SliTaz Forum

B.P.

Member

Registered: 2019-03-11

Posts: 3

Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

Hi All,

can you please look into the last Rolling ISO-files of today.

Was trying to install it on my USB's and all my anti-virus programs (Norton, AVG and Avast) claim the ISO's are infected with the Troyan WIN32:EVO-gen [susp].

Perhaps the PC where the ISO was generated on was infected?

B.P.

Member

Registered: 2019-03-11

Posts: 3

Re: Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

Previous attempts and downloads went trough Lubuntu and Windows-7.

Btw, the source used for the ISO's is

http://mirror.slitaz.org/iso/rolling/

Third try, on an other system (XP-XPOS running AVG) blocks the download from the website when trying to download the Slitaz-rolling.ISO of the 10th of march 2019.

It mentions it is infected with BlackList

The other downloads came trough, however, but with scanning of the downloads they were also found to be infected with the Troyan WIN32:EVO-gen [susp].

[attachment=47285,2785]

bellard

Administrator

Registered: 2011-03-28

Posts: 657

Re: Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

False positive.

See http://hg.slitaz.org/wok/file/tip/syslinux/stuff/iso2exe/README

B.P.

Member

Registered: 2019-03-11

Posts: 3

Re: Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

@Bellard:

so 3 anti-virus totally different programs, AVG, Avast and Norton are wrong?

The funny thing is, the same rolling ISO (slitaz-rolling.iso) of of the 19th of February 2019 was clean.

So that means you have started adding these headers only in the last two weeks ?

Btw: All these 3 ant-virus programs will put the ISO's in quarantine and white-listing them is not an option as they immediately are being put back in quarantine: even if I wish to use them I am not able to.

Rufus (the program I use to burn the ISO's) also rejected the ISO's btw

bellard

Administrator

Registered: 2011-03-28

Posts: 657

Re: Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

The patch set date is Sat Feb 23 13:25:31 2019 +0100

http://hg.slitaz.org/wok/rev/ab8e834bbcfe

And the README has been updated Mon Mar 11 12:28:08 2019 +0100

http://hg.slitaz.org/wok/rev/be2ab6ab8f7e#l3.1

cray

Member

Registered: 2019-02-03

Posts: 35

Re: Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

I remember the slitaz-rolling.iso dated 24th of Febrary downloaded from sliaz.org didn't match its md5sum, I tried twice with same unmatched md5 and finally downloaded it from a mirror and that one matched the md5sum provided on the slitaz site.

I hope this was not related with the trojan infection and also hope no one was able to hack slitaz.org isos. I'm only sure about the rolling one of that day as a couple of the others like the 5in1 do not provide an md5sum. This was the first time since I use Slitaz that I find an iso downloaded from the main site with a wrong md5sum which only hapened there as the other mirrors downloaded a correct md5 one.

bellard

Administrator

Registered: 2011-03-28

Posts: 657

Re: Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

Every slitaz iso file has an embedded md5sum you can check it which taziso:

# taziso slitaz-core-5in1.iso isomd5

Or with tazpanel in boot->ISO mine

cray

Member

Registered: 2019-02-03

Posts: 35

Re: Slitaz ISO-distro's contain Troyan WIN32:EVO-gen [susp]

In slitaz.org and in any of its mirrors, in the /rolling/ folder, a separate .md5 file is provided for the following isos: rolling, preinit, core and core64 but not for 5in1 and loram isos.

Thanks Bellard.