Pelles C forum
Pelles C => General discussions => Topic started by: agp on December 27, 2012, 09:18:32 PM
-
Hi,
I'am running Windows 7 32-bit and (of course) Pelles IDE 32-bit (I'm not new to Pelles C or the C lang in generall, nor to this forum as a still reader). I've got a linker error as descriped in subject, every time when compiling/linking a simple console app like a Hello World Program from the IDE wizard.
This behavior occurs under the following conditions:
- it's only concerned to console apps (for Win32 GUI projects everything works fine)
- it only occurs if debug info COFF or "COFF & CodeView" and is switched on (no COFF => no problem; only CodeView debug => no problem)
- there must be for example a printf function in the code
I've investigated in this error quite a bit of time, first thought there is a path problem, then admin rights or something. But it has been shown that the problem comes from the damn virus scanner "AntiVir". If I temporarily tourn "on-access scanning" off, then everything works fine (for the moment). But thereafter I have a virus in the linked exe (VirusTotal detection rate 2/46). Send it to AntiVir and they tracked it as expected FALSE POSITIVE. I then hoped to problem is vanished, but it's not. New compilation, new linking, again the same error.
The people from AntiVir Virus Lab simply record the signature of this one exe file which I send them, but my hex editor shows me that the TimeDateStamp in the COFF Header of the exe at offset 88h which changed everytime on compilation/linking caused AntiVir to produce a new virus warning, which is annoying. I noticed that after re-send the new exe to AntiVir Lab. They again classified it as false positiv and so on ..
Any ideas what to do?
-
Yep... get rid of that virus scanner.
Personally I don't use AV software at all. None... Moreover; except for the firewall in my router, I don't even have firewalls enabled inside the LAN. I've been working like this since 1995 and I've never had a problem.
On the rare occasion when I did suspect a virus I've used the EMISYSOFT (http://www.emsisoft.com/en/software/eek/) Emergency Kit to scan and clean my system.
Ask yourself when is the last time your AV scanner actually reported a REAL virus on your system?
Maybe it's just a waste of CPU cycles.
Finally; the only time you need debugging symbols in your executables is when you are actually debugging your code. The rest of the time it's just bloat and gives you no benefit at all so you might as well compile with debugging off, unless you need it.
-
@ CommonTater
Coudn't get rid of it. ;) I have had some situations in the past where AntiVir has done his job quite well and since I make ebay and online banking, I need some additional security.
Yes, you are right. I didn't always need the debuginfo, so I could turn debuginfo off or turn off AntiVir for a short period of time. That's a workaround, but not the best solution. There must be a short sequence of bytes in the exe caused by the linked COFF info causing the false alarm but the AntiVir people excluded the "critical bytes" from their definition files apparently too generous as necessary and these bytes changed after new compiling/linking.
And think of this, user who unexpectedly had this "linker error code 1" may not get an idea what caused the problem and get confused of using Pelles C IDE (or C in generell). ;)
A particular byte-change in the code creation except the DateTimeStamp would probably solve the issue.
-
Well... if you're not willing to solve the problem then you get to live with it.
Also note that in order to use Pelles Debugging tools, you need both codeview and coff symbols in your executable. (for x86)
-
@ CommonTater
I used the debuginfo playing around with inline assembler and linked object asm files to improve my experience in asm and also practice good old win32 api. I also used other compilers/IDE like VisualC for plain C/C with Win32 API/C# and some more (have as well old Delphi 7 installed, but I'm more familiar in C). There is no problem with these tools with AntiVir.
> Well... if you're not willing to solve the problem then you get to live with it.
It's not on my will to solve this problem. I can only do a workaround for me and live with it. To solve this problem it's on the AntiVir Lab people oder Pelle the master of this really good IDE. ;)
-
Then my last remaining suggestion is this...
If you are REALLY REALLY sure this is a bug in Pelles C (POLINK) then you should make a bug report in the appropriate forum section...
-
Then my last remaining suggestion is this...
If you are REALLY REALLY sure this is a bug in Pelles C (POLINK) then you should make a bug report in the appropriate forum section...
