Antivirus and excluded folders

[Olaf Doschke]

Last weekend I had a case of my antivirus software putting a newly built EXE in quarantine. I added my main projects folder into an exclusion list, but the scanning continued, even after a PC restart.
This is not only true for VFP9 built EXEs.

The essence is, you can't even rely on excluding folders. For sure it's no good idea to exclude the EXE file type from scanning in general, so you have to add the specific exe file you build from scanning, too.

Bye, Olaf.

 

[Mike Lewis]

Olaf,

Would you care to tell us which anti-virus you are using?

I use AVG. As far as I can remember, I've never known it to object to any Foxpro-related files. I've set it to scan all the usual "executable" file types, without any excluded folders.

Mike

__________________________________
Mike Lewis (Edinburgh, Scotland)

Visual FoxPro articles, tips and downloads

 

[Olaf Doschke]

Well, it's Bitdefender.

It's not scanning prgs, dbfs, etc. but EXE of course. And it evens scans EXE files in excluded folders, obviously.

Bye, Olaf.

 

[GriffMG]

Is it possibly scanning a temporary folder that the .exe is built in - and moving it before
VFP does?

Regards

Griff
Keep [Smile]ing

There are 10 kinds of people in the world, those who understand binary and those who don't.

I'm trying to cut down on the use of shrieks (exclamation marks), I'm told they are not good for you. ​

 

[Olaf Doschke]

No, Bitdefender is explicitly pointing to the EXE in the destination, within the project folder I excluded.

The point I want to bring over is, we sometimes recommend excluding folders and VFP specific file extensions from scanning, but it's not sufficient for at least Bitdefender. So, if you recommend that to users, also recommend excluding the built EXE from virus scanning.

It's not, that a virus definition is found, Bitdefender just warns this (newly creeated) EXE is suspicious to it.

Bye, Olaf.

 

[mjcmkrsr]

Hi,

Bitdefender is a PITA. Even if you exclude the EXE, it sometimes gives you a FALSE alarm when you run that EXE. In the end I removed Bitdefender and installed a different AV.

hth

MarK

 

[Olaf Doschke]

Bitdefender has some nice features for me, so I'll not replace it just because of this. As far as I see excluding the specific EXE file helps.

In general it's a good idea to not stop scanning EXE files, even your own, as this of course is a security hole. You never know, if even your own EXE files will be compromised by a virus just waiting for a new EXE file to be created. In this case the Task manager showed 50% CPU usage for this EXE, as I didn't add DOEVENTS in a tight loop, so that may have caused Bitdefender to judge this EXE as a system threat, just because it hogs one of the CPU cores. So I might also adjust some live scan settings, if I find one allowing that.

By the way this also is true for VS2010. When building a solution for the second time, the generated EXE can't be copied to the bin folder, not because it's still running, I double checked with Task Manager.

Bye, Olaf.

 

[Mike Lewis]

I'm not familiar with Bitdefender, but I noticed this in its review on CNET:

It [monitors] the various applications and programs you already have installed and "learns" what kind of configurations are standard vs. those that are tampered with by malware.

I wonder if the problem is caused by the fact that you rebuilding the same EXE several times. It notes the size and/or CRC of the first build, then sees that it has changed, and so assumes that it has become infected. That's only a guess, but it seems plausible.

Of course, that's no excuse for it monitoring a folder when you have explicitly told it not to.

In the end I removed Bitdefender and installed a different AV.

Very sensible. Of course, we can't always tell our customers to do that.

Mike





__________________________________
Mike Lewis (Edinburgh, Scotland)

Visual FoxPro articles, tips and downloads

 

[Olaf Doschke]

Yes rebuilding an exe, causing a new CRC, checksum, signature, hash, whatever the AV software uses, can cause that. But I'm compiling all the time. All that's true for any compilation, yet normally I don't have that problem. I don't use Bitdefender for years, but since December.

It may be sensible to change AV sometimes, and for me as a single person that might be easy, but in case of corporations you can't simply change AV over night. I do also have some problems with MS Frontline at a customers site, you can't detach a USB thumb drive, while it's scanned. I'd say every AV has it's pros and cons.

Bye, Olaf.

 

[EzLogic]

Olaf, I had the same issue, and then, I got a code signing SSL from Comodo (what a painful process), and now, i digitally sign my EXEs and my Installation files as well.

And that issue went away. Also, we don't get the "unknown publisher" any longer.

Ez Logic
Michigan