Anti-virus threat detections in repo source packages

Also, I should note that these could be false positives. Per a conversation with Kees on IRC, I have opened this bug for further investigation.

Looks like pymilters is actually shipping viruses (as part of its test suite). They should probably be adjusted to only use EICAR.

nepenthes looks like an example/test too.

I don't know OCaml, but the polygen hit seems like a false positive too. It's seems to be a joke, not actual code (I hope).

El Vie 11 Jun 2010, Kees Cook escribió:
> nepenthes looks like an example/test too.

it's a doc file. I may remove it... But clearly is not a threat..

l.

I emailed the pymilter upstream to get his feedback.

Upstream feedback:

I understand where they are coming from, but EICAR does not work for
these test cases. The viruses are deactivated. Pymilter is not a
traditional antivirus that looks for signatures. It simply bans
executable content. Many viruses attempt to disguise their
executability, taking advantage of how malformed emails are handled.
That's what the test cases are about.

I think that qualifies as a false positive, but I understand why it tripped a scan.

Upstream for pymilter-milters is willing to work on better test cases that don't trip the A/V checks. It would be helpful to know which files caused the problems.

Running a manual scan on the downloaded orig.tar.gz from an apt-get source produces the following 7 alerts.

Scan Type: Manual Scan
Event: Threat Found!
Threat: VBS.LoveLetter.A
File: /home/thomas/code/pymilter-milters_0.8.13.orig.tar.gz>>/home/th...>>pymilter-milters-0.8.13/test/virus1
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:02:47 PM PDT

Scan Type: Manual Scan
Event: Threat Found!
Threat: VBS.LoveLetter.A
File: /home/thomas/code/pymilter-milters_0.8.13.orig.tar.gz>>/home/th...>>pymilter...>>LOVE-LETTER-FOR-YOU.TXT.vbs
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:02:47 PM PDT

Scan Type: Manual Scan
Event: Threat Found!
Threat: W32.Nimda.enc
File: /home/thomas/code/pymilter-milters_0.8.13.orig.tar.gz>>/home/th...>>pymilter-milters-0.8.13/test/virus4
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:02:47 PM PDT

Scan Type: Manual Scan
Event: Threat Found!
Threat: W32.Nimda.enc
File: /home/thomas/code/pymilter-milters_0.8.13.orig.tar.gz>>/home/th...>>pymilter...>>Unknown0000002E.data
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:02:47 PM PDT

Scan Type: Manual Scan
Event: Threat Found!
Threat: W32.Aliz.Worm
File: /home/thomas/code/pymilter-milters_0.8.13.orig.tar.gz>>/home/th...>>pymilter-milters-0.8.13/test/virus5
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:02:47 PM PDT

Scan Type: Manual Scan
Event: Threat Found!
Threat: W32.Aliz.Worm
File: /home/thomas/code/pymilter-milters_0.8.13.orig.tar.gz>>/home/th...>>pymilter...>>Unknown0000002E.data
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:02:47 PM PDT

Scan Type: Manual Scan
Event: Threat Found!
Threat:
File: /home/thomas/code/pymilter-milters_0.8.13.orig.tar.gz
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:02:47 PM PDT

Interestingly enough, when I run it on the pymilter-milters directory, I only get the following 3 alerts

Scan Type: Manual Scan
Event: Threat Found!
Threat: W32.Aliz.Worm
File: /home/thomas/code/pymilter-milters-0.8.13/test/virus5
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:06:34 PM PDT

Scan Type: Manual Scan
Event: Threat Found!
Threat: VBS.LoveLetter.A
File: /home/thomas/code/pymilter-milters-0.8.13/test/virus1
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:06:34 PM PDT

Scan Type: Manual Scan
Event: Threat Found!
Threat: W32.Nimda.enc
File: /home/thomas/code/pymilter-milters-0.8.13/test/virus4
Location: Quarantine
Computer: earth
User: root
Action Taken: Quarantine succeeded
Date found: Thu 09 Sep 2010 02:06:34 PM PDT

As these are Symantec detections, and threat names vary between different AV vendors information for these threats can be found at
http://www.sym...

The logs don't contain any path details for the following packages, so I haven't been able to check them:

dbacl
amavis-ng
amavisd-new
kcmpureftpd
boxbackup