I would not say that there is in general a bug in a Software if a Virus Scanner blocks a software, certainly not if the detection is false positiv.
I would rather say that this problem is first on the lab-people from Avira, but I do not know how to convince them to set up correctly their antiviren signature (VDF). At the moment a pelles win32 console project with coff debuginfo could theoreticly produce 2^32 false positive Virus messages, because of a every time changed 4-byte DateTimeStamp binary value. But the more annoying thing is that the IDE won't link a simple console app (+ debug coff), as long as AntiVir is active.
First and foremost I started this thread to find out if there are other pelles user who had the same problem. So let's wait a bit, if there are others who confirm the issue.
(or maybe I'm the only dickhead who runs this virusscanner ::))
-
Do some forum searches... we've talked about this before...
-
Yep... get rid of that virus scanner.
Personally I don't use AV software at all. None... Moreover; except for the firewall in my router, I don't even have firewalls enabled inside the LAN. I've been working like this since 1995 and I've never had a problem.
Than you are either extremely fortunate or rarely online....
On the rare occasion when I did suspect a virus I've used the EMISYSOFT (http://www.emsisoft.com/en/software/eek/) Emergency Kit to scan and clean my system.
Ask yourself when is the last time your AV scanner actually reported a REAL virus on your system?
Maybe it's just a waste of CPU cycles.
Sorry, but in general I would consider this ill advice these days. I did not have a virus becoming active on any of my own computer systems but I usually use AVG (on Windows XP mainly) or Avast! (on Windows XP and Windows 7) and I have at least once a day that I get a warning about some illegal activity when web browsing, a lot of times on supposedly safe web sites.
I work as an IT consultant and have clients that don't go more than 3 month without catching some virus that is causing major headaches, even despite having AV software active. For some of them, I set up their web browser in a sandbox (http://www.sandboxie.com/) so that any potential malware infection isn't taking the whole system down. In one case, a less than smart secretary, I even have her email program sandboxed...
As for AntiVir, I did not have the greatest experience with it. It might be different for someone located in Europe, but for me AVast! and AVG (in that order currently) do their job just fine, with fairly little influence on the system performance....
Ralf
-
Than you are either extremely fortunate or rarely online....
Neither.... Just careful ... I don't randomly "surf the web"... I go where I go for a reason and I never click on ads. When installing software, anything that wants to put in a toolbar or offers me some grand thing or another is immediately turfed. But mostly I apply common sense... It's the old saying: "If it sounds too good to be true, it probably is."
As for AntiVir, I did not have the greatest experience with it. It might be different for someone located in Europe, but for me AVast! and AVG (in that order currently) do their job just fine, with fairly little influence on the system performance....
Of those two I'd suggest Avast ....
-
Than you are either extremely fortunate or rarely online....
Neither.... Just careful ... I don't randomly "surf the web"... I go where I go for a reason and I never click on ads. When installing software, anything that wants to put in a toolbar or offers me some grand thing or another is immediately turfed. But mostly I apply common sense... It's the old saying: "If it sounds too good to be true, it probably is."
The issue is that nowadays, you do not even have to actively "click on any link/ads" anymore.
I watched one client's 14 year old granddaughter browse to a web site for school research, which she apparently did before a couple of times and each time caught a nasty "faked anti-virus" virus.
She did nothing more than go to the main URL she was given by her teacher and within a split second, a minutes earlier updates AVast! threw a red flag alert.
Turned out that on that web site there was a graphic loaded, which by itself was linked from another (original) site, not any ad or something like this by a long shot. And that on that second site, the graphic file itself had been highjacked and "laced" with some executable code which in turn loaded that trojan without anyone noticing.
The web admin of that second site wasn't aware of anything amiss until I notified him and he fixed the issue (and likely a lot more on his site) pretty quickly, but there wasn't anything that your "common sense" (which I am aware is a rare commodity these days) would have prevented from happening...
Ralf
-
Surfing the net is like having sex, even if you really know your partner, you should wear a condom.
Everyone can get infected in so many different ways, where most are not even known.
