Mirror of forum.nim-lang.org

10824 :: The nim installer for Windows contains malware

• edreamleo (orginal) [2024-01-01T13:03:43+01:00] view original

  There is a dangerous link at https://nim-lang.org/download/nim-2.0.2_x64.zip

  Mozilla warned me before the download.

  bitdefender removed two files afterwards. Here is the log:

  nim-2.0.2_x64.zip=>nim-2.0.2/bin/nimgrab.exe
  Trojan.GenericKD.70907822 Deleted
   Gen:Variant.Tedy.472027 Deleted
  Run

  Edward

---

• Araq (orginal) [2024-01-01T14:27:41+01:00] view original

  False positives.

---

• edreamleo (orginal) [2024-01-01T15:01:59+01:00] view original

  Thanks for your response!

  Why do you say the responses are false?

  And even if they are false positives, these messages do not leave a good first impression :-)

---

• edreamleo (orginal) [2024-01-01T15:15:00+01:00] view original

  See Nim issue #23151.

---

• nasl (orginal) [2024-01-01T15:37:23+01:00] view original

  Nim community can help: report false positive to AV companies:

  https://github.com/yaronelh/False-Positive-Center

  @Araq can Nim team add a community comment in VirusTotal for nim official binaries?

---

• Araq (orginal) [2024-01-01T15:38:48+01:00] view original

  I say, the responses are false, because they are. I wrote "nimgrap" and I know the pipelines producing the binaries, I should know.

---

• ringabout (orginal) [2024-01-01T15:44:50+01:00] view original

  fwiw, https://github.com/nim-lang/virus_checker/actions submits the Nim nightlies binaries to virusTotal everyday

---

• nasl (orginal) [2024-01-01T16:08:28+01:00] view original

  Adding a comment here could assuage some fears: https://www.virustotal.com/gui/file/948dbf8e3fdd1b5242e3d662fd25c50e9b2586e097be8a85c22d7db2bde70bad/community

---

• edreamleo (orginal) [2024-01-02T14:44:16+01:00] view original

  Thanks to all for your helpful comments.

  Several of us in the Leo world are up and running with Nim.

---

• dwhall256 (orginal) [2024-01-02T19:03:36+01:00] view original

  I had my IT dept submit a false-positive report last year. The immediate work-around was to install nim and write my nim source in our designated virus-scan-exclusion path.

  P.S. What's "the Leo world" ?

---

• sls1005 (orginal) [2024-01-03T10:38:56+01:00] view original

  Maybe add a warning to the download page for Windows, something like "If your antivirus software consider it a malware, you should ..."

  This can prevent the issue from emerging again and again. It still cannot solve the problem, but people would know how to deal with it.

---

• didlybom (orginal) [2024-01-03T12:43:52+01:00] view original

  That is a good idea.

---