This project has moved. For the latest updates, please go here.

Kaspersky Alert

Apr 4, 2016 at 4:50 PM
I use the Magick.NET-x86 a long time, and now the antivirus Kaspersky is blocking the use of this DLL.
This .dll is very important for my project, and I wonder what can be done about this situation.

Antivirus used
Kaspersky Endpoint Security for Windows 10 - version 10.2.1.23

Alert
Kaspersky - Virus.Win32.Nimnul.a
Apr 4, 2016 at 5:25 PM
What version of the Magick.NET-x86 DLL are you using? I have Kaspersky and it is not flagging any version of Magick.NET.

Also, if you download and extract a fresh copy of the DLL from Codeplex, does it give you a warning? If not, then it may be that the local copy of the DLL may be infected.
Apr 4, 2016 at 5:28 PM
The threat level for Win32.Nimnul.a is "severe". May want to check your entire computer as the source of the infection may not be the DLL.

You can find more info at http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Virus%3aWin32%2fRamnit.N

(or cached version: http://cc.bingj.com/cache.aspx?q=Kaspersky+-+Virus.Win32.Nimnul.a&d=4841593599298121&mkt=en-US&setlang=en-US&w=BiouqfjHjwWZs5sowSswoCERdwy7qKJd)
Apr 4, 2016 at 8:19 PM
The version is Magick.NET-6.8.5.1001-Q16-x86-net20.

I downloaded this version again the site and unpack Kaspersky already accused as malware.

It has now been tested in Kaspersky 2016.
Coordinator
Apr 4, 2016 at 8:28 PM
Edited Apr 4, 2016 at 8:28 PM
I wanted to test this on virustotal but it looks like someone already ran this old version of Magick.NET through an online scanner. The result can be found here: https://virustotal.com/nl/file/08c2545e97c99df2e39dee661518c2826164419e3cde6d318a5dcb9e313d140b/analysis/. Only Kasparsky is reporting a problem, this feels like a false positive.
Apr 4, 2016 at 8:35 PM
Did that old version have unsafe code?
Coordinator
Apr 4, 2016 at 8:41 PM
Edited Apr 4, 2016 at 8:41 PM
It was a cli/c++ library so yes it did contain unsafe code.