Antivirus/Malware report

Question

Antivirus/Malware report

kravlost opened this issue 7 years ago · comments

When installing atom-beautify, Avira antivirus is picking up an HTML/ExpKit.Gen2 infection in the C:\Users\Name.atom.apm\registery.npmjs.org\which.cache.json file.

I suspect that it's Avira being over-sensitive but thought I'd pass it on.

Austin Cheney · Answer 1 · Wed Mar 01 2017 00:02:01 GMT+0800 (China Standard Time)

Linking to other issue. Glavin001/atom-beautify#1532 (comment)

isaacs · Answer 2 · Wed Mar 01 2017 02:23:29 GMT+0800 (China Standard Time)

That's weird. I'm pretty sure it's not a virus, you can check out the source. The cached JSON file isn't even executable, so I wonder what kind of signature it's triggering.

Oleksii Zubko · Answer 3 · Wed Mar 01 2017 13:51:21 GMT+0800 (China Standard Time)

the same issue with avira http://www.avira.com/en/support-threats-summary-product?tid=5424&threat=HTML%252FExpKit.Gen2&track=1 . Yesterday all has been fine.

kravlost · Answer 4 · Wed Mar 01 2017 16:50:49 GMT+0800 (China Standard Time)

I've sent it to Avira as a false positive. I skimmed through the file and it looked OK, perhaps the JSON is being treated as corrupt HTML by the AV.

kravlost · Answer 5 · Wed Mar 01 2017 20:53:50 GMT+0800 (China Standard Time)

Avira confirm it's clean, so a false positive at their end. :)

Oleksii Zubko · Answer 6 · Wed Mar 01 2017 21:10:33 GMT+0800 (China Standard Time)

Great, Thanks! :)

Noobincoding · Answer 7 · Thu Mar 02 2017 13:53:01 GMT+0800 (China Standard Time)

I am having the same issue when i try to install angular cli. Am i in the safe side? Are you guys sure its only Avira acting out?

isaacs · Answer 8 · Thu Mar 02 2017 14:14:13 GMT+0800 (China Standard Time)

Yes. Definitely a false positive.

Future people coming to this thread and finding it locked: yes, node-which is definitely not a virus. (If you don't believe me, stop using my code! ;)