AVG reports psw.banker virus in mainbase.o file
lazarus / 1-Linux

----------------------------------------------------------------------
gambothell · 2007-09-10 22:16

Hi all

I am new to Lazarus. I am a retired Delphi programmer and found
Lazarus the other day. I cannot tell you how happy I am to find this
great package.

I installed first on my Win/XP machine then on my Ubuntu computer.
Today, I ran Grisoft AVG ver 7.5.47 on the Ubuntu computer with
current definitions. The scan reported that the mainbase.o file in the
/bin folder was infected with the PSW.Banker virus.

I installed Lazarus on Ubuntu following the great post by Vincent on
8/18 at 10:12am getting the Lazarus key from mit.edu and using the apt
keys to add it to the repository.

I assume that this is a false positive, but just checking...

Thanks

----------------------------------------------------------------------
Marc · 2007-09-11 09:51

eehh.. in /bin ?
How did it end up there ?

----------------------------------------------------------------------
gambothell · 2007-09-11 16:44

I scanned my XP machine and there were no viruses. The file in the
/bin folder was inserted during installation. I suspect that the hex
signature in the mainbase.o file matches the psw.banker virus, but I
don't feel it is a valid virus.

I was just checking if anyone else has seen this.

Thanks for your comment.

----------------------------------------------------------------------
alanphys · 2007-09-17 06:31

I have the same on my Fedora machine. I am fairly certain it is a
false positive as other users have reported that other AV (ClamAV) do
not pick it up.

Cheers

----------------------------------------------------------------------
gambothell · 2007-09-17 16:15

Glad to see I was not the only one who ever saw this. Thanks for the
comments and I will mark this one down as a false positive.

----------------------------------------------------------------------
Zaher · 2007-09-18 02:45

I have XP and last update with Free AVG, i have not problem with this
file.

----------------------------------------------------------------------
tech-pro · 2007-09-18 08:32

Best thing to do if you aren't sure if something is a virus is to
upload it to virustotal.com. It will give you a consensus of opinion
from about 12 different virus scanners.

----------------------------------------------------------------------
goniometer · 2007-10-26 03:32

I am also new to Lazarus, and I do quite a bit of Delphi programming,
 I have Lazarus 0.9.22 installed in  Ubuntu 7.10.

I also noticed that AVG Anti-Virus 7.5.49 using the virus database
version 269.15.11/1093 reported the PSW.Banker virus in
/.lazarus/bin/mainbase.o .