# Virus detected 3 messages from 2024-01-25 to 2024-01-25. Participants: Hr. Rüge, Konstantin Khomoutov. Thread: https://gitlist.dev/t/60790 ## Hr. Rüge, 2024-01-25 15:23 Subject: Virus detected Message-ID: URL: https://gitlist.dev/e/a96e6744-c0bb-4f6e-9066-646ca15a353d%40GMX.De ``` Hello, trying to use windows version 2.43.0 from https://git-scm.com/downloads my antivirus software detects it as a virus. In parallel something wanted to change my hosts-entries. Ist that normal? Best regards, Martin ``` ## Hr. Rüge, 2024-01-25 15:46 Subject: P. S. Virus detected Message-ID: <05dbb2da-203b-4e12-ba8f-a46e1fd3f622@GMX.De> URL: https://gitlist.dev/e/05dbb2da-203b-4e12-ba8f-a46e1fd3f622%40GMX.De In-Reply-To: ``` Tried a few versions: First version WITHOUT detected virus (avira.com) is version 2.41.0.3. All newer versions lead to virus detections. Best regards, Martin Am 25.01.2024 um 16:23 schrieb Hr. Rüge: > Hello, > > trying to use windows version 2.43.0 from https://git-scm.com/downloads > my antivirus software detects it as a virus. > In parallel something wanted to change my hosts-entries. > > Ist that normal? > > Best regards, > Martin ``` ## Konstantin Khomoutov, 2024-01-25 16:21 Subject: Re: Virus detected Message-ID: <20240125162117.ajysmqwrqc4emybn@carbon> URL: https://gitlist.dev/e/20240125162117.ajysmqwrqc4emybn%40carbon In-Reply-To: ``` Hi! On Thu, Jan 25, 2024 at 04:23:25PM +0100, Hr. Rüge wrote: > trying to use windows version 2.43.0 from https://git-scm.com/downloads > my antivirus software detects it as a virus. I assume you're talking about Windows. This problem is not new and has been reported and discussed numerous times on the 'net. It has even been reported to the Git-for-Windows bug tracker - see [1, 2, 3, 4]. The problem with A\V software is that it does not operate solely by scanning the executable image files for having byte sequences identifying particular infections - this approach worked in 90s but not for too long. These days, pieces of A/V software try to _guess_ whether a particular executable is a malware, and to do that, they "score" what they inspect; for instance, lack of signing of some binaries lowers the score, not being presented in some "whitelist" lowers the score and so on. What you can do is to navigate directly to the GfW's project downloads [5] (you might have noticed that the link to download the Windows binaries over there at git-scm.com actually already leads there, just to some more user-friendly web page), pick the version and make (32-bit vs 64-bit) you need, download it and then verify its checksum [6] matches that one listed at the download page. If the checksum is OK, you can be sure no software running on your machine has tampered with the downloaded installer, and then the question of whether or not the installer contains any malware is the trust in the Git-for-Windows maintainers and the integrity of the GfW's Github project. > In parallel something wanted to change my hosts-entries. > > Ist that normal? I would say it's not normal but as usually, coinsidence of this activity with an attempt to install GfW might not indicate any connection between the two - other than temporal. Of course, this only stands if you have no malware running on your host which patches the downloaded files on-the-fly. Still, if you're not sure about this one, please ask on the dedicated GfW mailing list [7]. 1. https://github.com/git-for-windows/git/issues?q=is%3Aissue+in%3Atitle+virus 2. https://github.com/git-for-windows/git/issues?q=is%3Aissue+in%3Atitle+malware 3. https://groups.google.com/g/git-for-windows/search?q=malware 4. https://groups.google.com/g/git-for-windows/search?q=virus 5. https://github.com/git-for-windows/git/releases/ 6. https://www.google.com/search?q=windows+calculate+hash+of+file 7. https://groups.google.com/g/git-for-windows/ ```