ClamAv reports a malware in /usr/local/bin/pnscan

[bpuppy]

As the title says, Clam Antivirus (32 bit version) reports:
/usr/local/bin/pnscan: Unix.Malware.Agent-7186126-0 FOUND.

It was reported on PuppyTahr v.6.0.5 (32-bit).
This may only be a false positive, but it would be interresting to investigate further...

Can anyone else check this on either the 32/64 bit versions?

bpuppy

[fabrice_035]

Hi,
From BionicPup64

Code: Select all

root# pnscan -V [PNScan, version 1.11 - Dec 11 2016 14:53:52]

Compil today from https://github.com/ptrrkssn/pnscan

Code: Select all

root# ./pnscan -V
[PNScan, version 1.13 - Jun  8 2020 16:41:13]

???

[6502coder]

There's an apparently related thread on LinuxQuestions.org:
https://www.linuxquestions.org/question ... 175630929/

[perdido]

Out of curiosity I downloaded 4 versions of tahr from the ibiblio repository
http://distro.ibiblio.org/puppylinux/puppy-tahr/iso/

This is what clam says

tahr64-6.0.5.iso - /usr/local/bin/pnscan: Unix.Malware.Agent-6327832-0 FOUND
tahr-6.0.5_PAE.iso - /usr/local/bin/pnscan: Unix.Malware.Agent-7186126-0 FOUND
-------------------
Nothing found in either tahr 6.0.6 version
tahr-6.0.6-uefi.iso was clean
tahr64-6.0.6-uefi.iso was clean
###############################################
I also scanned the latest bionicpups 64-bit & 32-bit

bionicpup64-8.0-uefi.iso - /usr/local/bin/pnscan: Unix.Malware.Agent-7186126-0 FOUND
-------------------
bionicpup32-8.0-uefi.iso was clean.

This could be false positives but who knows? I sure don't.
This post is for informational purposes only. You make your own determinations.

Have fun!

[rcrsn51]

The latest versions of PeasyPort have eliminated pnscan in favour of a different scanning tool.

[Smithy]

/usr/sbin/mpscan
/usr/bin/pscan
/usr/bin/ipsort
/usr/bin/pnscan
root/packages/builtin_files/pnscan
root/packages/builtin_files/file_sharing-curlftpfs-mpscan

Tried a ClamwinScan as an alternative, Didn't find anything suspect in Artfulpup. I am guessing it will be the same in Tahrpup and Bionic.

that pscan file is a symbolic link to busybox, 703kb or 17bytes depending on where you look.

[666philb]

hi,
this was also mentioned on the bionicpup64 thread.

i think the 32bit pnscan in /usr/local/bin got into the distro by woofce grabbing the wrong peasyport.pet which includes pnscan.

interestingly the 64bit pnscan (which is the official ubuntu version) in /usr/bin is also detected as malware when uploaded to virustotal, although clamav misses it.

it seems that it can be used as a hacktool and is not malware in itself. see this post at pnscans github page https://github.com/ptrrkssn/pnscan/issues/2

[bpuppy]

This is indeed interesting.
Being so controversial, I wonder whether new Puppy derivatives should include it in their next versions...

[rcrsn51]

I have PeasyPort v3.1 in PET form which removes pnscan. If anyone wants to participate in testing, I will post it.