This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: executuable in distutils triggering microsoft anti virus
Type: security Stage:
Components: Distutils, Windows Versions: Python 3.5
process
Status: closed Resolution: third party
Dependencies: Superseder:
Assigned To: steve.dower Nosy List: Rob Bairos, dstufft, eric.araujo, paul.moore, steve.dower, tim.golden, zach.ware
Priority: normal Keywords:

Created on 2016-06-24 15:03 by Rob Bairos, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Messages (5)
msg269186 - (view) Author: Rob Bairos (Rob Bairos) Date: 2016-06-24 15:03
python 3.5:  wininst-14.0.exe

Is triggering 
Microsoft Security Essentials virus detection:

Recommended action: Remove this software immediately.

Items: 
file:D:\PythonBuilds\202ee57ca3\py\Lib\distutils\command\wininst-14.0.exe

I've tried on two separate machines so far, with same quarantine.


Microsoft Security Essentials (running on Windows 7)

Antimalware Client Version: 4.9.218.0
Engine Version: 1.1.12805.0
Antivirus definition: 1.223.2544.0
Antispyware definition: 1.223.2544.0
Network Inspection System Engine Version: 2.1.12706.0
Network Inspection System Definition Version: 116.10.0.0
msg269193 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2016-06-24 16:56
Wow, that sucks.

I just rebuilt it and it's still detected, so presumably somebody distributed malware as a bdist_exe and it made it into the signature. There haven't been any unexpected modifications to the sources.

I've submitted the file to the right people, so hopefully it will be removed from the signature soon.
msg269203 - (view) Author: Rob Bairos (Rob Bairos) Date: 2016-06-24 17:40
thanks for the quick action!
msg269448 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2016-06-28 18:37
FYI the definitions have been updated and I'm no longer seeing the false positive.

Definition version: 1.223.2858.0
msg269449 - (view) Author: Rob Bairos (Rob Bairos) Date: 2016-06-28 18:52
Great. Thanks for the update

On Tue, Jun 28, 2016 at 2:37 PM, Steve Dower <report@bugs.python.org> wrote:

>
> Steve Dower added the comment:
>
> FYI the definitions have been updated and I'm no longer seeing the false
> positive.
>
> Definition version: 1.223.2858.0
>
> ----------
>
> _______________________________________
> Python tracker <report@bugs.python.org>
> <http://bugs.python.org/issue27383>
> _______________________________________
>
History
Date User Action Args
2022-04-11 14:58:33adminsetgithub: 71570
2016-06-28 18:52:08Rob Bairossetmessages: + msg269449
2016-06-28 18:37:25steve.dowersetmessages: + msg269448
2016-06-24 17:40:33Rob Bairossetmessages: + msg269203
2016-06-24 16:56:32steve.dowersetstatus: open -> closed
assignee: steve.dower
resolution: third party
messages: + msg269193
2016-06-24 15:06:48zach.waresetnosy: + paul.moore, tim.golden, zach.ware, steve.dower
components: + Windows
2016-06-24 15:03:41Rob Bairoscreate