McAfee virus scanner caught something in 'test-pdb.exe' as 'RDN/Generic.cpt' trojan

[jakehurst (Justine Akehurst)]

I was running MacPorts 'selfupdate' today to update my ports list, and my virus scanner caught something in '/opt/local/var/macports/build/test-pdb.exe' as something called a 'RDN/Generic.cpt' Trojan.

Virus scanner says it 'cleaned' the file.

[jakehurst (Justine Akehurst)]

Screenshot of the dialog that shows that McAfee caught a trojan in MacPorts base.

[jakehurst (Justine Akehurst)]

Another screenshot of McAfee, which seems to show more of an exact location of 'test-pdb.exe'

[jmroot (Joshua Root)]

That file is not part of MacPorts base. Not sure how it got into the top level of the build directory, but this seems relevant? ​http://lists.llvm.org/pipermail/cfe-users/2017-April/001131.html

[jmroot (Joshua Root)]

Oh I see, your second screenshot shows that it's not in the top level, it's in a particular port's subdirectory. Unfortunately the middle part that shows which port it belongs to has been abbreviated with an ellipsis. Can you determine the full path?

I would guess it's part of the test suite for one of the llvm ports, but let's make sure.

[jakehurst (Justine Akehurst)]

OK, googled a little deeper and found this article: ​http://lists.llvm.org/pipermail/lldb-dev/2016-November/011568.html

The source code is here:

​https://llvm.org/svn/llvm-project/lldb/branches/google/testing/unittests/SymbolFile/PDB/Inputs/test-pdb.cpp

And it definitely does nothing. Most of these AV are heuristic, it's probably suspicious about the fact that it's linked with unusual settings (ie /nodefaultlib) which we did in order to minimize the binary size (the pdb is quite large if we don't do this)

On Mon, Nov 7, 2016 at 4:03 PM Jim Ingham via lldb-dev < lldb-dev at lists.llvm.org> wrote:

Over in the Swift GitHub, somebody filed:

​https://bugs.swift.org/browse/SR-3147

with the claim that this file contains a trojan? Dunno if this is bogus or not, but it's worth somebody on the Windows side checking it out...

Jim

So, this is benign.

[jakehurst (Justine Akehurst)]

Feel free to close this ticket.