POLINK: fatal error: Zugriff verweigert Error code: 1

[agp]

Hi,

I'am running Windows 7 32-bit and (of course) Pelles IDE 32-bit (I'm not new to Pelles C or the C lang in generall, nor to this forum as a still reader). I've got a linker error as descriped in subject, every time when compiling/linking a simple console app like a Hello World Program from the IDE wizard.

This behavior occurs under the following conditions:

- it's only concerned to console apps (for Win32 GUI projects everything works fine)
- it only occurs if debug info COFF or "COFF & CodeView" and is switched on (no COFF => no problem; only CodeView debug => no problem)
- there must be for example a printf function in the code

I've investigated in this error quite a bit of time, first thought there is a path problem, then admin rights or something. But it has been shown that the problem comes from the damn virus scanner "AntiVir". If I temporarily tourn "on-access scanning" off, then everything works fine (for the moment). But thereafter I have a virus in the linked exe (VirusTotal detection rate 2/46). Send it to AntiVir and they tracked it as expected FALSE POSITIVE. I then hoped to problem is vanished, but it's not. New compilation, new linking, again the same error.

The people from AntiVir Virus Lab simply record the signature of this one exe file which I send them, but my hex editor shows me that the TimeDateStamp in the COFF Header of the exe at offset 88h which changed everytime on compilation/linking caused AntiVir to produce a new virus warning, which is annoying. I noticed that after re-send the new exe to AntiVir Lab. They again classified it as false positiv and so on ..

Any ideas what to do?

[CommonTater]

Yep... get rid of that virus scanner. 

Personally I don't use AV software at all.  None... Moreover; except for the firewall in my router, I don't even have  firewalls enabled inside the LAN.  I've been working like this since 1995 and I've never had a problem. 

On the rare occasion when I did suspect a virus I've used the EMISYSOFT Emergency Kit to scan and clean my system.

Ask yourself when is the last time your AV scanner actually reported a REAL virus on your system?
Maybe it's just a waste of CPU cycles.

Finally; the only time you need debugging symbols in your executables is when you are actually debugging your code.  The rest of the time it's just bloat and gives you no benefit at all so you might as well compile with debugging off, unless you need it.
 
 

[agp]

@ CommonTater

Coudn't get rid of it. I have had some situations in the past where AntiVir has done his job quite well and since I make ebay and online banking, I need some additional security.

Yes, you are right. I didn't always need the debuginfo, so I could turn debuginfo off or turn off AntiVir for a short period of time. That's a workaround, but not the best solution. There must be a short sequence of bytes in the exe caused by the linked COFF info causing the false alarm but the AntiVir people excluded the "critical bytes" from their definition files apparently too generous as necessary and these bytes changed after new compiling/linking.

And think of this, user who unexpectedly had this "linker error code 1" may not get an idea what caused the problem and get confused of using Pelles C IDE (or C in generell).

A particular byte-change in the code creation except the DateTimeStamp would probably solve the issue.

[CommonTater]

Well... if you're not willing to solve the problem then you get to live with it.
 
Also note that in order to use Pelles Debugging tools, you need both codeview and coff symbols in your executable. (for x86)

[agp]

@ CommonTater

I used the debuginfo playing around with inline assembler and linked object asm files to improve my experience in asm and also practice good old win32 api. I also used other compilers/IDE like VisualC for plain C/C with Win32 API/C# and some more (have as well old Delphi 7 installed, but I'm more familiar in C). There is no problem with these tools with AntiVir.

> Well... if you're not willing to solve the problem then you get to live with it.

It's not on my will to solve this problem. I can only do a workaround for me and live with it. To solve this problem it's on the AntiVir Lab people oder Pelle the master of this really good IDE. 

[CommonTater]

Then my last remaining suggestion is this...

If you are REALLY REALLY sure this is a bug in Pelles C (POLINK) then you should make a bug report in the appropriate forum section... 

[agp]

Then my last remaining suggestion is this...

If you are REALLY REALLY sure this is a bug in Pelles C (POLINK) then you should make a bug report in the appropriate forum section...

I would not say that there is in general a bug in a Software if a Virus Scanner blocks a software, certainly not if the detection is false positiv.

I would rather say that this problem is first on the lab-people from Avira, but I do not know how to convince them to set up correctly their antiviren signature (VDF). At the moment a pelles win32 console project with coff debuginfo could theoreticly produce 2^32 false positive Virus messages, because of a every time changed 4-byte DateTimeStamp binary value. But the more annoying thing is that the IDE won't link a simple console app (+ debug coff), as long as AntiVir is active.

First and foremost I started this thread  to find out if there are other pelles user who had the same problem. So let's wait a bit, if there are others who confirm the issue.

(or maybe I'm the only dickhead who runs this virusscanner  )

[CommonTater]

Do some forum searches... we've talked about this before...

[Bitbeisser]

Yep... get rid of that virus scanner. 

Personally I don't use AV software at all.  None... Moreover; except for the firewall in my router, I don't even have  firewalls enabled inside the LAN.  I've been working like this since 1995 and I've never had a problem. 

Than you are either extremely fortunate or rarely online....

On the rare occasion when I did suspect a virus I've used the EMISYSOFT Emergency Kit to scan and clean my system.

Ask yourself when is the last time your AV scanner actually reported a REAL virus on your system?
Maybe it's just a waste of CPU cycles.

Sorry, but in general I would consider this ill advice these days. I did not have a virus becoming active on any of my own computer systems but I usually use AVG (on Windows XP mainly) or Avast! (on Windows XP and Windows 7) and I have at least once a day that I get a warning about some illegal activity when web browsing, a lot of times on supposedly safe web sites.
I work as an IT consultant and have clients that don't go more than 3 month without catching some virus that is causing major headaches, even despite having AV software active. For some of them, I set up their web browser in a sandbox (http://www.sandboxie.com/) so that any potential malware infection isn't taking the whole system down. In one case, a less than smart secretary, I even have her email program sandboxed...

As for AntiVir, I did not have the greatest experience with it. It might be different for someone located in Europe, but for me AVast! and AVG (in that order currently) do their job just fine, with fairly little influence on the system performance....

Ralf

[CommonTater]

Than you are either extremely fortunate or rarely online....

Neither.... Just careful ... I don't randomly "surf the web"... I go where I go for a reason and I never click on ads. When installing software, anything that wants to put in a toolbar or offers me some grand thing or another is immediately turfed.  But mostly I apply common sense... It's the old saying: "If it sounds too good to be true, it probably is."

As for AntiVir, I did not have the greatest experience with it. It might be different for someone located in Europe, but for me AVast! and AVG (in that order currently) do their job just fine, with fairly little influence on the system performance....

Of those two I'd suggest Avast .... 

[Bitbeisser]

Than you are either extremely fortunate or rarely online....

Neither.... Just careful ... I don't randomly "surf the web"... I go where I go for a reason and I never click on ads. When installing software, anything that wants to put in a toolbar or offers me some grand thing or another is immediately turfed.  But mostly I apply common sense... It's the old saying: "If it sounds too good to be true, it probably is."

The issue is that nowadays, you do not even have to actively "click on any link/ads" anymore.
I watched one client's 14 year old granddaughter browse to a web site for school research, which she apparently did before a couple of times and each time caught a nasty "faked anti-virus" virus.
She did nothing more than go to the main URL she was given by her teacher and within a split second, a minutes earlier updates AVast! threw a red flag alert.
Turned out that on that web site there was a graphic loaded, which by itself was linked from another (original) site, not any ad or something like this by a long shot. And that on that second site, the graphic file itself had been highjacked and "laced" with some executable code which in turn loaded that trojan without anyone noticing.
The web admin of that second site wasn't aware of anything amiss until I notified him and he fixed the issue (and likely a lot more on his site) pretty quickly, but there wasn't anything that your "common sense" (which I am aware is a rare commodity these days) would have prevented from happening...

Ralf

[Stefan Pendl]

Surfing the net is like having sex, even if you really know your partner, you should wear a condom.
Everyone can get infected in so many different ways, where most are not even known.

Have a router as your first barrier against intruders and AV software as your second defense.
The router will block many things, but some will slip through, so you will need a final curtain.

I have had quite some brands of AV software, free and paid, some of them are mentioned here.
I kicked McAffee, BitDefender, Avast, AVG, AntiVir, just to name some and am now using Microsoft Security Essentials, due to its small footprint.
In addition I never used Norton due to its heavy load and the competition between virus writers to beat it.

BTW, AntiVir is known for its huge amount of false positives and the lack of working them out painlessly.

[agp]

BTW, AntiVir is known for its huge amount of false positives and the lack of working them out painlessly.

That's not my personal experience.  I use AntiVir now for several years (used it under Win98, W2k, XP) and tried out other virus scanners like avg. They all had their quirks. Worst of them was the Norton package. Normally false positives isn't a problem on Avira since the manufacturer's signature files in this regard quickly adapts.

I also think, if we are talking about pelles c in general, it is not only a problem of a specific virusscanner. I tried an older version of pelles c v5 and v6. As a result of compiling a simple hello world wizard console app I get

v5 : more than 15 virus warnings from virustotal
v6: about 7 virus warnings

across all known av scanner. I must say, I know of no other software that shows such effects (I had once some virus issues with masm32 and other asm tools with whom I played around but I think for assembler this isn't so unusual). This issue cannot only be adressed to the AV vendors. Please don't missunderstand me (and my poor english ), i really like this peace of software and pelle did a great job to develop such a useful IDE. But if I would create such a complex software system like a compiler etc. (that goes beyond my capabilities significantly  ), I strongly had an personal interest that my software does not confuse others with virus warnings. In this regard has v7 in comparison to older versions perceptibly improved. But there are still false alarms on well known AV scanners like Avira Free Antivirus and I think it should be investigated.

Are there really no one out who at least once could confirm the problem? I can't believe it that I'm the only guy whom concerns this.

Maybe Console Apps are out of date ..

[Bitbeisser]

Are there really no one out who at least once could confirm the problem? I can't believe it that I'm the only guy whom concerns this.

Maybe Console Apps are out of date ..

Most of what I do with Pelle's C are in fact console apps and I don't get any false positives at all, as mentioned using AVast and AVG on my own PCs, in addition to ESet and MSE on some of my clients hosts...

Worst case scenario is on one of my own hosts, which I mainly use to test software (my own and stuff I am trying out for clients) and that has AVast! set with a default sandbox mode for unknown executables. No further problem once I confirm if I either want to run a program in sandboxed or normal mode...

Ralf

[agp]

#include <stdio.h>
int main(int argc, char *argv[])
{
    printf("Hello, world!\n");
    return 0;
}

Pelles C v6.00.4 (6.0)

1. Full Debug Info

virustotal Detection ratio:    7 / 46
AntiVir    TR/Fraud.Gen7
BitDefender    Gen:Variant.Graftor.39411
Emsisoft    Gen:Variant.Graftor.39411 (B)
F-Secure    Gen:Variant.Graftor.39411
GData    Gen:Variant.Graftor.39411
Ikarus    Backdoor.Win32.Poison
Jiangmin    Backdoor/Poison.vpe

2. compiled with multithreaded lib
virustotal Detection ratio:    1 / 46
AntiVir    TR/Fraud.Gen7

Pelles C v7.00.355 (7.0)

3. None Debug Info

virustotal Detection ratio:    3 / 46
DrWeb    BackDoor.Poison.13979
Ikarus    Backdoor.Win32.Poison
Jiangmin    Backdoor/Poison.ydu

4. Full Debug Info

virustotal    Detection ratio:    2 / 46
AntiVir    TR/Fraud.Gen7
Ikarus    Backdoor.Win32.Poison

5. compiled with multithreaded lib

virustotal   Detection ratio:    1 / 46
Ikarus    Backdoor.Win32.Poison


and just for fun downloaded actual lcc-win32 and compiled the hello world sample

full debug info (as default)

virus Detection ratio:    9 / 46
BitDefender    Gen:Variant.Graftor.Elzob.16145
Commtouch    W32/Rbot.K.gen!Eldorado
F-Prot    W32/Rbot.K.gen!Eldorado
F-Secure    Gen:Variant.Graftor.Elzob.16145
GData    Gen:Variant.Graftor.Elzob.16145
Ikarus    Trojan-Spy.Win32.KeyLogger
Jiangmin    TrojanSpy.KeyLogger.cvgg
K7AntiVirus    Backdoor
McAfee-GW-Edition    Heuristic.LooksLike.Win32.Suspicious.J!80

and the "winner" is lcc-win32 

Note the difference between single-threaded to multi-threaded compilation in Pelles C !!