Page 1 of 3

primalscript virus?

Posted: Sat Aug 25, 2012 5:31 pm
by Lembasts
I just downloaded the latest version of primalscript and had errors during the install. My antivirus program has reported two files as being infected:
Poshexehostwin.exe and poshexehostforms.exe

Cheers

David

primalscript virus?

Posted: Sat Aug 25, 2012 5:38 pm
by Alexander Riedel
Our software gets virus scanned before it goes out so most likely just a false positive.It would help to know what errors you got during the install and what virus scanner reported what virus.

primalscript virus?

Posted: Sat Aug 25, 2012 6:36 pm
by Lembasts
The install had two error messages saying it could not find the two files I mentioned. The antivirus software reported the virus as Gen:Variant.Barys.894
The two files were buried within my user profile, appdata,psintall etc folder..

primalscript virus?

Posted: Sat Aug 25, 2012 7:38 pm
by Alexander Riedel
I assume your antivirus software prevented the files from being used during the install, hence the error message. I did a check on these files and found nothing affecting them.Since you don't mention what antivirus software you use I can't really check your results. I would recommend to double check with some other software and submit the files to your antivirus software vendor for verification.

primalscript virus?

Posted: Thu Sep 06, 2012 7:16 pm
by Kenneth
I have the exact same issue when installing Powershell Atudio file version 3.0.8.0.

I use f-secure as antivirus provider. The installation went, but the daily scanning caught some files. See attachment

Attached files

primalscript virus?

Posted: Thu Sep 06, 2012 8:20 pm
by Alexander Riedel
I can only recommend to double check your scan with another tool.
To be on the safe side you should absolutely submit your local files to your antivirus vendor for verification.

primalscript virus?

Posted: Tue Nov 20, 2012 2:04 am
by pisboi
Same problem here with F-Secure Client Security 9.

It doesn't seem to like the following files (it quarantines/deletes them, and I get errors during installation):

PoshExeHostForms.exe
PoshExeHostFormsV3.exe
PoshExeHostWin.exe
PoshExeHostV3.exe

The Exe's are from PrimalScript2012.exe downloaded today, but I have had the same problem with previous versions of PrimalScript.

In the future, could the author consider reporting them as false positives to F-Secure?
https://analysis.f-secure.com/portal/login.html

primalscript virus?

Posted: Thu Jan 03, 2013 6:56 pm
by natas_dk
Scan type: Auto-Protect Scan
Event: Risk Found!
Security risk detected: Trojan.Gen.2
File: "C:Program FilesSAPIEN Technologies, IncPrimalScript 2012ScriptEnginesPoshExeHostForms.exe"
Location: C:Program FilesSAPIEN Technologies, IncPrimalScript 2012ScriptEngines
User: SYSTEM
Action taken: Pending Side Effects Analysis : Access denied
Date found: 4. januar 2013 08:52:58

from Symantec Endpoint Protection..

primalscript virus?

Posted: Fri Jan 04, 2013 3:35 am
by uphtgk
Scan type: Auto-Protect Scan
Event: Risk Found!
Security risk detected: Trojan.Gen.2
File: C:Program Files (x86)SAPIEN Technologies, IncPowerShell Studio 2012ScriptEnginesPoshExeHostForms.exe
Location: C:Program Files (x86)SAPIEN Technologies, IncPowerShell Studio 2012ScriptEngines
Computer: Mycomputer
User: xxxxxx
Action taken: Pending Side Effects Analysis : Access denied
Date found: Friday, January 04, 2013 10:34:18 AM

primalscript virus?

Posted: Fri Jan 04, 2013 4:31 am
by robwm1
I am having the same problem once I execute version 6.5.138. Symantec detected two viruses. Our security group is not going to allow me to install this version and besides, a few files automatically get quarantined so I don't expect it could install properly anyway.

Is there any estimate on producing a new executable that is virus free? Maybe the tech that packaged it has an infected computer.

I have never had this problem and I have used Primal Script for almost 5 years now. We have always used Symantec Endpoint Protection in our organization and I haven't had this problem before so I firmly believe that this is not a false positive. Nothing has changed on our end since I have been using this product...

No virus was detected on the downloaded executable. The virus detection only occurs when you launch the executable so there are files inside of the archive that are infected. I generally upgrade with every new update released.