python - confusing advice
in [Viruses]
|
Prev: wmi namespace ? virus
Next: this is really awesome
From: JClark on 13 Sep 2009 17:36 I have conflicting reports on Python. According to McAfee: http://vil.nai.com/vil/content/v_994.htm "Python is a polymorphic, stealth, file infecting virus. It infects ..COM and .EXE files, including COMMAND.COM. Upon infection, this virus may becomes memory resident at the top of system memory but below the 640K DOS boundary." McAfee goes on to describe all the bad things it does. But.... there are other reports: Python is just a programming language: http://www.python.org/doc/faq/installed/ Or another source says it's a great language for writing viruses (nice guy): http://vx.netlux.org/lib/vvx00.html In my own computer, a search for "python" brings up instances within Roxio, Cyberlink-PowerDVD9, and Pinnacle Studio 12. There is a whole subfolder "Python" under Roxio (c:\program files\common files\roxio shared\media share 101\) Are these just innocent dll's and xml's? Or viruses? If they are viruses why did not my antivirus programs find and remove them (Avira and AVG)? Many thanks for any clarification of my confusion, and for any suggestions about what, if anything, I should do. Jack
From: FromTheRafters on 13 Sep 2009 17:42 "JClark" <jclark(a)nomail.invalid> wrote in message news:6joqa59bm3j56nor5b8ek1jj8s1kha76s8(a)4ax.com... >I have conflicting reports on Python. > > According to McAfee: > > http://vil.nai.com/vil/content/v_994.htm > > "Python is a polymorphic, stealth, file infecting virus. It infects > .COM and .EXE files, including COMMAND.COM. > > Upon infection, this virus may becomes memory resident at the top of > system memory but below the 640K DOS boundary." > McAfee goes on to describe all the bad things it does. > > But.... there are other reports: > > Python is just a programming language: > > http://www.python.org/doc/faq/installed/ > > Or another source says it's a great language for writing viruses (nice > guy): > > http://vx.netlux.org/lib/vvx00.html > > In my own computer, a search for "python" brings up instances within > Roxio, Cyberlink-PowerDVD9, and Pinnacle Studio 12. There is a whole > subfolder "Python" under Roxio (c:\program files\common files\roxio > shared\media share 101\) > > Are these just innocent dll's and xml's? Or viruses? If they are > viruses why did not my antivirus programs find and remove them (Avira > and AVG)? > > Many thanks for any clarification of my confusion, and for any > suggestions about what, if anything, I should do. "Python" by itself is not a proper malware name. Sometimes, a malware (especially a virus) is named similarly to the programming language used to create it (for instance "delf"). Just because a program was written in such a language doesn't mean it is malware.
From: David W. Hodgins on 13 Sep 2009 17:46 On Sun, 13 Sep 2009 17:36:09 -0400, JClark <jclark(a)nomail.invalid> wrote: > I have conflicting reports on Python. > According to McAfee: > http://vil.nai.com/vil/content/v_994.htm In this case, it was a poor choice for the name of the virus, as python is indeed a cross platform programming language. http://www.python.org/download/windows/ Regards, Dave Hodgins -- Change nomail.afraid.org to ody.ca to reply by email. (nomail.afraid.org has been set up specifically for use in usenet. Feel free to use it yourself.)
From: JClark on 13 Sep 2009 21:52 On Sun, 13 Sep 2009 17:42:50 -0400, "FromTheRafters" <erratic(a)nomail.afraid.org> wrote: >"JClark" <jclark(a)nomail.invalid> wrote in message >news:6joqa59bm3j56nor5b8ek1jj8s1kha76s8(a)4ax.com... >>I have conflicting reports on Python. >> >> According to McAfee: >> >> http://vil.nai.com/vil/content/v_994.htm >> >> "Python is a polymorphic, stealth, file infecting virus. It infects >> .COM and .EXE files, including COMMAND.COM. >> >> Upon infection, this virus may becomes memory resident at the top of >> system memory but below the 640K DOS boundary." >> McAfee goes on to describe all the bad things it does. >> >> But.... there are other reports: >> >> Python is just a programming language: >> >> http://www.python.org/doc/faq/installed/ >> >> Or another source says it's a great language for writing viruses (nice >> guy): >> >> http://vx.netlux.org/lib/vvx00.html >> >> In my own computer, a search for "python" brings up instances within >> Roxio, Cyberlink-PowerDVD9, and Pinnacle Studio 12. There is a whole >> subfolder "Python" under Roxio (c:\program files\common files\roxio >> shared\media share 101\) >> >> Are these just innocent dll's and xml's? Or viruses? If they are >> viruses why did not my antivirus programs find and remove them (Avira >> and AVG)? >> >> Many thanks for any clarification of my confusion, and for any >> suggestions about what, if anything, I should do. > >"Python" by itself is not a proper malware name. Sometimes, a malware >(especially a virus) is named similarly to the programming language used >to create it (for instance "delf"). Just because a program was written >in such a language doesn't mean it is malware. > That's what I want to think. Avira doesn't even list python in its virus list. But the McAfee description just uses the word "python" to describe all the bad stuff. Really scary. Take a look at the link: http://vil.nai.com/vil/content/v_994.htm I do appreciate your thoughts on this and former topics. Jack
From: JClark on 13 Sep 2009 21:54
On Sun, 13 Sep 2009 17:46:00 -0400, "David W. Hodgins" <dwhodgins(a)nomail.afraid.org> wrote: >On Sun, 13 Sep 2009 17:36:09 -0400, JClark <jclark(a)nomail.invalid> wrote: > >> I have conflicting reports on Python. >> According to McAfee: >> http://vil.nai.com/vil/content/v_994.htm > >In this case, it was a poor choice for the name of the virus, as >python is indeed a cross platform programming language. >http://www.python.org/download/windows/ > >Regards, Dave Hodgins Hi Dave, So finding all those files with the name python can be ignored on my system? Many thanks for your input. The McAfee description keeps repeating the simple word "python" which makes it so worrisome. Jack |