Re: [Nasm-devel] Win32 NASM virus-infected

[anonymous c. <nas...@ya...>]

> > Hey, Norton Anti-virus 2004 reported that virus (w32/ctx) and deleted nasmw.
> 
> Well, sh*t! Guess we'd better pull that, then. can anyone come up with a 
> replacement real quick? I'm not having any luck with either watcom or 
> cc386, at the moment. Bizzare errors I haven't figured out how to fix...
> 
> Sorry for not taking this more seriously - it's been going on for a 
> *long* time!

There is no need to pull the 0.98.38 nasmw.exe at SourceForge -- it is clean.

I have re-checked it with F-Prot and today's signature files -- no virus.
Also, I have re-submitted it to Kaspersky's online checker -- no virus.

I believe that these W32/CTX reports are caused by (a) people downloading the
binary in question to a machine which is already infected -- this will cause
the binary to get infected as soon as it is saved to disk, which in turn will
cause the anti virus software to yell -- or (b) anti virus software which is
mis-identifying the binary in question as being infected, even though it is
not. Personally I think that (a) is more likely than (b); however, (b) can't
be ruled out -- just inquire with the vendor of your anti virus software to
be absolutelty certain.

Here are the files I just grabbed from SourceForge:

2003/11/24  20:09              218,973 nasm-0_98_38-win32.zip
 contains
2002/04/30  22:09               24,958 copying
2003/09/12  20:16              324,096 nasmw.exe
2003/09/12  20:16              159,232 ndisasmw.exe

And here are their "md5sum --binary" checksums:

ca357adaeaf90ea8f4b174ec1964b74e *nasm-0_98_38-win32.zip
 contains
18190cdb47e88b49e9cb886b8103cfbf *copying
f2e3ec4de3677be3ca165625749b7cae *nasmw.exe
c59b6ad5695ac2ee1eba0e1d1d9316e7 *ndisasmw.exe

So, if your anti virus software is yelling about 0.98.38 nasmw.exe, then you
might want to take a look at your md5sum checksums...

__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/