R help - Jun 2018 - malware reported by antivirus on R Windows .exe file

Dear R-list members,

This is just to make a report: Today, 04 June 2018, I attempted to 
download R-3.5.0 Patched build for Windows (a .exe file) from the 
Austria CRAN https site. My antivirus software, AVG Internet Security 
with all the latest updates, aborted the connection, saying that some 
malware was found - please see the attached Figure 1.

I went then to the CRAN mirror at Oswaldo Cruz Foundation, Rio de 
Janeiro, Brazil, and was able to download the .exe file. I immediately 
asked the AVG software to scan the file; it found something suspicious 
and sent the file for analysis in their labs. Some hours later, AVG said 
that the file was malicious, and sent it to quarantine; I am not able to 
figure out which kind of malware was supposed to exist in the file - 
please see the attached Figure 2.

Yesterday I was also not able to download the .exe file from the Austria 
CRAN site, for the same reason.

I am not able to evaluate the technical corretness of AVG's decisions. I 
am only reporting what happened.

Paulo Barata

(Rio de Janeiro - Brazil)


-------------- next part --------------
A non-text attachment was scrubbed...
Name: Fig-1-Link-from-CRAN-Austria-for-R-3.5.0-patched-0n-04-June-2018.png
Type: image/png
Size: 87899 bytes
Desc: not available
URL:
<https://stat.ethz.ch/pipermail/r-help/attachments/20180604/29a72f2a/attachment.png>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: Fig-2-R-3.5.0-patched-from-Fiocruz-Brazil-site-on-04-June-2018.png
Type: image/png
Size: 25795 bytes
Desc: not available
URL:
<https://stat.ethz.ch/pipermail/r-help/attachments/20180604/29a72f2a/attachment-0001.png>

These are almost always false positives. The checks are based on checksumming
and sometimes a perfectly innocent .exe will match the checksum of some
virus/malware. The .exe is rebuilt nightly and changes slightly between builds,
so you may want just retry after a day or so.

(The AV vendors are behaving pretty irresponsibly in these matters, but as long
as it only hits a patch build, I don't think anyone cares enough to take
action.)

-pd
> On 5 Jun 2018, at 00:03 , Paulo Barata <pb at infolink.com.br> wrote:
> 
> Dear R-list members,
> 
> This is just to make a report: Today, 04 June 2018, I attempted to download
R-3.5.0 Patched build for Windows (a .exe file) from the Austria CRAN https
site. My antivirus software, AVG Internet Security with all the latest updates,
aborted the connection, saying that some malware was found - please see the
attached Figure 1.
> 
> I went then to the CRAN mirror at Oswaldo Cruz Foundation, Rio de Janeiro,
Brazil, and was able to download the .exe file. I immediately asked the AVG
software to scan the file; it found something suspicious and sent the file for
analysis in their labs. Some hours later, AVG said that the file was malicious,
and sent it to quarantine; I am not able to figure out which kind of malware was
supposed to exist in the file - please see the attached Figure 2.
> 
> Yesterday I was also not able to download the .exe file from the Austria
CRAN site, for the same reason.
> 
> I am not able to evaluate the technical corretness of AVG's decisions.
I am only reporting what happened.
> 
> Paulo Barata
> 
> (Rio de Janeiro - Brazil)
> 
>
<Fig-1-Link-from-CRAN-Austria-for-R-3.5.0-patched-0n-04-June-2018.png><Fig-2-R-3.5.0-patched-from-Fiocruz-Brazil-site-on-04-June-2018.png>______________________________________________
> R-help at r-project.org mailing list -- To UNSUBSCRIBE and more, see
> https://stat.ethz.ch/mailman/listinfo/r-help
> PLEASE do read the posting guide
http://www.R-project.org/posting-guide.html
> and provide commented, minimal, self-contained, reproducible code.
-- 
Peter Dalgaard, Professor,
Center for Statistics, Copenhagen Business School
Solbjerg Plads 3, 2000 Frederiksberg, Denmark
Phone: (+45)38153501
Office: A 4.23
Email: pd.mes at cbs.dk  Priv: PDalgd at gmail.com