SliTaz Forum

Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

(8 posts) (3 voices)

• Started 5 years ago by B.P.
• Latest reply from cray
• This topic is not resolved

Tags:

No tags yet.

1. 

   B.P.
   

   offline

   Member

   Hi All,

   can you please look into the last Rolling ISO-files of today.
   Was trying to install it on my USB's and all my anti-virus programs (Norton, AVG and Avast) claim the ISO's are infected with the Troyan WIN32:EVO-gen [susp].

   Perhaps the PC where the ISO was generated on was infected?

   Attachments

   1. 1.GIF (7.8 KB, 460 downloads) 5 years old
   2. slitaz-avast.GIF (67.8 KB, 427 downloads) 5 years old
   3. slitaz-norton.PNG (19.3 KB, 400 downloads) 5 years old

   Posted 5 years ago #
2. 

   B.P.
   

   offline

   Member

   Previous attempts and downloads went trough Lubuntu and Windows-7.

   Btw, the source used for the ISO's is
   http://mirror.slitaz.org/iso/rolling/

   Third try, on an other system (XP-XPOS running AVG) blocks the download from the website when trying to download the Slitaz-rolling.ISO of the 10th of march 2019.
   It mentions it is infected with BlackList

   The other downloads came trough, however, but with scanning of the downloads they were also found to be infected with the Troyan WIN32:EVO-gen [susp].

   

   Attachments

   1. Slitaz-website-blacklist.GIF (28.7 KB, 828 downloads) 5 years old

   Posted 5 years ago #
3. 

   Bellard
   

   offline

   Key Master

   False positive.
   See http://hg.slitaz.org/wok/file/tip/syslinux/stuff/iso2exe/README

   Posted 5 years ago #
4. 

   B.P.
   

   offline

   Member

   @Bellard:

   so 3 anti-virus totally different programs, AVG, Avast and Norton are wrong?
   The funny thing is, the same rolling ISO (slitaz-rolling.iso) of of the 19th of February 2019 was clean.
   So that means you have started adding these headers only in the last two weeks ?

   Btw: All these 3 ant-virus programs will put the ISO's in quarantine and white-listing them is not an option as they immediately are being put back in quarantine: even if I wish to use them I am not able to.
   Rufus (the program I use to burn the ISO's) also rejected the ISO's btw

   Posted 5 years ago #
5. 

   Bellard
   

   offline

   Key Master

   The patch set date is Sat Feb 23 13:25:31 2019 +0100
   http://hg.slitaz.org/wok/rev/ab8e834bbcfe

   And the README has been updated Mon Mar 11 12:28:08 2019 +0100
   http://hg.slitaz.org/wok/rev/be2ab6ab8f7e#l3.1

   Posted 5 years ago #
6. 

   cray
   

   offline

   Member

   I remember the slitaz-rolling.iso dated 24th of Febrary downloaded from sliaz.org didn't match its md5sum, I tried twice with same unmatched md5 and finally downloaded it from a mirror and that one matched the md5sum provided on the slitaz site.
   I hope this was not related with the trojan infection and also hope no one was able to hack slitaz.org isos. I'm only sure about the rolling one of that day as a couple of the others like the 5in1 do not provide an md5sum. This was the first time since I use Slitaz that I find an iso downloaded from the main site with a wrong md5sum which only hapened there as the other mirrors downloaded a correct md5 one.

   Posted 5 years ago #
7. 

   Bellard
   

   offline

   Key Master

   Every slitaz iso file has an embedded md5sum you can check it which taziso:
   # taziso slitaz-core-5in1.iso isomd5

   Or with tazpanel in boot->ISO mine

   Posted 5 years ago #
8. 

   cray
   

   offline

   Member

   In slitaz.org and in any of its mirrors, in the /rolling/ folder, a separate .md5 file is provided for the following isos: rolling, preinit, core and core64 but not for 5in1 and loram isos.

   Thanks Bellard.

   Posted 5 years ago #

RSS feed for this topic

Reply

You must log in to post.