Date:	Thu, 22 Apr 1999 11:39:50 +0300 (IDT)
From:	Eli Zaretskii <eliz AT is DOT elta DOT co DOT il>
X-Sender:	eliz AT is
To:	Hans-Bernhard Broeker <broeker AT physik DOT rwth-aachen DOT de>
cc:	djgpp AT delorie DOT com
Subject:	Re: Download site
In-Reply-To:	<199904201812.UAA07965@acp3bf.physik.rwth-aachen.de>
Message-ID:	<Pine.SUN.3.91.990422113931.15748Q-100000@is>
MIME-Version:	1.0
Reply-To:	djgpp AT delorie DOT com
X-Mailing-List:	djgpp AT delorie DOT com
X-Unsubscribes-To:	listserv AT delorie DOT com

On Tue, 20 Apr 1999, Hans-Bernhard Broeker wrote:

> In article <371D22A6 DOT 67CE927E AT student DOT kuleuven DOT ac DOT be> you wrote:
> > I had a similar problem. My scanner (it was TBAV I think) reported that
> > several executables downloaded from the djgpp site were infected by an
> > 'unknown virus'. I assumed it was a false alarm, I know that some virus
> > scanners don't like compilers, but since it kept bugging me about it I
> > removed the scanned and installed Winguard, which doesn't complain about
> > anything.
> > Was my assumption about the alert being a false hit too early?
> 
> Could have been. It's hard to tell, or may be impossible, without
> knowing what made the scanner cry 'unknown virus', which is a rather
> unusual result from a scanning engine. They normally search for known
> viruses, so there must have been some heuristical method, and the
> engine should at least optionally give reasons *why* it thinks there's
> a virus.

This has come up during v2.0 pretest.  The DJGPP v2.x stub does some
unusual stunts (I forgot which ones) trying to optimize the code for
size, and some virus scanners take that as a sign of a virus.

Maybe this is another case like that.

- Raw text -