Have a router as your first barrier against intruders and AV software as your second defense.
The router will block many things, but some will slip through, so you will need a final curtain.
I have had quite some brands of AV software, free and paid, some of them are mentioned here.
I kicked McAffee, BitDefender, Avast, AVG, AntiVir, just to name some and am now using Microsoft Security Essentials, due to its small footprint.
In addition I never used Norton due to its heavy load and the competition between virus writers to beat it.
BTW, AntiVir is known for its huge amount of false positives and the lack of working them out painlessly.
-
BTW, AntiVir is known for its huge amount of false positives and the lack of working them out painlessly.
That's not my personal experience. I use AntiVir now for several years (used it under Win98, W2k, XP) and tried out other virus scanners like avg. They all had their quirks. Worst of them was the Norton package. Normally false positives isn't a problem on Avira since the manufacturer's signature files in this regard quickly adapts.
I also think, if we are talking about pelles c in general, it is not only a problem of a specific virusscanner. I tried an older version of pelles c v5 and v6. As a result of compiling a simple hello world wizard console app I get
v5 : more than 15 virus warnings from virustotal
v6: about 7 virus warnings
across all known av scanner. I must say, I know of no other software that shows such effects (I had once some virus issues with masm32 and other asm tools with whom I played around but I think for assembler this isn't so unusual). This issue cannot only be adressed to the AV vendors. Please don't missunderstand me (and my poor english ;D), i really like this peace of software and pelle did a great job to develop such a useful IDE. But if I would create such a complex software system like a compiler etc. (that goes beyond my capabilities significantly :o), I strongly had an personal interest that my software does not confuse others with virus warnings. In this regard has v7 in comparison to older versions perceptibly improved. But there are still false alarms on well known AV scanners like Avira Free Antivirus and I think it should be investigated.
Are there really no one out who at least once could confirm the problem? I can't believe it that I'm the only guy whom concerns this.
Maybe Console Apps are out of date .. ;)
-
Are there really no one out who at least once could confirm the problem? I can't believe it that I'm the only guy whom concerns this.
Maybe Console Apps are out of date .. ;)
Most of what I do with Pelle's C are in fact console apps and I don't get any false positives at all, as mentioned using AVast and AVG on my own PCs, in addition to ESet and MSE on some of my clients hosts...
Worst case scenario is on one of my own hosts, which I mainly use to test software (my own and stuff I am trying out for clients) and that has AVast! set with a default sandbox mode for unknown executables. No further problem once I confirm if I either want to run a program in sandboxed or normal mode...
Ralf
-
#include <stdio.h>
int main(int argc, char *argv[])
{
printf("Hello, world!\n");
return 0;
}
Pelles C v6.00.4 (6.0)
1. Full Debug Info
virustotal Detection ratio: 7 / 46
AntiVir TR/Fraud.Gen7
BitDefender Gen:Variant.Graftor.39411
Emsisoft Gen:Variant.Graftor.39411 (B)
F-Secure Gen:Variant.Graftor.39411
GData Gen:Variant.Graftor.39411
Ikarus Backdoor.Win32.Poison
Jiangmin Backdoor/Poison.vpe
2. compiled with multithreaded lib
virustotal Detection ratio: 1 / 46
AntiVir TR/Fraud.Gen7
Pelles C v7.00.355 (7.0)
3. None Debug Info
virustotal Detection ratio: 3 / 46
DrWeb BackDoor.Poison.13979
Ikarus Backdoor.Win32.Poison
Jiangmin Backdoor/Poison.ydu
4. Full Debug Info
virustotal Detection ratio: 2 / 46
AntiVir TR/Fraud.Gen7
Ikarus Backdoor.Win32.Poison
5. compiled with multithreaded lib
virustotal Detection ratio: 1 / 46
Ikarus Backdoor.Win32.Poison
and just for fun downloaded actual lcc-win32 and compiled the hello world sample
full debug info (as default)
virus Detection ratio: 9 / 46
BitDefender Gen:Variant.Graftor.Elzob.16145
Commtouch W32/Rbot.K.gen!Eldorado
F-Prot W32/Rbot.K.gen!Eldorado
F-Secure Gen:Variant.Graftor.Elzob.16145
GData Gen:Variant.Graftor.Elzob.16145
Ikarus Trojan-Spy.Win32.KeyLogger
Jiangmin TrojanSpy.KeyLogger.cvgg
K7AntiVirus Backdoor
McAfee-GW-Edition Heuristic.LooksLike.Win32.Suspicious.J!80
and the "winner" is lcc-win32 :o
Note the difference between single-threaded to multi-threaded compilation in Pelles C !!
