Saxon

We have checked the file and we do not believe there is anything wrong with it.

It is true that SourceForge acquired a bad reputation a couple of years ago for adding unwanted (but generally harmless) software to open source downloads. I understand that they have since ceased this practice unless the software owner positively opts into it in order to get revenue - which we have not done.

It is also true that the site is cluttered with advertisements for unrelated products that can easily mislead you into downloading the wrong thing, and this practice has damaged its reputation.

We have tested the .NET install script that you link to in your message and we believe it is clean and does not contain malware. If you believe otherwise, please be more precise about exactly what you did and what happened to make you think there was malware.

The behaviour you describe "The newer version of the HE version of Saxon was detected as soon as installation started, but the older version was detected once I attempted to run a Query." doesn't seem related to malware, but rather suggests some configuration problem in your installation. Again, please try to tell us more precisely what happened.

We are reluctant to move away from SourceForge because it's useful to maintain continuity; we cannot remove the many software releases that are currently on the site, and it would cause confusion if the newest releases were not available there. We also now distribute via Maven. For commercial versions of the software, of course, we use www.saxonica.com.

I'll send screen a screen shot, it is a hidden file that webroot detects.

From: Saxonica Developer Community notifications@plan.io

Sent: Tuesday, June 13, 2017 7:34:39 AM

Subject: [Saxon - Bug #3267] Malware in Sourceforge download file

Thanks for the screen shots. Webroot seems to have a lot of problems with false positives (i.e. detecting malware where none exists). We'll see if we can get them to look at it and either fix their detection or tell us what we need to do to avoid the false alarm.

Sourceforge did say that they would stop, but they said that before these were written. So I hope you're right about webroot being the problem. This is the first time that webroot has done this for software that I need. I'll let you know when it works.

http://seclists.org/nmap-dev/2015/q2/194

Sourceforge Hijacks the Nmap Sourceforge Accounthttp://seclists.org/nmap-dev/2015/q2/194

seclists.org

Hi Folks! You may have already read the recent news about Sourceforge.net hijacking the GIMP project account to distribute adware/malware. Previously GIMP used this ...

https://arstechnica.com/information-technology/2015/06/black-mirror-sourceforge-has-now-siezed-nmap-audit-tool-project/

[https://cdn.arstechnica.net/wp-content/uploads/2015/06/nmapgrab-640x465.jpg]https://arstechnica.com/information-technology/2015/06/black-mirror-sourceforge-has-now-siezed-nmap-audit-tool-project/

Black “mirror”: SourceForge has now taken over Nmap audit ...https://arstechnica.com/information-technology/2015/06/black-mirror-sourceforge-has-now-siezed-nmap-audit-tool-project/

arstechnica.com

What's yours is mine dept. — Black “mirror”: SourceForge has now taken over Nmap audit tool project [Updated] VLC developer also surprised to find project taken ...

https://blog.l0cal.com/2015/06/02/what-happened-to-sourceforge/

[https://s.gravatar.com/avatar/726d58202f463ab45f27de07733b7a33?s=128]https://blog.l0cal.com/2015/06/02/what-happened-to-sourceforge/

What happened to Sourceforge? · etix's weblog - l0cal.comhttps://blog.l0cal.com/2015/06/02/what-happened-to-sourceforge/

blog.l0cal.com

What happened to Sourceforge? Tue, Jun 2, 2015. Disclaimer: I’m a VLC developer, member of the board of VideoLAN and managing the infrastructure behind the ...

From: Saxonica Developer Community notifications@plan.io

Sent: Tuesday, June 13, 2017 10:19:58 AM

Subject: [Saxon - Bug #3267] Malware in Sourceforge download file

Thanks, we are well aware of widespread dissatisfaction with the commercialization of SourceForge, but that's nothing to do with the issue here. The report from Webroot here is a false positive on scanning our software for viruses, and would have happened whatever platform we used for distribution. Sourceforge are distributing the binary that we uploaded.

I've got to admit, you're good lol I didn't expect webroot to respond so quickly to you. It works now, with no malware notification. Thank you.

From: Saxonica Developer Community notifications@plan.io

Sent: Tuesday, June 13, 2017 12:11 PM

Subject: [Saxon - Bug #3267] Webroot claims that there is malware (W32.Malware.Gen) in Sourceforge .NET download file