primalscript virus?

This forum can be browsed by the general public. Posting is limited to current SAPIEN license holders with active maintenance and does not offer a response time guarantee.
Forum rules
DO NOT POST SUBSCRIPTION NUMBERS, LICENSE KEYS OR ANY OTHER LICENSING INFORMATION IN THIS FORUM.
Only the original author and our tech personnel can reply to a topic that is created in this forum. If you find a topic that relates to an issue you are having, please create a new topic and reference the other in your post.

Any code longer than three lines should be added as code using the 'Select Code' dropdown menu or attached as a file.
User avatar
Lembasts
Posts: 217
Joined: Thu Mar 15, 2012 9:47 am

primalscript virus?

Post by Lembasts » Sat Aug 25, 2012 5:31 pm

I just downloaded the latest version of primalscript and had errors during the install. My antivirus program has reported two files as being infected:
Poshexehostwin.exe and poshexehostforms.exe

Cheers

David

User avatar
Alexander Riedel
Posts: 7107
Joined: Tue May 29, 2007 4:43 pm

primalscript virus?

Post by Alexander Riedel » Sat Aug 25, 2012 5:38 pm

Our software gets virus scanned before it goes out so most likely just a false positive.It would help to know what errors you got during the install and what virus scanner reported what virus.
Alexander Riedel
SAPIEN Technologies, Inc.

User avatar
Lembasts
Posts: 217
Joined: Thu Mar 15, 2012 9:47 am

primalscript virus?

Post by Lembasts » Sat Aug 25, 2012 6:36 pm

The install had two error messages saying it could not find the two files I mentioned. The antivirus software reported the virus as Gen:Variant.Barys.894
The two files were buried within my user profile, appdata,psintall etc folder..

User avatar
Alexander Riedel
Posts: 7107
Joined: Tue May 29, 2007 4:43 pm

primalscript virus?

Post by Alexander Riedel » Sat Aug 25, 2012 7:38 pm

I assume your antivirus software prevented the files from being used during the install, hence the error message. I did a check on these files and found nothing affecting them.Since you don't mention what antivirus software you use I can't really check your results. I would recommend to double check with some other software and submit the files to your antivirus software vendor for verification.
Alexander Riedel
SAPIEN Technologies, Inc.

User avatar
Kenneth
Posts: 19
Joined: Sun Feb 26, 2012 9:30 pm

primalscript virus?

Post by Kenneth » Thu Sep 06, 2012 7:16 pm

I have the exact same issue when installing Powershell Atudio file version 3.0.8.0.

I use f-secure as antivirus provider. The installation went, but the daily scanning caught some files. See attachment

Attached files

User avatar
Alexander Riedel
Posts: 7107
Joined: Tue May 29, 2007 4:43 pm

primalscript virus?

Post by Alexander Riedel » Thu Sep 06, 2012 8:20 pm

I can only recommend to double check your scan with another tool.
To be on the safe side you should absolutely submit your local files to your antivirus vendor for verification.
Alexander Riedel
SAPIEN Technologies, Inc.

User avatar
pisboi
Posts: 1
Joined: Sun Mar 03, 2013 12:41 pm

primalscript virus?

Post by pisboi » Tue Nov 20, 2012 2:04 am

Same problem here with F-Secure Client Security 9.

It doesn't seem to like the following files (it quarantines/deletes them, and I get errors during installation):

PoshExeHostForms.exe
PoshExeHostFormsV3.exe
PoshExeHostWin.exe
PoshExeHostV3.exe

The Exe's are from PrimalScript2012.exe downloaded today, but I have had the same problem with previous versions of PrimalScript.

In the future, could the author consider reporting them as false positives to F-Secure?
https://analysis.f-secure.com/portal/login.html

User avatar
natas_dk
Posts: 1
Joined: Sun Mar 03, 2013 12:44 pm

primalscript virus?

Post by natas_dk » Thu Jan 03, 2013 6:56 pm

Scan type: Auto-Protect Scan
Event: Risk Found!
Security risk detected: Trojan.Gen.2
File: "C:Program FilesSAPIEN Technologies, IncPrimalScript 2012ScriptEnginesPoshExeHostForms.exe"
Location: C:Program FilesSAPIEN Technologies, IncPrimalScript 2012ScriptEngines
User: SYSTEM
Action taken: Pending Side Effects Analysis : Access denied
Date found: 4. januar 2013 08:52:58

from Symantec Endpoint Protection..

User avatar
uphtgk
Posts: 5
Joined: Sun Mar 03, 2013 12:44 pm

primalscript virus?

Post by uphtgk » Fri Jan 04, 2013 3:35 am

Scan type: Auto-Protect Scan
Event: Risk Found!
Security risk detected: Trojan.Gen.2
File: C:Program Files (x86)SAPIEN Technologies, IncPowerShell Studio 2012ScriptEnginesPoshExeHostForms.exe
Location: C:Program Files (x86)SAPIEN Technologies, IncPowerShell Studio 2012ScriptEngines
Computer: Mycomputer
User: xxxxxx
Action taken: Pending Side Effects Analysis : Access denied
Date found: Friday, January 04, 2013 10:34:18 AM

User avatar
robwm1
Posts: 90
Joined: Wed May 07, 2008 6:46 am

primalscript virus?

Post by robwm1 » Fri Jan 04, 2013 4:31 am

I am having the same problem once I execute version 6.5.138. Symantec detected two viruses. Our security group is not going to allow me to install this version and besides, a few files automatically get quarantined so I don't expect it could install properly anyway.

Is there any estimate on producing a new executable that is virus free? Maybe the tech that packaged it has an infected computer.

I have never had this problem and I have used Primal Script for almost 5 years now. We have always used Symantec Endpoint Protection in our organization and I haven't had this problem before so I firmly believe that this is not a false positive. Nothing has changed on our end since I have been using this product...

No virus was detected on the downloaded executable. The virus detection only occurs when you launch the executable so there are files inside of the archive that are infected. I generally upgrade with every new update released.