-
I am not quite sure what you are trying to tell us here (or if you just keep flogging a dead fish)...
I just created a brand new project, copied with your source code of this imensly important program and scanned wit with the various AVs at my disposal and I do not get a false positive on any of them, here just one example of the result:
-
Don't blame me for this problem and don't address it to me. I spend a lot of time (hours of hours) to investigate this. What you tell me in your example ist only that your avast scanner is detecting nothing. Try an upload your exe you've compiled to
https://www.virustotal.com/
but ensure that it is compiled with full debug info!! Then post the results here.
What system are you running? Win 7 64 bit?
-
None of this is the linker's fault...
Seriously, this is the virus scanners, not the programming tools.
I have a pet theory that some of the bigger corporations are turning in reports on the free stuff as a means of forcing people to pay... but that's just a theory.
-
@ CommonTater
Have you an explanation or a theory why lcc-win32 (which based on lcc like Pelles C too) is so extremly overloaded with virus warnings from the big player in the AV business? By the way lcc-win32 has a terrible IDE.
Try this simple helloworld on VisualC++ 2008 and 2010 (I have done this) and you wouldn't found any of this warnings (OK, there was one warning from very unknown scanners), whether you include debug info or not or do other compiler/linker settings.
I also tried the old version of Pelle v5. There were 15 warnings on virustotal !! You don't want wo use such a software. Fortunately the newer the PellesC version the better or less warnings, which leads me to believe that Pelle has possibly figured out that there is a problem on that and done something against, but I don't know.
As I said before, it would be nice to read more additional experiences of others in this regard. I don't think that Pelle is a "dead fish" (your talk in the other thread), so lets keep the debate open. I think code safety (virus safety) is not a secondary matter.
-
Don't blame me for this problem and don't address it to me. I spend a lot of time (hours of hours) to investigate this. What you tell me in your example ist only that your avast scanner is detecting nothing. Try an upload your exe you've compiled to
https://www.virustotal.com/
but ensure that it is compiled with full debug info!! Then post the results here.
Two false positives, on AntiVir and Ikarus, whatever that is. This scan doesn't tell shit, specially if this is only triggered with debug info, which should not be "out in the wild" in the first place. The sample itself is so simple that it rather demonstrate that these are just annoying false positives from some rather obscure anti virus tools, nothing more...
What system are you running? Win 7 64 bit?
Whatever you want, I did the scans at on my setups on Windows XPSP3 Pro/32bit, Windows 7 Ultimate 64bit, Windows Server 2003 Standard 32bit, Windows Server 2008 64bit, it doesn't matter what OS you're running if an application is considered (containing) a virus or not...
Ralf
-
@ CommonTater
Have you an explanation or a theory why lcc-win32 (which based on lcc like Pelles C too) is so extremly overloaded with virus warnings from the big player in the AV business? By the way lcc-win32 has a terrible IDE.
Because it's a free tool that might be used by a lot of virus authors and those AV software that show those warnings do a shoddy job in identifying what actually constitutes the virus part and instead trigger "detection" on parts of program initializations or library routines instead of actual malicious parts...
Try this simple helloworld on VisualC++ 2008 and 2010 (I have done this) and you wouldn't found any of this warnings (OK, there was one warning from very unknown scanners), whether you include debug info or not or do other compiler/linker settings.
