Skip to content

WinPython 3.10.9.0 was seen as a randsomware by antivirus #1364

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
sebma opened this issue Jun 26, 2024 · 10 comments
Open

WinPython 3.10.9.0 was seen as a randsomware by antivirus #1364

sebma opened this issue Jun 26, 2024 · 10 comments
Labels
Procedure Procedure
Milestone
2024-04 Numpy-2 /...

Comments

@sebma
Copy link

sebma commented Jun 26, 2024 •
edited
Loading

Hi, I installed WinPython 3.10.9.0 with gsudo.ps1 -NoLogo -NoProfile -Command "scoop install -g winpython".

scoop is taken from : https://github.com/ScoopInstaller/Scoop#readme

It seems the antivirus has a problem with this file : C:\ProgramData\scoop\apps\winpython\3.10.9.0\python-3.10.9.amd64\Lib\site-packages\numpy\core\tests\data\umath-validation-set-README.txt

Can you investigate why WinPython 3.10.9.0 was seen as a randsomware by antivirus ?

Is there a problem with the numpy package ?
@stonebig
Copy link
Contributor

a ransomware in a text file .....

maybe check the hash of what you get.

WinPython 2022-04 release (January 22nd, 2023)

MD5 SHA-1 SHA-256 Binary Size SHA3-256
5d6c22345a952affe1266a92abf14ceb 7ba4581efb578247ba3ee2d998162135e3ef83b3 7c61728acb13954ba862348116676c30617aec8fc45536fa882c9b0dd9278eda Winpython64-3.10.9.0dot.exe 27 467 759 Bytes b1a6760c984ccdbd13df31c742bf6dbb2b5246f617781f313e2db843dc6d89ff
ba3268df9d7e5206dee6b7a42dbab8a7 214ebb0110df945f37be8ff884447103b69d7d70 49738ff219cd23cd1e96afaf2a6b8eabdcdb04575167dd46e1f132e946821326 Winpython32-3.10.9.0dot.exe 26 249 584 Bytes 3e39907400b728719093edb0a67213da956f243caeaaf13842faeab1b0ee9235
46a26e25ca6524ebaabfa04b390d3b91 da52d4ab1bdf923aaf36f69f5d8eeb057e8eab84 1577b72582c04fb43f2353c17d09c41f927f8a4994f33a2a6689e2558ade0204 Winpython64-3.11.1.0dot.exe 24 404 166 Bytes e5fa479d2d5948f0e399c08bcfe30ed088dc10d726ba2406ec22c5d65a6769f3
8e3fb06b4ae8e3741207bd650b62df15 3a2600c37217d9be245ec67f1a1154af282424d6 6d265a1b795d3a444a8890db114f8cd7153b41378a02bd21cb2bcd5ba431c4e3 Winpython64-3.10.9.0.exe 683 571 740 Bytes 3cef6ad93ef127063b24b112c7a4e9437878033e0dee486c5d80991c964ee860
8ba6cb889fba7bd208a36cdd123dbcb6 aa63897b18bb8bb35b236a1068501552290c24f8 7664b45097ab206828a9c1de7b03c14d622dc2bb94733075c62a6174c2252698 Winpython64-3.11.1.0.exe 562 936 337 Bytes 024c570acf8bd6a0f5ce6fad784ff6791323f984c911a81523da485bcc9432ae

@stonebig
Copy link
Contributor

in any case if you have a doubt, don't stress yourself and use another distro. You are free

@stonebig
Copy link
Contributor

i don't know what is this "scoop" thing

@stonebig
Copy link
Contributor

WinPython "original" are downloadables from SourceForce and Github, and you get hash files on github and https://groups.google.com/g/winpython to check what you get is what has been uploaded, 1 year and 5 month ago

@stonebig
Copy link
Contributor

chocolatey or scoop being unknown middlemen, anything is possible.

@stonebig
Copy link
Contributor

stonebig commented Jul 14, 2024 •
edited
Loading

In any case, things should be done to give you more control means:

  • A version of WinPython kept below 650 Mo that you can upload to VirusTotal, and that would be greened
  • the non-sense balooning of standard version (Anaconda currently the same over 900 Mo) must be reversed.

... so upcoming 2024-04 release will :

  • bucher a lot of packages
  • have a .7z archive option (as Windows11 can un-pack it)

@stonebig
Copy link
Contributor

stonebig commented Jul 14, 2024 •
edited
Loading

Further analysis:

  • slim version: 620 Mo .exe (auto-unpack 7x): 41/42 vendors are ok
  • dot version: 26 Mo .7z: 51/52 vendors are ok
  • dot version: 44Mo .zip (the same as above... zip is compressing way less): 54/55 vendors are ok

Conjecture:

  • like on official wheel packages experience, it's hard to have not 1 antivirus complaining
  • everyone shall read the title of Andy Grove book: "Only the Paranoid Survive"

@stonebig
Copy link
Contributor

Holly shit, I'm green !
image

@stonebig stonebig added this to the 2024-04 Numpy-2 milestone Jul 14, 2024
@stonebig
Copy link
Contributor

stonebig commented Jul 14, 2024 •
edited
Loading

so, for b2:

  • dot versions will be generated as .7z and .exe
  • slim version will be generated < 650 Mo and .7z and .exe
  • keeping the big one .7z only

it seems clear the small "IA" guessing anti-virus won't want to bet on auto-extract

@stonebig
Copy link
Contributor

stonebig commented May 4, 2025

all releases are now pre-submitted to anti-virus community, with the goal of making at most 1/30 anti-virus un-happy

@stonebig stonebig added the Procedure Procedure label May 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Procedure Procedure
Projects
None yet
Milestone
2024-04 Numpy-2 / .7z
Development

No branches or pull requests
2 participants
@stonebig @sebma