[texworks] message from TeXworks user

[Reinhard Kotucha]

On 3 March 2010 Jens Heber wrote:

 > Dear TeXworks team,
 > 
 > I would like to ask for your advice concerning the following
 > security issue.
 > 
 > Yesterday I installed TeXLive 2009 for Windows XP via internet
 > (using install-tl.zip from
 > http://www.tug.org/texlive/acquire-netinstall.html) and thus came
 > into contact with TeXworks for the first time.
 > 
 > Unfortunately, my "Sophos" antivirus software claims that three
 > files are virus/spyware of a category called "Mal/Dorf-I" (cf.
 > http://www.sophos.com/security/analyses/viruses-and-spyware/maldorfi.html).
 > The "suspicious" MS DOS-exe-files have been put under quarantine by
 > Sophos.
 > 
 > These files appear to be last modified on 2010/02/28. Are these
 > original TeXworks files? (I include their MD5-hash code, see
 > below).

This is not a TeXworks issue, a better place to ask is the TeX Live
mailing list.

All these files come from TeX Live.  These files are wrappers needed
by TeX Live, not the programs themselves.  The purpose of them is to
launch programs in a modified environment.  PSV, for instance, needs
Ghostscript and the wrapper makes the hidden Ghostscript provided by
TeX Live visible to PSV.  TeXworks has to be told where the files it
needs are located in TeX Live.

These wrappers were updated 2010/02/28 in the TeX Live Subversion
repository indeed.
 
 > texlive\2009\bin\win32
 >      \dviout.exe   (MD5-hash d132caed244851b1a944221921611235)
 >      \psv.exe      (MD5-hash 4ea3886315f590856e6d921c54aca0f2)
 >      \texworks.exe (MD5-hash e9c1687a5375f6ad5b5e76172c46bf37)

Thanks for providing them.  I can confirm that they are identically
equal to those calculated from the files in the repository.

Someone else reported the same problem today on the TeX Live mailing
list and Tomek, the author of the wrappers, recommended to report this
problem to Sophos and ask them to fix the scanner. 

I recommend you to report the problem too, I don't know whether the
other person did.

Regards,
  Reinhard

-- 
----------------------------------------------------------------------------
Reinhard Kotucha			              Phone: +49-511-3373112
Marschnerstr. 25
D-30167 Hannover	                      mailto:reinhard.kotucha at web.de
----------------------------------------------------------------------------
Microsoft isn't the answer. Microsoft is the question, and the answer is NO.
----------------------------------------------------------------------------