I also tried the old version of Pelle v5. There were 15 warnings on virustotal !! You don't want wo use such a software. Fortunately the newer the PellesC version the better or less warnings, which leads me to believe that Pelle has possibly figured out that there is a problem on that and done something against, but I don't know.
No, more likely that the virus authors switched tools (away from LCC) and Pelle's C over time has less and less in common with the original LCC code....
As I said before, it would be nice to read more additional experiences of others in this regard. I don't think that Pelle is a "dead fish" (your talk in the other thread), so lets keep the debate open. I think code safety (virus safety) is not a secondary matter.
There simply isn't anything you can do, beside pestering the AV manufacturers to deal properly with those false positives or simply ignore those obscure programs that keep giving those false positives...
Ralf
-
Two false positives, on AntiVir and Ikarus, whatever that is.
Ralf
OK, thanks for that! ;)
specially if this is only triggered with debug info
Try and compile it as multithreaded lib, upload to virustotal and show the result. The AntiVir warning disappear.
By the way, the worse (for me) is not to get a virus warning. The worse is linking is blocked.
The sample itself is so simple that it rather demonstrate that these are just annoying false positives from some rather obscure anti virus tools, nothing more...
Yes it is simple and that's a good thing point out the problem. I don't agree with you that AntiVir is "obscure". It may not common where you live but in germany it's a very known AntiVirus SW and I havn't found that there is another better one out there. Here we have a special rare problem. Because the exe file that one can compile when debugging console app code changes every time on compilation and so there is currently no chance to adapt the VDF scanner files which is normally done in just 24 hours.
-
Have you an explanation or a theory why lcc-win32 (which based on lcc like Pelles C too) is so extremly overloaded with virus warnings from the big player in the AV business? By the way lcc-win32 has a terrible IDE.
Ok... bottom line and I'm outa this thread...
This is NOT the fault of the compiler or linker....
It's 1/2 your fault for letting code with debugging symbols (a prime vector for reverse engineering, btw) out into the wild.
The other 1/2 is the AV scanner's fault for doing a crappy job of recognizing actual viruses.
10-4 ...
-
None of this is the linker's fault...
Seriously, this is the virus scanners, not the programming tools.
I have a pet theory that some of the bigger corporations are turning in reports on the free stuff as a means of forcing people to pay... but that's just a theory.
Oh, please, not another attack of the tinfoil hat brigade....
Those false positives that I have seen myself when checking on those rumors that Pelle's C created programs trigger virus warnings are all from rather small and partially obscure anti virus vendors that just want to get their share of the pie.
And to get ahead of the herd, some of them seem to do a very shoddy job of identifying possible malicious code and rather seem to identify parts of a stock program initialization or library routines instead of actively malicious code, which might be much more difficult to detect due to tricks played by the virus authors.
And when using a relatively low-volume tool like Pelle's C (or LCC or a lot of other less common program environments), it is simply much more likely to get a false positive identification because of this than with some high volume tools like VC++ or GCC for example...
And that a program compiled with full debug info might get more false positives is technically not surprising either. Some of the techniques used to debug programs are simply similar to tricks used by virus authors to try and prevent decryption and detection when their virus code is run in debuggers. So if a AV vendor again is doing a poor job in identifying the actual malicious code and instead uses pieces of legitimate debugging info in a program, than there is very little that you can do on your end. Again beside pestering those AV tool makers to do a better job...
Ralf
-
Oh, please, not another attack of the tinfoil hat brigade....
Hey ... carefult with that... I resemble that remark! :D
-
Try and compile it as multithreaded lib, upload to virustotal and show the result. The AntiVir warning disappear.
Not surpised at all, as likely the initialization or runtime library code that they use to detect the alleged malware is not used in that case. Once again rather a strong hint that their detection method simply stinks...
By the way, the worse (for me) is not to get a virus warning. The worse is linking is blocked.
If you are running a tool that gives you these kinds of problems, simply ditch it, it is just not worth dealing with it.
Either they react on a properly described false positive or move on to something more sane. As I mentioned, AVast (which I currently consider the most secure and sane of all current AV products) can come up with a warning about sandboxing a newly created application, which I take rather as a sign that it is doing it's job and pays attention in an otherwise rather unintrusive way and I can decide if I want to do this or even disable that warning all together...
