Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Malware detected - can't download to sensitive corporate network #293

Closed
pcuci opened this issue Jul 2, 2019 · 1 comment
Closed

Malware detected - can't download to sensitive corporate network #293

pcuci opened this issue Jul 2, 2019 · 1 comment

Comments

@pcuci
Copy link

pcuci commented Jul 2, 2019

Virus Name: BehavesLike.Win32.Backdoor.tcMcAfee Threat Center (99%)

This is new... worked last month, I was able to download the windows installer. Can't upgrade the to the newer AW.

If I remember correctly, McAfee (and other anti-virus firms) use a centralized CVE reporting mechanism (don't recall the website name), it might be worth submitting the aw code for review so they blanket white list it.

McAfee Web Gateway
Malware Found
The transferred file is suspected of containing malware and has been blocked.
User: BypassAuthentication-Site-NCSA-url (10.128.69.64)
URL: https://github-production-release-asset-2e65be.s3.amazonaws.com/57224308/9717bc00-4276-11e9-8bf8-44ffc21fb0dc?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190702%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190702T162040Z&X-Amz-Expires=300&X-Amz-Signature=e6c6fa86b66910b4b26b6fb607e947976ffe1e9da55da44fa3d654d14f01f9e6&X-Amz-SignedHeaders=host&actor_id=2169849&response-content-disposition=attachment%3B%20filename%3Dactivitywatch-v0.8.0b8-windows-x86_64.zip&response-content-type=application%2Foctet-stream (52.216.88.155)
URL Categories: Internet Services
Reputation: Minimal Risk (1) Minimal Risk
Application: Amazon S3 (Minimal Risk)
File Name: activitywatch-v0.8.0b8-windows-x86_64.zip|activitywatch/aw-qt.exe
Ensured Types: application/executable
Virus Name: BehavesLike.Win32.Backdoor.tcMcAfee Threat Center (99%)
MD5: dc364351800f4a0526048c4da5b658a9

Open SOS request Open SOS request (Internet Access > Request access to a website).
Sample Internet Usage Policy
This Sample Internet Usage Policy applies to all employees of Ubisoft; who have access to computers and the Internet to be used in the performance of their work. Use of the Internet by employees of Ubisoft; is permitted and encouraged where such use supports the goals and objectives of the business. However, access to the Internet through Ubisoft; is a privilege and all employees must adhere to the policies concerning Computer, Email and Internet usage. Violation of these policies could result in disciplinary and/or legal action leading up to and including termination of employment. Employees may also be held personally liable for damages caused by any violations of this policy. All employees are required to acknowledge receipt and confirm that they have understood and agree to abide by the rules hereunder on a periodic basis.
For assistance, please contact your helpdesk.
generated 2019-07-02 16:20:41 by msr-net-mwg04 (10.129.10.234:3128)
RuleSet: Gateway Anti-Malware
Rule: Anti-Malware: Block Infected(Gateway Anti-Malware)
Client IP: 10.128.69.64
Username: BypassAuthentication-Site-NCSA-url

@ErikBjare
Copy link
Member

Thanks for reporting (and including the output).

This is a duplicate of #181 however, so I'm closing it and refer to the discussion there for the (slow) progress on the issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants