What is the malware associated with pywin32

Question

I tried to download the pywin32 package off github and am unable to as my antivirus software keeps deleting it (Message is- Security risk detected: Heur.AdvML.C). It is the same complaint that was outlined in this thread:

pywin32-220 installer "high risk" file

I have been using an the pywin32 package of python 2.7 for years but am switching to ArcPro and need to upgrade my scripts to the python 3.6 version. I need to have this to run my scripts and was hoping someone could tell me what the virus captures so we can weigh whether it is ok to download. With all the recommendations to download this, I would think someone out there would have knowledge of what the risk was.

I tried to download it from the official website:

https://github.com/mhammond/pywin32/releases

Any ideas how I can get a clean version?

Many thanks

Answer 1

Antivirus software is prone to false positives (this is a fundamental problem), so it's useful to see the big picture.

These are VirusTotal scans for all the binary downloads for the current https://github.com/mhammond/pywin32/releases/tag/b223 as of now:

• pywin32-223.win-amd64-py2.7.exe (URL)
• pywin32-223.win-amd64-py3.5.exe (URL 1)
• pywin32-223.win-amd64-py3.6.exe (URL)

• pywin32-223.win-amd64-py3.7.exe (URL)

• pywin32-223.win32-py2.7.exe (URL)

• pywin32-223.win32-py3.5.exe (URL)
• pywin32-223.win32-py3.6.exe (URL 1)
• pywin32-223.win32-py3.7.exe (URL)

As you can see, download URLs are checked separately, there are no positives for files but there are some select ones for URLs. Since the files are okay, these must be false positives.