Antivirus and ArcaOS

[Ramon Perez]

Hello everyone:

Every time I try to access the ARCAOS yum repository, the host Windows antivirus, Bitdefender, warns me:

"https://www.2rosenthals.com/
Accessed by: VirtualBoxVM.exe
Dangerous pages try to install software that can harm your device, collect personal information, or act without your consent."

Isn't that Lewis Rosenthal's page?

Also when I try to download or access the page of the creator of Filestar2, file manager recommended in the OS/2 Wiki:

"A malware-type threat was found at http://jaread.net/downloads/filestar/fs_30500.zip"
or
"A malware-type threat was found at http://jaread.net/software/pages/filestar.html
We have blocked this dangerous page to protect you."

They block me and won't let me download it.

Although they may be false alarms, I don't know.
There is talk about the absence of viruses in OS/2, it´s probably true, but I think that the reputation on the network should be improved.

For your informartion.

Greetings to all.

[Remy]

If you have doubt about a file, use https://www.virustotal.com/gui/home/url and test your suspected links or files.
It goes through many virus tools.

I just tried the fs_30500.zip link and all is ok !


About https://www.2rosenthals.com/
Only BitDefender and G-data found a malware where 88 other tools found nothing !

[Martin Iturbide]

Hi Ramon

I run VirtualBox as a host on Windows 10 and ArcaOS as a guest and I never got those messages from the Antivirus (ESSET and Windows included AV) when ArcaOS is trying to access a webpage or the RPM repo.

But there are a lot of false positives in Windows with OS/2 files. Some AV reports OS/2 files as virus, even just .cmd script files.

Regards

[Ramon Perez]

Thank you for your answers.
The OS2 community has always seemed to me to be made up of serious people, hence my doubts.
Bitdefender is my paid antivirus, purchased because of good references and I should trust it, but nothing is perfect.
The answers were enough to stop worrying.
Regards.

[Lewis Rosenthal]

Sometimes I wonder how these "domain reputation" scores actually work. Sometimes, it seems that any domain which hosts downloadable files is automatically classified as some level of risk. It's very odd that Bitdefender seems to consider our domain suspect. Of course, you can remove our YUM mirror from your netlabs-rel.repo file (and/or netlabs-exp).

Unfortunately, you can't really do that with any of the Arca Noae repo files, as Arca Noae currently has no other mirrors, but a lookup of repos.arcanoae.com will come back to one of our registered IP addresses (but not the same address as www.2rosenthals.com).

IAC, Ramon, I can assure you that the Netlabs YUM mirror hosted at 2rosenthals.com is clean. We sync every 12 hours with netlabs.org, and the web space is not world-writeable, so it should be free of any extraneous files. The YUM metadata would have to be built on the server if any files were changed or added, and we don't do that. Instead, we sync the entire Netlabs repo content, including the metadata (faster and less CPU-intensive than rebuilding it locally). Thus, only the files which would be accessible from the master copies of the Netlabs repos should be available from our mirrors.

[Ramon Perez]

Thanks Lewis,
Unlike other websites, which blocked my access, in the case of 2rosenthals.com, they warned me (as you can see), but they let me download the files, in fact I have everything updated in ArcaOS.
Really from the beginning I thought it had to be a false alarm, but I think I did well to report it, in case it happens to anyone else and give the opportunity to clarify it
Greetings.

[Lewis Rosenthal]

Absolutely, Ramon.

As a server admin, I often need to rely on reports from others as to whether we've ended up on some wacky blacklist or some such. Sometimes, a mail account we host may be compromised, and as we allow authenticated relay, the server will start relaying junk. I might not be aware of the problem until I go looking for something else, and then find that the log file has grown to gigantic proportions. So, I'd much prefer if people would speak up when they get odd-sounding results, so I can look into things more fully.

So, thanks for saying something. I'm relieved to see that it was (and likely still is) just a false alarm, and we don't appear to be on any (other) widely available reputation blacklists. Glad, too, that you were able to fetch your updates.

Cheers