You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@netbeans.apache.org by Emilian Bold <em...@gmail.com> on 2019/08/04 08:21:24 UTC
NetBeans clank JARs flagged as infected by antiviruses
Hello,
These ZIP at http://netbeans.osuosl.org/binaries/BBEBAEE8729CCF165E2080A915542C6875208F97-clank_0.3.9.zip
contains org-clang-sema.jar and org-clang-ast.jar which are flagged by
AVG and Avast as containing Java:Agent-CNL [Expl]:
* https://www.virustotal.com/gui/file/b962183ab8ccd075f1f4ec7bbb8339ba47a965081b1e5c7c2d74172ced5c8958/detection
* https://www.virustotal.com/gui/file/0f4c0fbeaddd72242b05856754428673d9636f97b09510d062afc9526981c00c/detection
In another online scan
https://metadefender.opswat.com/results#!/file/bzE5MDgwNHIxVG5NR0VtQkhKZzYyZkdWUUg/regular/multiscan
Microsoft Defender ATP claims org-clang-ast.jar contains Malware.
These JARs are used by NetBeans via libs.clank:
https://github.com/emilianbold/netbeans-releases/blob/master/libs.clank/external/binaries-list
--emi
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: Fwd: NetBeans clank JARs flagged as infected by antiviruses
Posted by Emilian Bold <em...@gmail.com>.
I can't be certain it's a false positive, I just assume so. Not sure how
clank is compiled and if I can produce the same bits to compare...
Take this email as you wish. Since NetBeans will include the same jars in
the next release it will get the same user feedback.
--emi
dum., 4 aug. 2019, 14:06 Matthias Bläsing <mb...@doppel-helix.eu> a
scris:
> Hi,
>
> Am Sonntag, den 04.08.2019, 13:52 +0300 schrieb Emilian Bold:
> > The false positive
>
> so the right thing to do is to tell the users, that their snake-oil
> software is broken. I'm sure using clang/clank libraries in trojans is
> realistic, these warnings are a sign of broken software (on the
> antivirus site).
>
> I would bet, that ptrace would be marked as a trojan helper, if present
> on windows ...
>
> So what is the takeaway? We can't just hopp around just to fool a
> broken antivirus engine.
>
> Greetings
>
> Matthias
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
> For additional commands, e-mail: dev-help@netbeans.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
>
Re: Fwd: NetBeans clank JARs flagged as infected by antiviruses
Posted by Matthias Bläsing <mb...@doppel-helix.eu>.
Hi,
Am Sonntag, den 04.08.2019, 13:52 +0300 schrieb Emilian Bold:
> The false positive
so the right thing to do is to tell the users, that their snake-oil
software is broken. I'm sure using clang/clank libraries in trojans is
realistic, these warnings are a sign of broken software (on the
antivirus site).
I would bet, that ptrace would be marked as a trojan helper, if present
on windows ...
So what is the takeaway? We can't just hopp around just to fool a
broken antivirus engine.
Greetings
Matthias
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Fwd: NetBeans clank JARs flagged as infected by antiviruses
Posted by Emilian Bold <em...@gmail.com>.
This warning is for
53EDE27126390D0EF244777525FB7CCA13E34368-clank_0.3.9 too:
https://www.virustotal.com/gui/file/fd5846c6360095d6419bbbd0a89b41fcc4e799fad8a61a252dad28bd9b70f127/detection
and A1DC7BFEB1A7C4D6DBC9D74545C1686F14C229F8-clank_0.3.9 :
https://www.virustotal.com/gui/file/1a83b1daaede6011c8727ed94aada8ef394fd9ca3344989f0ee2f7981aac8dc7/detection
and 34912CF2DAABFF7E126957B12B571F29F7E7A716-clank_0.3.9 :
https://www.virustotal.com/gui/file/7354afeaefaa89f21f53d1dbf732160e854c0754970380cda7d9a4a4d0621d5d/detection
and NOT for F3A74CD526DF05DFBFF96D0072BB71A334B52AD9-clank_0.3.9 :
https://www.virustotal.com/gui/file/1adfb1a9d34937b7bdf55919d23d9e0e79b793f98b9614a226acc98e6ba7a85c/detection
and NOT for F20EEEDF4FE6B93B180387576FB780EED9F79C66-clank_0.3.9 :
https://www.virustotal.com/gui/file/9cb2d467ed704aa0ad2af532623ab3d843202c61002b4562916d3a9546d99a95/detection
and NOT for the org-clang-sema.jar in netbeans-8.2-201609300101-cpp.zip
The false positive(?) seems to show up since
https://github.com/emilianbold/netbeans-releases/commit/024abf6b5076eeefb5abfde2c553c60e673d3c4a#diff-f055ca4fd6fc6b2d4f93f833e1b8776f
on May 2, 2017
--emi
On Sun, Aug 4, 2019 at 11:21 AM Emilian Bold <em...@gmail.com> wrote:
>
> Hello,
>
> These ZIP at http://netbeans.osuosl.org/binaries/BBEBAEE8729CCF165E2080A915542C6875208F97-clank_0.3.9.zip
> contains org-clang-sema.jar and org-clang-ast.jar which are flagged by
> AVG and Avast as containing Java:Agent-CNL [Expl]:
>
> * https://www.virustotal.com/gui/file/b962183ab8ccd075f1f4ec7bbb8339ba47a965081b1e5c7c2d74172ced5c8958/detection
>
> * https://www.virustotal.com/gui/file/0f4c0fbeaddd72242b05856754428673d9636f97b09510d062afc9526981c00c/detection
>
> In another online scan
> https://metadefender.opswat.com/results#!/file/bzE5MDgwNHIxVG5NR0VtQkhKZzYyZkdWUUg/regular/multiscan
> Microsoft Defender ATP claims org-clang-ast.jar contains Malware.
>
> These JARs are used by NetBeans via libs.clank:
> https://github.com/emilianbold/netbeans-releases/blob/master/libs.clank/external/binaries-list
>
> --emi
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists