[Clipart] openclipart-0.14-win32.exe: Trojan.Downloader.Istbar-158 FOUND

[JT]

Alan Horkan wrote:
> On Fri, 15 Jul 2005, JT wrote:
> 
> 
>>Date: Fri, 15 Jul 2005 09:20:34 -0700
>>From: JT <jt at sirius.airdelights.com>
>>To: clipart at lists.freedesktop.org
>>Subject: [Clipart] openclipart-0.14-win32.exe:
>>    Trojan.Downloader.Istbar-158 FOUND
>>
>>Hi, all -
>>
>>I downloaded the openclipart-0.14-win32.exe a couple weeks ago via the
>>openclipart.org website. Last night my nightly ClamWin (0.86.1)(main:
>>33, daily: 978) virus scan returned:
>>
>>C:\Downloads\openclipart-0.14-win32.exe: Trojan.Downloader.Istbar-158 FOUND
>>C:\Program Files\Open Clip Art Library\Uninstall-openclipart-0.14.exe:
>>Trojan.Downloader.Istbar-158 FOUND
>>
>>I'm downloading the new openclipart-0.15-win32.exe build now, but it
>>will take a little while. Does anyone have a copy of the .14 exe to
>>check? I'm submitting the (smaller) file to the clamav team, perhaps it
>>is a false positive, or maybe it got there after I downloaded it. I will
>>update later.
> 
> 
> There is a strong possibility you got a false postive.  Several virus
> scanners have taken a dislike to some of the freely available uninstall
> programs and over the years many open source programs have been
> mislabelled as viruses. If you could double check this or if someone else
> could check it agianst another virus scanner that would be a help.
> 
> If we are going to continue to distribute Windows Executables we might
> want to run it by an open source virus scanner (like possibly Clam AV).
> 
> Sincerely
> 
> Alan Horkan
> 

Right. I have since scanned with Trend and got no hit. I also downloaded
.15 and clamav still matches it. I submitted the uninstaller to the
clamav definitions team as a false positive. Unless someone has a better
idea, I'll let the list know when when they get back to me.

JT