{"thread":{"id":"60790","subject":"Virus detected","startedAt":"2024-01-25T15:23:27Z","lastAt":"2024-01-25T16:21:33Z","messageCount":3,"participants":["Hr. Rüge","Konstantin Khomoutov"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"487362","messageId":"a96e6744-c0bb-4f6e-9066-646ca15a353d@GMX.De","threadId":"60790","inReplyTo":null,"subject":"Virus detected","fromName":"Hr. Rüge","fromEmail":"ruege@gmx.de","sentAt":"2024-01-25T15:23:25Z","receivedAt":"2024-01-25T15:23:27Z","isPatch":false,"sender":{"key":"ruege@gmx.de","avatar":null},"body":"Hello,\n\ntrying to use windows version 2.43.0 from https://git-scm.com/downloads\nmy antivirus software detects it as a virus.\nIn parallel something wanted to change my hosts-entries.\n\nIst that normal?\n\nBest regards,\nMartin\n"},{"id":"487363","messageId":"05dbb2da-203b-4e12-ba8f-a46e1fd3f622@GMX.De","threadId":"60790","inReplyTo":"a96e6744-c0bb-4f6e-9066-646ca15a353d@GMX.De","subject":"P. S. Virus detected","fromName":"Hr. Rüge","fromEmail":"ruege@gmx.de","sentAt":"2024-01-25T15:46:16Z","receivedAt":"2024-01-25T15:46:18Z","isPatch":false,"sender":{"key":"ruege@gmx.de","avatar":null},"body":"Tried a few versions:\n\nFirst version WITHOUT detected virus (avira.com) is version 2.41.0.3.\nAll newer versions lead to virus detections.\n\nBest regards,\nMartin\n\n\nAm 25.01.2024 um 16:23 schrieb Hr. Rüge:\n> Hello,\n>\n> trying to use windows version 2.43.0 from https://git-scm.com/downloads\n> my antivirus software detects it as a virus.\n> In parallel something wanted to change my hosts-entries.\n>\n> Ist that normal?\n>\n> Best regards,\n> Martin\n"},{"id":"487366","messageId":"20240125162117.ajysmqwrqc4emybn@carbon","threadId":"60790","inReplyTo":"a96e6744-c0bb-4f6e-9066-646ca15a353d@GMX.De","subject":"Re: Virus detected","fromName":"Konstantin Khomoutov","fromEmail":"kostix@bswap.ru","sentAt":"2024-01-25T16:21:17Z","receivedAt":"2024-01-25T16:21:33Z","isPatch":false,"sender":{"key":"kostix@bswap.ru","avatar":null},"body":"Hi!\n\nOn Thu, Jan 25, 2024 at 04:23:25PM +0100, Hr. Rüge wrote:\n\n> trying to use windows version 2.43.0 from https://git-scm.com/downloads\n> my antivirus software detects it as a virus.\nI assume you're talking about Windows.\n\nThis problem is not new and has been reported and discussed numerous times\non the 'net. It has even been reported to the Git-for-Windows bug tracker -\nsee [1, 2, 3, 4].\n\nThe problem with A\\V software is that it does not operate solely by scanning\nthe executable image files for having byte sequences identifying particular\ninfections - this approach worked in 90s but not for too long. These days,\npieces of A/V software try to _guess_ whether a particular executable is a\nmalware, and to do that, they \"score\" what they inspect; for instance, lack of\nsigning of some binaries lowers the score, not being presented in some\n\"whitelist\" lowers the score and so on.\n\nWhat you can do is to navigate directly to the GfW's project downloads [5]\n(you might have noticed that the link to download the Windows binaries over\nthere at git-scm.com actually already leads there, just to some more\nuser-friendly web page), pick the version and make (32-bit vs 64-bit) you\nneed, download it and then verify its checksum [6] matches that one listed at\nthe download page. If the checksum is OK, you can be sure no software running\non your machine has tampered with the downloaded installer, and then the\nquestion of whether or not the installer contains any malware is the trust in\nthe Git-for-Windows maintainers and the integrity of the GfW's Github project.\n\n> In parallel something wanted to change my hosts-entries.\n> \n> Ist that normal?\n\nI would say it's not normal but as usually, coinsidence of this activity with\nan attempt to install GfW might not indicate any connection between the two -\nother than temporal. Of course, this only stands if you have no malware\nrunning on your host which patches the downloaded files on-the-fly.\n\nStill, if you're not sure about this one, please ask on the dedicated GfW\nmailing list [7].\n\n 1. https://github.com/git-for-windows/git/issues?q=is%3Aissue+in%3Atitle+virus\n 2. https://github.com/git-for-windows/git/issues?q=is%3Aissue+in%3Atitle+malware\n 3. https://groups.google.com/g/git-for-windows/search?q=malware\n 4. https://groups.google.com/g/git-for-windows/search?q=virus\n 5. https://github.com/git-for-windows/git/releases/\n 6. https://www.google.com/search?q=windows+calculate+hash+of+file\n 7. https://groups.google.com/g/git-for-windows/\n\n"}]}