Bloodhound.Exploit.49 trojan found in MIMEBase.pyc

[Alex Hunsley]

Symantec antivirus has apparently picked up a virus in my Python 2.4
(under cygwin):

Scan type: Scheduled Scan
Event: Threat Found!
Threat: Bloodhound.Exploit.49
File: C:\cygwin\lib\python2.4\email\MIMEBase.pyc
Location: Quarantine
Action taken: Quarantine succeeded


There's info to be found on various pages, but it's a pretty terse
explanation:
http://secunia.com/virus_information/22534/bloodhound.exploit.49/

Has anyone had this also? Is it perhaps a false positive?
alex

 

[Fredrik Lundh]

Symantec antivirus has apparently picked up a virus in my Python 2.4
(under cygwin):

Scan type: Scheduled Scan
Event: Threat Found!
Threat: Bloodhound.Exploit.49
File: C:\cygwin\lib\python2.4\email\MIMEBase.pyc
Location: Quarantine
Action taken: Quarantine succeeded

There's info to be found on various pages, but it's a pretty terse
explanation:
http://secunia.com/virus_information/22534/bloodhound.exploit.49/

Has anyone had this also? Is it perhaps a false positive?

if Python had anything to do with this, they would probably have mentioned it
in the related documents:

http://www.sarc.com/avcenter/venc/data/bloodhound.exploit.49.html
http://www.microsoft.com/technet/security/bulletin/MS05-048.mspx

</F>

 

[jepler]

It's almost certainly a false positive. In my day job we run into false
positive antivirus detections like this once or twice a year, and
typically get a runaround from the AV vendor (who often have the gall to
suggest that we should buy a copy of their broken software before
they'll fix their problems)

Jeff

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDVPPAJd01MZaTXX0RAlWNAJ94IDzI9frXW4/pts+OXyCpM5NLVACfTRTx
elikrDx9qLvlOJGnJSg5R5c=
=H27b
-----END PGP SIGNATURE-----