Yes it is simple and that's a good thing point out the problem. I don't agree with you that AntiVir is "obscure".
Maybe less obscure than Ikarus (which I looked up by now, they are from Vienna, Austria) or Jiangmin (some Chinese outfit that has problems presenting them on their international site even in proper English).
It may not common where you live but in germany it's a very known AntiVirus SW and I havn't found that there is another better one out there.
Yes, AntiVir is less common here in the USA (ich bin Deutscher!) but I run into it a couple of times a year in my work as an IT consultant. And so far, not in a positive way.
AVast or AVG, which I prefer out of experience at my line of work, aren't US software either but do a much better job as all those little garage outfits that have crept up in the last few years. Or those bloated behemoths like Symantec/Norton or McAfee...
Here we have a special rare problem. Because the exe file that one can compile when debugging console app code changes every time on compilation and so there is currently no chance to adapt the VDF scanner files which is normally done in just 24 hours.
But the fact that you have to keep doing this is a sure sign that they are just going about detecting the alleged malware the wrong way. It's not the whole program that triggers the alert, it's just a piece (or several pieces) of code that they identify as the 'code signature' of the alleged malware. Or that's what it is supposed to do...
Ralf
-
Oh, please, not another attack of the tinfoil hat brigade....
Hey ... carefult with that... I resemble that remark! :D
;)
-
...
I don't agree with you that AntiVir is "obscure". It may not common where you live but in germany it's a very known AntiVirus SW and I havn't found that there is another better one out there. Here we have a special rare problem. Because the exe file that one can compile when debugging console app code changes every time on compilation and so there is currently no chance to adapt the VDF scanner files which is normally done in just 24 hours.
I'm also using Avira AntiVir for many years, across several Windows versions. Yeap, it raises several false positives with Pelles C, and once it raised false positives for executables built with some older version of mingw32. You could try lowering the heuristics detection level form High to Medium, or even put offensive execs and or libs to the Exceptions list. At least, that's what I did ;)
-
Good news from the (anti) virus front. ;) Today there was a huge file update for Avira Free AntiVir and now the false virus problem on linking console code as I described ist GONE!!
In the mean time I updated to AntiVir v13, so I couln't promise that this applies to the older version v12 (but I think so). A check at virus total online engine did not confirm that until now, but I think this will be in the next few days when they had updated their scanners.
Thanks to all for the comments especially migf1.
-
Good news from the (anti) virus front. ;) Today there was a huge file update for Avira Free AntiVir and now the false virus problem on linking console code as I described ist GONE!!
In the mean time I updated to AntiVir v13, so I couln't promise that this applies to the older version v12 (but I think so). A check at virus total online engine did not confirm that until now, but I think this will be in the next few days when they had updated their scanners.
Thanks to all for the comments especially migf1.
I thank you too for the good news about the new version of Avira AntiVir :)
-
Just for information.
Same behaviour with F-Secure Antivirus 9.x since a longer time. Sent a report to F-Secure (Percomp) yesterday. They will fix it (they have said .-)
only with single-threaded, no debug.
int main( void )
{
malloc(42); // Virus detected Gen.Variant.Graftor:56893
/* calloc(1,42); // no virus (calling malloc) */
};
> pocc.exe -std:C99 -Tx86-coff -Ob1 -fp:precise -W0 -Gd "O:\Sources\Test\test.c" -Fo"O:\Sources\Test\output\test.obj"
Erzeugen von O:\Sources\Test\Test.tag.
> polink.exe -subsystem:console -machine:x86 kernel32.lib advapi32.lib delayimp.lib user32.lib -out:"O:\Sources\Test\Test.exe" O:\Sources\Test\output\test.obj
POLINK: fatal error: Zugriff verweigert <<< Virus-Scanner pops up with appropriate Message
*** Fehlercode: 1 ***
Fertig.
-
Today it is possible to generate the executable testfile with F-Secure AV active (but in a few days ... .-)