My Anti-Virus app (AVG 7.5.448 269.11.11/994 8/9/2007) turned up hits for the following files: 
C:\cygwin\lib\perl5\b.8\cygwin\auto\Encode\Byte\Byte.dll
C:\cygwin\lib\perl5\b.8\cygwin\auto\Encode\CN\CN.dll
C:\cygwin\lib\perl5\b.8\cygwin\auto\Encode\EBCDIC\EBCDIC.dll
C:\cygwin\lib\perl5\b.8\cygwin\auto\Encode\JP\JP.dll
C:\cygwin\lib\perl5\b.8\cygwin\auto\Encode\KR\KR.dll
C:\cygwin\lib\perl5\b.8\cygwin\auto\Encode\Symbol\Symbol.dll
C:\cygwin\lib\perl5\b.8\cygwin\auto\Encode\TW\TW.dll
C:\cygwin\lib\python2.5\lib-dynload\_multibytecodec.dll

[download]

I'm sure it's a false positive, but any information you have would be appreciated. I can't find anything about Win32/PolyCrypt in the AVG "virus encyclopedia" online... And no news items elsewhere.

It says it "healed" the files. I suspect my utf8 encoders don't work anymore, but I haven't tried. I tend to Active Perl in Win32.

-Paul

Replies are listed 'Best First'.
Re: AVG 7.5.448 Win32/PolyCrypt antivirus hits in cygwin perl 5.8.8
by syphilis (Archbishop) on Aug 10, 2007 at 13:29 UTC
    Hi Paul,

    There has been some discussion about this on the Cygwin mailing list - where it has been unanimously voted as a "false positive"

    Cheers,
    Rob
[reply]
Re: AVG 7.5.448 Win32/PolyCrypt antivirus hits in cygwin perl 5.8.8
by garu (Scribe) on Aug 10, 2007 at 13:29 UTC
    After reading about it in the Chatterbox, I looked around and found that other people are having this problem too with AVG.

    So I guess Grisoft just screwed up on their virus signatures... Expect an update from them pretty soon :-)

    UPDATE: Apparently, this is not the first time AVG confuses Win32/PolyCrypt with something else
[reply]
Re: AVG 7.5.448 Win32/PolyCrypt antivirus hits in cygwin perl 5.8.8
by mr_mischief (Monsignor) on Aug 10, 2007 at 13:33 UTC
    As mentioned in the CB, I have 20 Cygwin Perl libraries that are reported to have this virus. under Cygwin I'm back at perl 5.8.2, and the Encode modules are joined by File::Glob, Sys::Syslog, and several Win32 modules on my system.

    My virus database is 269.11.10/943, released on 2007-08-08 so that may account for part of the differences.

    I ran a full scan on the 8th (before the update to this virus database) and had a clean bill of health from AVG at that time.

    This sure seems to be some false positive.

    Update: I stopped scanning, restored my 20 libraries from the Virus Vault to the filesystem, deleted the files from the Virus Vault, did a manual update check, and scanned c:\cygwin\lib\perl5 specifically. The results give a clean bill of health. My new virus database is 269.11.11/944 and my new version of AVG (didn't check old one) is 7.5.476 Free Edition.
[reply]
      I did the same. I didn't restore that python file, cuz who cares.

      -Paul

[reply]

Back to Perl News