Re: [boost] TROJAN INFECTION boost 1.67 binaries for Windows x64 MSVC 14.1

Subject: Re: [boost] TROJAN INFECTION boost 1.67 binaries for Windows x64 MSVC 14.1
From: Zipper Fish (zipperfish793_at_[hidden])
Date: 2018-07-27 13:14:40

Paul, I already feel good and am not panicking, but thank you for your
concern :-)

I am interested in the Windows 3rd party binaries because I try to avoid
building boost manually on Windows if at all possible. As you know, the
Windows Zip file does not contain binaries for the non-header-only parts of
boost.

I already gathered your strategy about using a separate partition to beat
the virus checkers from the archive link that Mateusz shared.

As I wrote in my response to Mateusz, I am simply curious why a virus
checker would flag a false positive in compiled boost libraries. Is it
because viruses use boost libraries? I've used quite a number of libraries
over the years and none that I can recall had this issue. (If this is off
topic, my apologies.)

Best regards

On Fri, Jul 27, 2018 at 4:19 AM, Paul A. Bristow via Boost <
boost_at_[hidden]> wrote:

> > -----Original Message-----
> > From: Boost [mailto:boost-bounces_at_[hidden]] On Behalf Of Zipper
> Fish via Boost
> > Sent: 27 July 2018 02:55
> > To: boost_at_[hidden]
> > Cc: Zipper Fish
> > Subject: Re: [boost] TROJAN INFECTION boost 1.67 binaries for Windows
> x64 MSVC 14.1
> >
> > Thank you
> >
> > Ok, I'll whitelist the file "boost_1_67_0-msvc-14.1-64.exe" with some
> > trepidation and try installing.
> >
> > I normally do search archives and Google extensively for code issues, but
> > for a positive hit from the a virus detector, it wasn't the first idea
> that
> > popped into my head.
> >
> > Just curious, why would a boost installer trigger virus detectors? Is the
> > virus executable linked to a boost library?
> >
> >
> > On Thu, Jul 26, 2018 at 6:41 PM, Mateusz Loskot via Boost <
> > boost_at_[hidden]> wrote:
> >
> > > Read this thread
> > > https://lists.boost.org/Archives/boost/2018/05/242200.php
> > >
> > > It's always a good idea to search through the list archives first.
> > >
> > > Mateusz Loskot, mateusz_at_[hidden]
> > > (Sent from mobile)
> > >
> > > On Fri, 27 Jul 2018, 00:08 Zipper Fish via Boost, <
> boost_at_[hidden]>
> > > wrote:
> > >
> > > > Dear boost developers and/or release managers:
> > > >
> > > > Today I downloaded boost_1_67_0-msvc-14.1-64.exe from the Windows
> > > binaries
> > > > downloads page:
> > > > https://dl.bintray.com/boostorg/release/1.67.0/binaries/
> > > >
> > > > The file contains a Trojan, according to Windows Defender.
> > > >
> > > > Screenshot:
> > > >
> > > > https://usercontent.irccloud-cdn.com/file/Uy6o19AC/2018-07-
> > > 26%2016_29_52-Windows%20Defender%20Security%20Center.jpg
>
> You could download and unzip the zipped version instead if that makes you
> feel better?
>
> https://www.boost.org/users/download/
>
> My experience is that several virus checkers intermittently but
> persistently find false positives in Boost libraries that I
> re-build;  I have been reduced to placing then in a separate partition
> which is not virus checked.
>
> (Since Microsoft use Boost internally, I am puzzled why this issue hasn't
> caused some liaison between the C++ users and the Defender
> team).
>
> Don't panic!
>
> Paul
>
> ---
> Paul A. Bristow
> Prizet Farmhouse
> Kendal UK LA8 8AB
> [phone]
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> Unsubscribe & other changes: http://lists.boost.org/
> mailman/listinfo.cgi/boost
>