A possible virus

[Dan Egli]

FAQ: My Anti-Virus software detected a virus in samba-latest.tar.gz. Whats
with that?

Answer: This is a false warning. It is completely impossible for a virus to
INFECT a archive (like .tar.gz) because a virus infects EXECUTABLE CODE,
which an archive is not. And even if there was a virus contained in one of
the files in the archive, in its compressed form it would not be recognised.
The virus warning is from software that performs 'Heuristic' scans (i.e.
reads the file byte by byte looking for virus-like instructions) where the
software thinks that the .gz is executable, and if it was executable, then a
particular byte-sequence in the file would resemble a possible virus.

Analysis: The file is safe, not infected, cannot be infected, and your
software is giving you a false warning. File is as safe as any uncompiled
program can be considered.


----- Original Message -----
From: <dan_mcmanus at co.blm.gov>
To: <samba at samba.org>
Sent: Thursday, April 26, 2001 10:07 AM
Subject: A possible virus


> Hello,
>
> I downloaded samba-latest.tar.gz from http://us1.samba.org/samba/ftp/  and
> my anti-virus software said it was infected, but didn't clean it, so I
> deleted it. I downloaded it onto a Windows NT machine. I don't know
whether
> it's my software freaking out or an actual problem with the file, but I
> thought I should let you know.
>
> Thanks,
> Dan McManus
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  http://lists.samba.org/mailman/listinfo/samba
>