[Solved] Antivirus stops exe build but allows compile/run?

[PB]

Per the subject... why can I compile/run an app, but when I try
to create an exe, the AV stops it? Why doesn't the AV also stop
the temp exe created from compile/run? Not logical.

[Joakim Christiansen]

False positives are not always logical. When run from the program the exe might be a little different, especially with the debugger enabled, probably different enough to not trigger the false positive.

[PB]

Ah, you're right! If I compile/run without the debugger from the IDE,
the AV stops it too (I get "POLINK: fatal error: Access is denied").

Now I just have to find out what's triggering the false positive.

[Joakim Christiansen]

Now I just have to find out what's triggering the false positive.

Many AV companies allow you to send in false positives so they can repair their detection engine, I did that with success once.

[PB]

I know, but that's too much hassle to report to them all.

It started after I added a single line of code to my source,
but now I can't remember what it was. I should've stopped
and commented it immediately, but I ignored it and kept coding.

[IdeasVacuum]

"POLINK: fatal error: Access is denied"

That normally means there is an exe of the same name already running - may be one that didn't terminate correctly? Check with Task Manager.

[PB]

No, that's not the case here. Avira Antivir causes this error when
it doesn't allow the compiled exe to run. Thanks for asking, though.

(Just to reassure you: my exe is a run-once-and-quit tool, so it'll
never be left running in the background at all).

[Fenix]

I know, but that's too much hassle to report to them all.

It started after I added a single line of code to my source,
but now I can't remember what it was. I should've stopped
and commented it immediately, but I ignored it and kept coding.

I had this when I started using regular expressions.

[PB]

I worked it out; I added a line to IncludeFile an ExeFromHwnd procedure by Rashad.
Obviously Avira thinks my app is being naughty for getting process information.

This is the line that makes Avira hate my exe:

Code: Select all

snap=CreateToolhelp32Snapshot_(#TH32CS_SNAPPROCESS,0)

Because if I change that to "snap=0", then Avira lets me build the exe.

However, I was able to trick Avira by not calling the CreateToolhelp32Snapshot API
directly, but by using OpenLibrary and CallFunction instead to "mask" the call:

Code: Select all

k32=OpenLibrary(#PB_Any,"kernel32.dll") ; Needed due to Avira.
If k32
  ;snap=CreateToolhelp32Snapshot_(#TH32CS_SNAPPROCESS,0) ; Avira hates this...
  snap=CallFunction(k32,"CreateToolhelp32Snapshot",#TH32CS_SNAPPROCESS,0) ; ...so we do this instead!
  If snap
  [...]

Now my exe builds. Kiss my ass, Avira!

[endo]

Even if I have checked "Create temporary executable in the source directory", when I compile with debugger, PureBasic uses the temp folder (on Windows). It would be a solution to exclude a specific folder from antivirus program if I could set the temp folder for PureBasic compiler. But I cannot exclude the whole temp folder.