eBook authors eBook Software - create and publish your own ebooks
Create your own eBooks
 
   
EBookApprentice.com
Learn How To Create, Publish & Market E-Books
 
   
EBookCompiler.com
E-Book Creation Software
 
   
EBookPower.com
Add sophisticated multimedia to your E-Books
 
   
CoverFactory.com
Create E-Book covers in minutes
 
 
  EBookSubmit.com
E-Book Marketing & Promotion made easy
 
  EBookJungle.com
Search engine for E-Books
 
  EBookInterviews.com
Interviews with eBook authors
 
  EBookEnhance.com
Tools for building better eBooks
 
 
 
Archived Message:

Trojan in active e-book - EVIEW.DAT


 
brainsci Some antivirus softwares are now seeing a Trojan where none existed before.  Some firewalls are also having this trouble.  It seems as though the criteria for distinguishing a Trojan has changed recently and some of the files in active e-book are now being labeled as having Trojans (PSW-win32.alert.kma).

I was careful about my tests.  First, I installed one of the antivirus programs (the other software that I know about which has been getting similar messages is zone alarm Pro), on a freshly installed and formatted Windows Vista machine.  The antivirus software that I used was Kaspersky.  There are others.

Then I began create e-books on one machine and move them over to the other on a flash drive.

Each time I would try to copy an e-book to the fist a machine that had Kaspersky installed on it, I would get error messages, the e-book would be deleted, and then I would start again.  At first, I thought it might be due to some of the files that I had in my e-book, but I was mistaken.  Eventually I created a new e-book, with only one file in it: the index page.

Still, even with the index page completely blank, I continued to get the message that my e-book was infected with a Trojan.

The next thing I did was to download the setup program for active e-book again, install it on the Vista machine.

The same thing happened again.  This time, however I got more specific error messages (when the antivirus program scanned the e-books, it said that it found the Trojan in a component of the e-book called "FILE01".

Kaspersky antivirus found two files that were infected with his Trojan.  One of them is EVIEW.DAT.  The other is EHELP.EXE.

When I removed these two files from my system that does NOT have Kapersky anti virus on it, and tried to compile an ebook, I got 0 kb files, which of course, are not 'valid win32 applications".

When I restored EVIEW.DAT, the ebooks were fine, but they were recognized as having the trojans - again.

The same thing happened with EHELP.EXE, but an experienced active ebook user doesn't need that.

I think that the behavior of EVIEW.DAT is close to an actual trojan, and antivirus programs and firewall programs are warning as though it were.

I hope there is a solution to this problem available.

So far, Kapersky antivrus and Zone Alarm PRO are two that I know of, but they're both important programs, and we should expect that more and more security softwares will follow suit.

Unless there's a fix, we may all have to stop using active ebook.

My testing was pretty careful, and I'm sure about where the supposed trojan was coming from.


Posted on: 8:05 am on August 12, 2008
brainsci UPDATE:

The issue was resolved when I compiled under AEB, V. 5.

Sunil, Rajkumar of programming, I hope you have a stable version 5 soon.

It compressed very well, too.  About 1/3 more than before.


Posted on: 10:38 am on August 12, 2008
brainsci Kaspersky has been updated, and no longer finds the false trojan.

Sunil wrote to them and got it done.

I still think version 5 is the best way to go, but Sunil came through for us on this one.


Posted on: 7:25 pm on August 12, 2008
EBookCompiler Updated information as requested by a user who saw this thread:

As you are probably aware many makers of anti-virus and anti-spyware products use heuristics (rules) and signatures (specific sequences of data) to look for viruses and spyware.  They do this because it is impractical to look for an entire virus/spyware because of time or resource constraints.

Unfortunately from time to time a situation can arise where a heuristic or signature used by a particular anti-virus or anti-spyware product happens to match a legitimate program or product - just by chance.  This is known as a "false positive", and can happen to any program or product. For more info see:
http://www.guide2spyware.com/p1_false_positives.php

The solution when this situation arises is for the maker of the anti-virus or anti-spyware product to modify their product, to use a different rule or heuristic.  The maker of the anti-virus or anti-spyware product of course needs to be informed of the problem to make the fix

The thread in question seems to refer to a situation when this arose with one of the Kaspersky anti-virus products.  As soon as I became aware of it, I contacted them, and I believe they corrected the problem within a few days.  This particular issue has been closed for almost a year.

Version 5 of Activ E-Book Compiler is currently in beta.  

The only reason that version 4.22 was affected and version 5 was just by chance.  And it could equally well, if chances had been different, been the other way round.


Posted on: 11:26 am on June 17, 2009

Go to Active Discussion Thread

Participate in Current/New Discussions

List All Archived Forums



Copyright © 2000-2015, Answers 2000 Limited.

With any business, it is up to the individual owner of said business to ensure the success of the business. You may make more or less than any sample figures or results that might be quoted on our web sites or other publications. All business involves risk, and many businesses do not succeed. Further, Answers 2000 Limited does NOT represent that any particular individual or business is typical, or that any results or experiences achieved by any particular individual/business is necessarily typical.

Disclosure: Our company's websites' content (including this website's content) includes advertisements for our own company's websites, products, and services, and for other organization's websites, products, and services. In the case of links to other organization's websites, our company may receive a payment, (1) if you purchase products or services, or (2) if you sign-up for third party offers, after following links from this website. Unless specifically otherwise stated, information about other organization's products and services, is based on information provided by that organization, the product/service vendor, and/or publicly available information - and should not be taken to mean that we have used the product/service in question. Additionally, our company's websites contain some adverts which we are paid to display, but whose content is not selected by us, such as Google AdSense ads. For more detailed information, please see Advertising/Endorsements Disclosures

Our sites use cookies, some of which may already be set on your computer. Use of our site constitutes consent for this. For details, please see Privacy.

Contact Us    About and Terms Of Use    Privacy    Advertising/Endorsements Disclosures