Repository navigation
WinPython 3.10.9.0 was seen as a randsomware by antivirus #1364
Description
Activity
a ransomware in a text file .....
maybe check the hash of what you get.
WinPython 2022-04 release (January 22nd, 2023)
MD5 SHA-1 SHA-256 Binary Size SHA3-256 5d6c22345a952affe1266a92abf14ceb 7ba4581efb578247ba3ee2d998162135e3ef83b3 7c61728acb13954ba862348116676c30617aec8fc45536fa882c9b0dd9278eda Winpython64-3.10.9.0dot.exe 27 467 759 Bytes b1a6760c984ccdbd13df31c742bf6dbb2b5246f617781f313e2db843dc6d89ff ba3268df9d7e5206dee6b7a42dbab8a7 214ebb0110df945f37be8ff884447103b69d7d70 49738ff219cd23cd1e96afaf2a6b8eabdcdb04575167dd46e1f132e946821326 Winpython32-3.10.9.0dot.exe 26 249 584 Bytes 3e39907400b728719093edb0a67213da956f243caeaaf13842faeab1b0ee9235 46a26e25ca6524ebaabfa04b390d3b91 da52d4ab1bdf923aaf36f69f5d8eeb057e8eab84 1577b72582c04fb43f2353c17d09c41f927f8a4994f33a2a6689e2558ade0204 Winpython64-3.11.1.0dot.exe 24 404 166 Bytes e5fa479d2d5948f0e399c08bcfe30ed088dc10d726ba2406ec22c5d65a6769f3 8e3fb06b4ae8e3741207bd650b62df15 3a2600c37217d9be245ec67f1a1154af282424d6 6d265a1b795d3a444a8890db114f8cd7153b41378a02bd21cb2bcd5ba431c4e3 Winpython64-3.10.9.0.exe 683 571 740 Bytes 3cef6ad93ef127063b24b112c7a4e9437878033e0dee486c5d80991c964ee860 8ba6cb889fba7bd208a36cdd123dbcb6 aa63897b18bb8bb35b236a1068501552290c24f8 7664b45097ab206828a9c1de7b03c14d622dc2bb94733075c62a6174c2252698 Winpython64-3.11.1.0.exe 562 936 337 Bytes 024c570acf8bd6a0f5ce6fad784ff6791323f984c911a81523da485bcc9432ae in any case if you have a doubt, don't stress yourself and use another distro. You are free
i don't know what is this "scoop" thing
WinPython "original" are downloadables from SourceForce and Github, and you get hash files on github and https://groups.google.com/g/winpython to check what you get is what has been uploaded, 1 year and 5 month ago
chocolatey or scoop being unknown middlemen, anything is possible.
In any case, things should be done to give you more control means:
- A version of WinPython kept below 650 Mo that you can upload to VirusTotal, and that would be greened
- the non-sense balooning of standard version (Anaconda currently the same over 900 Mo) must be reversed.
... so upcoming 2024-04 release will :
- bucher a lot of packages
- have a .7z archive option (as Windows11 can un-pack it)
Further analysis:
- slim version: 620 Mo .exe (auto-unpack 7x): 41/42 vendors are ok
- dot version: 26 Mo .7z: 51/52 vendors are ok
- dot version: 44Mo .zip (the same as above... zip is compressing way less): 54/55 vendors are ok
Conjecture:
- like on official wheel packages experience, it's hard to have not 1 antivirus complaining
- everyone shall read the title of Andy Grove book: "Only the Paranoid Survive"
Holly shit, I'm green !
so, for b2:
- dot versions will be generated as .7z and .exe
- slim version will be generated < 650 Mo and .7z and .exe
- keeping the big one .7z only
it seems clear the small "IA" guessing anti-virus won't want to bet on auto-extract
all releases are now pre-submitted to anti-virus community, with the goal of making at most 1/30 anti-virus un-happy
Hi, I installed WinPython 3.10.9.0 with
gsudo.ps1 -NoLogo -NoProfile -Command "scoop install -g winpython".scoop is taken from : https://github.com/ScoopInstaller/Scoop#readme
It seems the antivirus has a problem with this file :
C:\ProgramData\scoop\apps\winpython\3.10.9.0\python-3.10.9.amd64\Lib\site-packages\numpy\core\tests\data\umath-validation-set-README.txtCan you investigate why WinPython 3.10.9.0 was seen as a randsomware by antivirus ?
Is there a problem with the numpy package ?