scan on msi installer x86 win 3.x python gives Win32/Palevo.DZ worm and erases.

What file specifically did you download?

http://www.python.org/ftp/python/3.1.2/python-3.1.2.msi

it was this link on download page for msi windows x86 installer

On Tue, Nov 23, 2010 at 6:03 AM, Martin v. Löwis <report@bugs.python.org>wrote:

>
> Martin v. Löwis <martin@v.loewis.de> added the comment:
>
> What file specifically did you download?
>
> ----------
>
> _______________________________________
> Python tracker <report@bugs.python.org>
> <http://bugs.python.org/issue10500>
> _______________________________________
>

I checked both the 3.1.2 and 3.1.3 x86 msi installers on windows xp machine using Avast and it didn't find anything.

At the very least we'd need to know what virus scanner, and what version of it, the OP used.

Checked python-3.1.2.msi with f-prot, no viruses. Checked download
with firefox (which claims to do a short virus scan), no results.

No problems when I downloaded and installed on Windows XP.
I scanned using the Symantec EndPoint protection and no threats found.

Scanning with Microsoft Security Essentials says "no threat detected".

File checked with ClamAV under Linux, no findings.

VirusTotal says it is clean.

http://www.virustotal.com/file-scan/report.html?id=ca802f144a7e8268a773fa2567fecb0a1d792c62c00f751f27d103a263352113-1290961377

I suggest to close this issue.

Latest AVG Free on windows (9.0.872) says it's clean.

Latest Norton 360 fully updated has it clean; further, File Insight has it marked as Trusted (thousands of Norton users have had the same file installed for over a month with no reported trouble). Seems clean to me.

Thanks for the confirmations; closing this report as invalid.

And I checked both .2 and .3 with McAfee "Nothing found"

I am using CA antivirus, I downloaded 3.13 in link
http://www.python.org/ftp/python/3.1.3/python-3.1.3.msi

and it is still showing Win32/Palevo.DZ when i scan and it quarantines and
then erases the installer msix86 binary (does not include source)

On Sun, Nov 28, 2010 at 2:56 AM, Ezio Melotti <report@bugs.python.org>wrote:

>
> Ezio Melotti <ezio.melotti@gmail.com> added the comment:
>
> I checked both the 3.1.2 and 3.1.3 x86 msi installers on windows xp machine
> using Avast and it didn't find anything.
>
> ----------
> nosy: +ezio.melotti
>
> _______________________________________
> Python tracker <report@bugs.python.org>
> <http://bugs.python.org/issue10500>
> _______________________________________
>

I would recommend to the poster to contact CA and to notify them that they have a false positive no other antivirus (check VirusTotal site) in the world is having :-).

I downloaded that linked MSI again (as its different from the one originally reported)-- and it too is still coming up as clean.

I would suggest that its clearly either a false positive as Jesús is suggesting... or something on your side or between you and python.org is infecting it as or right after you download it.

The virustotal (Note: I am associated to those guys) link I posted included HASHES you can verify in your side to know if it is a false positive or the file is actually altered by "something" in transit/in your site.

I sent the file I downloaded to total virus and it say,
Result:
0/ 36 (0.0%)

I'm not sure what that means, but I am guessing a Result of "-" means it did
not find a virus, I have 2.7.1 installed and it scanned the installer and
was clean, so though I do not know what the Result says I am going to say it
shows clean on my side in the folder I downloaded to; I will send it in to
CA to see if they can recognize it as a false positive.
2010/11/28 Jesús Cea Avión <report@bugs.python.org>

>
> Jesús Cea Avión <jcea@jcea.es> added the comment:
>
> The virustotal (Note: I am associated to those guys) link I posted included
> HASHES you can verify in your side to know if it is a false positive or the
> file is actually altered by "something" in transit/in your site.
>
> ----------
>
> _______________________________________
> Python tracker <report@bugs.python.org>
> <http://bugs.python.org/issue10500>
> _______________________________________
>