Probably false alarm on files generated by gcc in Haskell Platform

Viruses and worms
1

Hi, to reproduce:

download and install Haskell Platform http://hackage.haskell.org/platform/2009.2.0.2/HaskellPlatform-2009.2.0.2-setup.exe

Create a minimal C program:

int main(int argc, char **argv) {
return 0;
}

compile it using the gcc from the package using this command line:


"C:\Devel\Haskell Platform\gcc.exe" "-BC:\Devel\Haskell Platform\gcc-lib" "-IC:\Devel\Haskell Platform\include\mingw" tst.c "-o" tst "-BC:\Devel\Haskell Platform\gcc-lib" "-IC:\Devel\Haskell Platform\include\mingw" "-D__GLASGOW_HASKELL__=610" "-Isrc/win32" "-Isrc" "-Isrc/win32" "-Isrc" "-I." "-DWIN32" "-DHAVE_HTTP" "-DWIN32" "-DHAVE_HTTP" "-D_REENTRANT" "-D_REENTRANT" "-IC:\Devel\Haskell Platform\process-1.0.1.1\include" "-IC:\Program Files\Haskell\haskeline-0.6.2.1\ghc-6.10.4\include" "-IC:\Program Files\Haskell\zlib-0.5.2.0\ghc-6.10.4\include" "-IC:\Devel\Haskell Platform\directory-1.0.0.3\include" "-IC:\Devel\Haskell Platform\Win32-2.2.0.0\include" "-IC:\Devel\Haskell Platform\old-time-1.0.0.2\include" "-IC:\Devel\Haskell Platform\extralibs\network-2.2.1.4\ghc-6.10.4\include" "-IC:\Devel\Haskell Platform\bytestring-0.9.1.4\include" "-IC:\Devel\Haskell Platform\base-4.1.0.0\include" "-IC:\Devel\Haskell Platform/include"

where you replace C:\Devel\Haskell Platform with the place you have installed it to and tst.c by the minimal C program.

Now avast Home edition 4.8.1351 with VPS version 091115-0 produces a virus warning in the generated file (Win32:Malware-gen).

Yesterday it worked but now I get these warnings. I’m not completely sure it’s a false alarm but it seems like one.

2

Thank you,
false positive will be fixed in next VPS update.

Milos

3

Looks like this is still not fixed. When i install packages with cabal, avast always pops up with a message about a suspected malware.

4

You posted in a topic from 2009. :wink:
You can report a possible FP here: https://www.avast.com/contact-us.php?subject=VIRUS-FILE

5

Yes, we often find that FPs use to repeat themselves, when no longer “commemmorated”.
Therefore a new FP report should be send.
We as volonteers on the support forums should Keep the avast team sharp.

polonus