Virus Detected on Python 2.7.12 file download

[Othric]

I downloaded Python from this URL https://www.python.org/ftp/python/2.7.12/python-2.7.12.msi. After downloading I ran it through virustotal.com to ensure there were no viruses before I ran the install on our company server. The scan came back with a problem. It detected Win32.Trojan.WisdomEyes.16070401.9500.9621.

[tritium21]

Take that with a grain of salt. One of the tools that virustotal uses has been reporting most things as containing WisdomEyes.

[berkerpeksag]

Thank you for the report. We get similar reports on a regular basis, but almost all the time they were false-positives. See http://bugs.python.org/issue30944 for a similar case for BitDefender. Quoting our Windows expert Steve Dower from the issue I linked above:

The best response is to notify Bitdefender so they can fix their signatures.

Python is commonly used in malware, and so some parts of it are often misidentified as unique to some detected virus. By reporting the name of the virus and providing the actual file to Bitdefender, they can fix their signatures and provide an update.

Most AV companies provide a specific email address for false positives. Feel free to email them, or provide enough information here (including their email address) and someone else can forward it.

[Source]

So I think the next step is to inform virustotal.com that Python's installation files are safe.

[jgfet]

Well, I've analysed a lot of the downloads of the Python 2 branch. The most recent version that gets a clean bill of health is 2.6 (not 2.6.1 on). Everything after than has one or bit of malicious malware on it. Always the same Win32.Trojan.WisdomEyes.16070401.9500.9621, but occasionally something else as well. Hope that helps find the cause.

[tritium21]

The files are safe - its a false positive. There is nothing python-dev can do to fix it except send the installers to the av companies, and tell them its a false positive.