-HELPER.EXE.
 Infection: Trojan-Downloader.Win32.VB.aqs
 Action: The file was renamed.

If this file is the same one used in the non-Portable version of The GIMP, I'm sure it's already been reported...but if not, you'll want to pass word along to F-Secure.

PetrMisek
Offline
Last seen: 17 years 10 months ago
Joined: 2006-11-29 03:27
I have the same report from

I have the same report from Kaspersky Antivirus F:\Apps\GIMPPortable\App\gtk\bin\gspawn-win32-helper.exe;is a Trojan Trojan-Downloader.Win32.VB.aqs;29.11.2006 7:29:36

wsm23
Offline
Last seen: 12 years 8 months ago
Joined: 2006-01-09 22:05
Not a portable apps issue.

You are reporting a false virus report for a program that is not published by PortableApps.com.

I don't understand the constant reporting here about OTHER programs issues.

John cannot make the other companies programs work correctly.

PortableApps do not contain viruses.

Please report ALL false positive issues with other programs to the appropriate company or publisher.

8)
Life is about the journey not the destination!
Live today like it is your last!

Do you do the right thing even when no one will know you did?

\(^.^)/

Life is about the journey not the destination!

The Kazoo Spartan

KevinTMC
Offline
Last seen: 8 years 8 months ago
Joined: 2006-04-14 10:45
Just giving a heads-up

I'm not expecting John to fix other companies' programs.

I did think he'd appreciate a heads-up when a new anti-virus issue cropped up. And, if he were inclined to contact the anti-virus companies, he'd certainly have much more technical knowledge and authority to offer them than I would. (I am reporting it myself though.)

And even if my post didn't meet your personal standard of usefulness and relevance, at least it was more helpful and respectful than yours.

wsm23
Offline
Last seen: 12 years 8 months ago
Joined: 2006-01-09 22:05
Common post

This post is so common. I am not only directing it at you, but at the many helpful PortableApp users.

A search of PortableApps.com false+virus produced 4 pages of topics where people were "just letting you know" that someone else's program is not functioning correctly.

It it almost as common as "Hey John, Did you know that a new beta version of ____ is out?"

These are support forums for PortableApps. John tries to read every one. As far as I can tell the number of posts is increasing every day.

I don't think we need anymore trojan/virus/new version posts.

8)
Life is about the journey not the destination!
Live today like it is your last!

Do you do the right thing even when no one will know you did?

\(^.^)/

Life is about the journey not the destination!

The Kazoo Spartan

KevinTMC
Offline
Last seen: 8 years 8 months ago
Joined: 2006-04-14 10:45
Fix is coming

The good news is that the F-Secure folks have written me back, and said that a fix is all set to go in their next update.

I had only given the GIMP Portable forum a quick scan before making my post; hadn't seen all the others you found in your search. (Also a search for the specific false positive I was getting came up dry.)

Now we've got another one, though, just above this thread. Heh. I think I understand your irritation better now. Smile

MacReiter
Offline
Last seen: 17 years 10 months ago
Joined: 2006-11-30 14:47
may want to recheck GTK support files

I read the "Portable Apps do not contain viruses" comment (which I'm not sure I'd ever personally be confident enough to make), but I find it odd that when AVG Antivirus turned up GSPAWN-WIN32-HELPER.EXE, and I told it to "Heal" that file, the problem went away. This suggests to me that either:

1. GSPAWN-WIN32-HELPER.EXE actually had a virus, which AVG removed.
2. GSPAWN-WIN32-HELPER.EXE was deleted by AVG and is not actually needed.

In looking at my directories, it appears that #2 is the case. While it would be nice if the antivirus programs never yielded false positives, it looks like GIMPPortable could simply remove GSPAWN-WIN32-HELPER.EXE from the distribution, removing the false positive and saving a bit of space.

Anybody know if that "helper" _is_ actually needed? GIMPPortable seems to be running ok without it...

Mac

John T. Haller
John T. Haller's picture
Online
Last seen: 14 min 56 sec ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Alright... once again...

GIMP Portable does not contain a virus. The release is months old. It's been verified spyware, adware and virus free by everybody using it in that time as well as sites like Softpedia. To ensure you have the official release, grab a program like WinMD5Sum and compare the installer you have's MD5 Sum with the one posted on the GIMP Portable page. If they match, you have the real one. Try extracting a new copy and check the file there. If it detects a virus, you can be positive that this is yet another error on AVG's part.

It's AVG that got a broken virus definition update THIS WEEK that has the problem. Tell them to fix their issue.

And no, we won't be removing random files due to the fact that some antivirus software doesn't work right.

Sometimes, the impossible can become possible, if you're awesome!

Topic locked