By Alboyto on

Ever since I've downloaded around 20 modules, my anti-virus software has been detecting and deleting trojan viruses. Is it possible there could be viruses in some modules?

⋅ Categories: Drupal 5.x

Comments

thepanz’s picture

thepanz commented

Modules are piece of PHP code.. and they can't contain any kind of virus!

-thePanz-

-thePanz-

vm’s picture

vm commented

One of the funniest things I've read asked on Drupal.org though. : )

Alboyto’s picture

Alboyto commented

Hardee har har! Guess everyone with a computer knows that but me. Right...

You don't know 'til you learn. I don't see why that's funny. It's not common sense or anything. But thanks for the replies, smart alecs.

My anti-virus software said trojan viruses were coming from zip files. The only zip files I've downloaded lately were Drupal modules.

Gurpartap Singh’s picture

Gurpartap Singh commented

It can be quite possible that an existing trojan on your pc could be affecting some of your downloads (maybe targeted by some criteria?). You should attempt a full scan of your computer.

Alboyto’s picture

Alboyto commented

Thanks for the reply. I think I got all the Trojans with my last scan.

RobinJ’s picture

RobinJ commented

It could be due to some modules having the same checksum values as a known virus. I have had that problem before.

Alboyto’s picture

Alboyto commented

That would make some sense then. Thanks.

johnhanley’s picture

johnhanley commented

It's certainly possible that a zip archive could contain some sort of virus, but your original question asked specifically about module files and they, as another poster already stated, are essentially text files which are not executable.

Alboyto’s picture

Alboyto commented

Thanks Bacteria.

To tell you the truth I didn't know all the files in modules are PHP code. I guess that's pretty obvious though.

"funny in a geeky sort of way"

Yeah, I was thinking the same thing. If something like my stupid question makes you laugh out loud, it makes me really wonder.

vm’s picture

vm commented

Drupal modules are not .zip. they are .tar.gz

johnhanley’s picture

johnhanley commented

Thanks for the clarification.

vm’s picture

vm commented

The comment was for the OP, not you.

If his/her virus software was complaining specifically about .zip files, then it has nothing to do with .tar.gz files. Unless of course the OP meant that his/her virus software was complaing about archives, which would obviously cover .tar.gz .rar .zip so on so forth.

AndrewJarvis’s picture

AndrewJarvis commented

My AVG virus scanner just now found what it is calling a Trojan Horse JS/Uniz.B in the javascript files ie7-standard-p.js and ie7-core.js in the module phpfreechat. Now, I think technically it's not the PHPFreeChat module itself, but the PHPFreeChat script that the module is made to interface with, but I think that's kind of splitting hairs--it's in the contributed module directory.

johnhanley’s picture

johnhanley commented

I suspect that the virus protection algorithms are identifying certain suspicious patterns and red-flagging them. It's not an exact science.

I personally don't use ANY virus protection software on my system (including what's built into WinXP.) I like to preserve every cycle possible (even though my CPU is an AMD FX-60.) I've never had a single problem because I'm extremely careful (if not paranoid) about what gets installed and/or opened on my system.

AndrewJarvis’s picture

AndrewJarvis commented

Wow, I've never heard of Virus software having false positives. Not to say I doubt you though, I just never heard of it.

johnhanley’s picture

johnhanley commented

I don't know squat about anti-virus software and I don't use it at home. However, I worked on contract at HP for a couple of years and they (understandably) have everything locked down tight (which is why my notebook computer would take forever to boot!) The anti-virus software they used (one of the mainstream products) would occasionally complain about this or that and quite often it would turn out to be nothing. It was just doing its job--looking for suspect files and stuff in memory.

sepeck’s picture

sepeck commented

Depending on the vendor's scanning engine, definition file, whether it is using heuristic algorithms, it can certainly pick up false positives. js files often fall into this category due to phishing, spyware, web site exploits etc.

Symantec recently had an issue where if you were using a Chinese localized version of Windows XP and had a specific patch installed, it would falsely identify 2 important boot files as viruses and delete them.

http://news.com.com/Flawed+Symantec+update+cripples+Chinese+PCs/2100-100...

There are a lot of bad people out there in the world and they have imagination to make things that destroy.

-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide -|- Black Mountain

-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide

AndrewJarvis’s picture

AndrewJarvis commented

Thanks for the info guys... guess I don't have to delete my module files! haha