Skip to content

WinPython 3.10.9.0 was seen as a randsomware by antivirus #1364

Open
Open
WinPython 3.10.9.0 was seen as a randsomware by antivirus#1364
Labels
ProcedureProcedure
Milestone
2024-04 Numpy-2 / .7z

Description

@sebma
sebma
opened on Jun 26, 2024

Hi, I installed WinPython 3.10.9.0 with gsudo.ps1 -NoLogo -NoProfile -Command "scoop install -g winpython".

scoop is taken from : https://github.com/ScoopInstaller/Scoop#readme

It seems the antivirus has a problem with this file : C:\ProgramData\scoop\apps\winpython\3.10.9.0\python-3.10.9.amd64\Lib\site-packages\numpy\core\tests\data\umath-validation-set-README.txt

Can you investigate why WinPython 3.10.9.0 was seen as a randsomware by antivirus ?

Is there a problem with the numpy package ?

Activity

  1. stonebig commented on Jun 26, 2024

    @stonebig
    stonebig
    on Jun 26, 2024
    Contributor

    a ransomware in a text file .....

    maybe check the hash of what you get.

    WinPython 2022-04 release (January 22nd, 2023)

    MD5 SHA-1 SHA-256 Binary Size SHA3-256
    5d6c22345a952affe1266a92abf14ceb 7ba4581efb578247ba3ee2d998162135e3ef83b3 7c61728acb13954ba862348116676c30617aec8fc45536fa882c9b0dd9278eda Winpython64-3.10.9.0dot.exe 27 467 759 Bytes b1a6760c984ccdbd13df31c742bf6dbb2b5246f617781f313e2db843dc6d89ff
    ba3268df9d7e5206dee6b7a42dbab8a7 214ebb0110df945f37be8ff884447103b69d7d70 49738ff219cd23cd1e96afaf2a6b8eabdcdb04575167dd46e1f132e946821326 Winpython32-3.10.9.0dot.exe 26 249 584 Bytes 3e39907400b728719093edb0a67213da956f243caeaaf13842faeab1b0ee9235
    46a26e25ca6524ebaabfa04b390d3b91 da52d4ab1bdf923aaf36f69f5d8eeb057e8eab84 1577b72582c04fb43f2353c17d09c41f927f8a4994f33a2a6689e2558ade0204 Winpython64-3.11.1.0dot.exe 24 404 166 Bytes e5fa479d2d5948f0e399c08bcfe30ed088dc10d726ba2406ec22c5d65a6769f3
    8e3fb06b4ae8e3741207bd650b62df15 3a2600c37217d9be245ec67f1a1154af282424d6 6d265a1b795d3a444a8890db114f8cd7153b41378a02bd21cb2bcd5ba431c4e3 Winpython64-3.10.9.0.exe 683 571 740 Bytes 3cef6ad93ef127063b24b112c7a4e9437878033e0dee486c5d80991c964ee860
    8ba6cb889fba7bd208a36cdd123dbcb6 aa63897b18bb8bb35b236a1068501552290c24f8 7664b45097ab206828a9c1de7b03c14d622dc2bb94733075c62a6174c2252698 Winpython64-3.11.1.0.exe 562 936 337 Bytes 024c570acf8bd6a0f5ce6fad784ff6791323f984c911a81523da485bcc9432ae

  2. stonebig commented on Jun 26, 2024

    @stonebig
    stonebig
    on Jun 26, 2024
    Contributor

    in any case if you have a doubt, don't stress yourself and use another distro. You are free

  3. stonebig commented on Jun 26, 2024

    @stonebig
    stonebig
    on Jun 26, 2024
    Contributor

    i don't know what is this "scoop" thing

  4. stonebig commented on Jun 26, 2024

    @stonebig
    stonebig
    on Jun 26, 2024
    Contributor

    WinPython "original" are downloadables from SourceForce and Github, and you get hash files on github and https://groups.google.com/g/winpython to check what you get is what has been uploaded, 1 year and 5 month ago

  5. stonebig commented on Jun 26, 2024

    @stonebig
    stonebig
    on Jun 26, 2024
    Contributor

    chocolatey or scoop being unknown middlemen, anything is possible.

  6. stonebig commented on Jul 14, 2024

    @stonebig
    stonebig
    on Jul 14, 2024
    Contributor

    In any case, things should be done to give you more control means:

    • A version of WinPython kept below 650 Mo that you can upload to VirusTotal, and that would be greened
    • the non-sense balooning of standard version (Anaconda currently the same over 900 Mo) must be reversed.

    ... so upcoming 2024-04 release will :

    • bucher a lot of packages
    • have a .7z archive option (as Windows11 can un-pack it)

  7. stonebig commented on Jul 14, 2024

    @stonebig
    stonebig
    on Jul 14, 2024
    Contributor

    Further analysis:

    • slim version: 620 Mo .exe (auto-unpack 7x): 41/42 vendors are ok
    • dot version: 26 Mo .7z: 51/52 vendors are ok
    • dot version: 44Mo .zip (the same as above... zip is compressing way less): 54/55 vendors are ok

    Conjecture:

    • like on official wheel packages experience, it's hard to have not 1 antivirus complaining
    • everyone shall read the title of Andy Grove book: "Only the Paranoid Survive"

  8. stonebig commented on Jul 14, 2024

    @stonebig
    stonebig
    on Jul 14, 2024
    Contributor

    Holly shit, I'm green !
    image

  9. stonebig
    added this to the 2024-04 Numpy-2 milestone on Jul 14, 2024

  10. stonebig commented on Jul 14, 2024

    @stonebig
    stonebig
    on Jul 14, 2024
    Contributor

    so, for b2:

    • dot versions will be generated as .7z and .exe
    • slim version will be generated < 650 Mo and .7z and .exe
    • keeping the big one .7z only

    it seems clear the small "IA" guessing anti-virus won't want to bet on auto-extract

  11. stonebig commented on May 4, 2025

    @stonebig
    stonebig
    on May 4, 2025
    Contributor

    all releases are now pre-submitted to anti-virus community, with the goal of making at most 1/30 anti-virus un-happy

  12. stonebig
    added
    ProcedureProcedure
    on May 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    ProcedureProcedure

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions