PureBasic Forums - English

Hi,

Not sure if this is a bug or not, anyway - it is utterly annoying

I'm using F-Secure as an anti-virus on my PC. A good AV-tester, but the heuristics are a bit overactive from time to time, and block a totally innocent program (telnet). I wouldn't abuse PB for writing viri !

I set PB to create the temporary files in the same folder as the source, and I set F-Secure to ignore what happens in these folders. Yet, it still blocks when trying to compile.

Product: F-Secure Anti-Virus (OID: 1.3.6.1.4.1.2213.12)
Severity: security alert (5)
Message: Malicious code found in file c:\Users\MyUserName\AppData\Local\Temp\~16B0747.TMP.
Infection: Gen:Variant.Graftor.12859

Now : why is this folder used for storing temporary things ? Either the setting for temporary files is not working (a bug ...) or it is another process that is unaware of this setting that spits in the fan. The linker maybe ?

Any ideas ?
How to fix ?

Ludo

moved, as its not a PB Bug ( more a snake-oil warning )

Your best bet is to contact F-Secure.

Ludo wrote: I set PB to create the temporary files in the same folder as the source

Hi, to be more precise the setting you are referring to is to create the temporary EXE in the same folder as the source.
In other words, the temporary target.
There is no promise of temporary files, if any, to be stored there also. So it's not a bug.

help wrote: With this option turned on, the temporary executable file for running the program from the IDE will be placed inside the source directory. This can be useful if the program depends on files inside the source directory for testing. With this option turned off, the executable is created in the systems temporary directory.

Ludo wrote: Now : why is this folder used for storing temporary things ? Either the setting for temporary files is not working (a bug ...)

It's the default temporary directory defined by windows, so yes it's probable some of the other tools used in the chain, or even the PB compiler itself, are writing there.

About your problem, you could see if the heuristic level of you antivirus can be lowered, you could set the temp directory in the exclude list of the antivirus (not a very bright idea I admit), or you could make a request in the appropriate forum section to make all the tools used by PB write to a specified temp directory. It could be possible or not, I don't know, considering the assembler and the linker are third party products. You could start to investigate if they can be redirected in using a different temp directory.
I never looked into it, so I don't have idea.

Obviously you could try to contact the antivirus maker and be at his mercy as many people seem so fond to be.
You could be lucky and resolve your problem now and maybe even for the future.

...or you could just ditch the AV and try another. I have tried a few that were recommended on this forum, but in the end have returned to MS Security Essentials. It does not interfere with PB at all.

Edit: I should mention why I tried a few others - my PC was getting slow and I thought Security Essentials might be a contributor. However, turned out that my drive was on it's way to drive heaven.

Variant.Graftor is a generic detection from F-Secure that detects a file that appears to have trojan-like features or behavior, it seems to affect mostly temp files. The problem, with F-Secure, is that most times its a false detection, However, there can be an instance where you actually have the original virus somewhere on your computer being launched by a trojan that has not been detected and it tries to infect a .tmp file each time its created, this is rare but we have seen this behavior in the lab on occaision. F-Secure has tried to get rid of this false detection in their updates but have yet to do so. I'd recommend that you either live with it (exclude the folder from being scanned - but I do not recommend this), let the default location for the temp files be the system default and set your PB source file folder to a folder not in the c:\Users\MyUserName\AppData\Local\Temp\ path as this could also trigger a false detection on some systems, or dump F-Secure and get something else. There are a lot better than F-Secure. If your looking for free then Microsoft Security Essentials is pretty good, or get the Avast Pro version which will cost you a little bit. BTW, the c:\Users\MyUserName\AppData\Local\Temp\ path is intended for just what the name implies and not for use as a 'working folder', this might have some play in the false detection also.

MS Security Essentials. It does not interfere with PB at all.

Ahem. http://purebasic.fr/english/viewtopic.php?f=7&t=48746

I've never had a problem at all with MS Essentials. I guess people could have some sort of issue with it but I haven't seen any problems with it.