OK, the investigation of the “virus alarm” issue is done, here’s my report.
Step 1. First of all I have tested the synfig installation bundle on the different PC
with the latest version of Avast Free antivirus installed. Result: no threats found.
avast-scan-cropped.png
Then I have installed Synfig and scanned the synfig folder. No alarm.
Step 2. There was one report about the antivirus complaining on libgdk-win32-2.0-0.dll file.
This file is part of CygPort’s mingw-gtk package, version 2.24.12-1.
I wanted to be sure that file is unmodified since the time it was installed.
So I’ve downloaded the original package from here and run an md5sum check for the downloaded version and installed one.
$ md5sum /var/run/media/zelgadis/Windows7_OS/Program\ Files\ (x86)/Synfig/bin/libgdk-win32-2.0-0.dll
c108435ed7f1b1583c108f3e0d0a00f4 /var/run/media/zelgadis/Windows7_OS/Program Files (x86)/Synfig/bin/libgdk-win32-2.0-0.dll
$ md5sum ~/Downloads/mingw-gtk2.0-2.24.12-1/usr/i686-pc-mingw32/sys-root/mingw/bin/libgdk-win32-2.0-0.dll
c108435ed7f1b1583c108f3e0d0a00f4 /home/zelgadis/Downloads/mingw-gtk2.0-2.24.12-1/usr/i686-pc-mingw32/sys-root/mingw/bin/libgdk-win32-2.0-0.dll
Result: the file is unchanged and the same as provided in CygPorts package.
All operations in step 2 were made from my Linux OS, to exclude the possibility of beign affected by (potentially existing) virus.
Step 3. I’ve booted into my build host and run online virus check by ESet.
Result: No threats found.
Step 4. I’ve booted back in Linux and downloaded Kaspersky Rescue Disk iso image.
I have burned the iso image onto CD, booted from it, and launched the virus scan for all hard drives.
Result: No threats found.
Step 5. After all that I booted back into Linux and used online virus scan services to check Synfig binaries.
-
virustotal.com/en/
** Result: 1 of 38 antiviruses reported a threat found. Antivirus name is Antiy-AVL. All the rest claim the file is clean. -
virscan.org/ (doesn’t support files larger than 20Mb, so I’ve scanned libgdk-win32-2.0-0.dll file only)
** Result: No threats found
[size=150]CONCLUSION: After all those tests I can safely classify the virus infection reports as false alarm. I’m putting the Windows binaries are back online.[/size]
Such an incident is another signal to migrate our build toolchain into Fedora’s crosscompile environment. I really don’t like all those “possibilities to have virus”. If we will build Windows binaries on Linux, then the probability of virus infection cases is close to zero.