www.digitalmars.com         C & C++   DMDScript  

digitalmars.D.ide - VisualD.dll flagged during VisualD 0.45.0 installation as Trojan by

reply ShadoLight <ettienne.gilbert gmail.com> writes:
Hi,

For other users of McAfee AV software: Note that, during the 
installation of VisualD 0.45.0, the VisualD.dll is detected as 
GenericRXBS-NK!9A26B67896F trojan by my McAfee AV (Enterprise 
v8.8 in my case).

Since I have been using VisualD (and D) for practically forever I 
am sure this is a false-positive, and caused by McAfee's 
new-fangled 'generically detected malware' algorithm!

I tried using the Quarantine Manager to 'restore' VisualD.dll, 
but this does not work since McAfee does not 'remember' 
previously restored files, and quarantine it every time VS loads 
the DLL.

Since this is a corporate PC I cannot disable McAfee, so this 
even stops me from ZIPping the damn DLL (to email to McAfee for 
analysis).

I'll have to revert to VisualD 0.45.0-rc2 for now, but it would 
be useful if someone can report this according to [1).

[1]: https://kc.mcafee.com/corporate/index?page=content&id=KB85567
Aug 03
next sibling parent reply Rainer Schuetze <r.sagitario gmx.de> writes:
On 03.08.2017 14:00, ShadoLight wrote:
 Hi,
 
 For other users of McAfee AV software: Note that, during the 
 installation of VisualD 0.45.0, the VisualD.dll is detected as 
 GenericRXBS-NK!9A26B67896F trojan by my McAfee AV (Enterprise v8.8 in my 
 case).
 
 Since I have been using VisualD (and D) for practically forever I am 
 sure this is a false-positive, and caused by McAfee's new-fangled 
 'generically detected malware' algorithm!
 
 I tried using the Quarantine Manager to 'restore' VisualD.dll, but this 
 does not work since McAfee does not 'remember' previously restored 
 files, and quarantine it every time VS loads the DLL.
 
 Since this is a corporate PC I cannot disable McAfee, so this even stops 
 me from ZIPping the damn DLL (to email to McAfee for analysis).
 
 I'll have to revert to VisualD 0.45.0-rc2 for now, but it would be 
 useful if someone can report this according to [1).
 
 [1]: https://kc.mcafee.com/corporate/index?page=content&id=KB85567
 
It seems this is getting worse for dmd built executables. VirusTotal also shows the McAfee failures, and 3 other engines complain, too. If I build Visual D against the MS-Runtime instead of the DigitalMars-Runtime, no virus is detected. Unfortunately the DLL grows from 3 MB to 9 MB, which seems to uncover a bug somewheree in the tool chain. That might not be a show stopper, though, and I wanted to switch to the COFF builds eventually anyway. The autotester has also created the same version, maybe it passes McAfee as is: https://ci.appveyor.com/project/rainers/visuald/build/job/2g40k1pgyxg58avv/artifacts It isn't built with the precise GC, though, so it might eat a bit more memory if you edit large files.
Aug 03
parent reply jj <jj aol.com> writes:
On Thursday, 3 August 2017 at 16:58:33 UTC, Rainer Schuetze wrote:
 On 03.08.2017 14:00, ShadoLight wrote:
 [...]
It seems this is getting worse for dmd built executables. VirusTotal also shows the McAfee failures, and 3 other engines complain, too. If I build Visual D against the MS-Runtime instead of the DigitalMars-Runtime, no virus is detected. Unfortunately the DLL grows from 3 MB to 9 MB, which seems to uncover a bug somewheree in the tool chain. That might not be a show stopper, though, and I wanted to switch to the COFF builds eventually anyway. The autotester has also created the same version, maybe it passes McAfee as is: https://ci.appveyor.com/project/rainers/visuald/build/job/2g40k1pgyxg58avv/artifacts It isn't built with the precise GC, though, so it might eat a bit more memory if you edit large files.
it still does not work with my VS 2017. after install it does not show up in the menu, it does not know d. sorry for the bad news.
Aug 03
parent Rainer Schuetze <r.sagitario gmx.de> writes:
On 03.08.2017 19:58, jj wrote:
 On Thursday, 3 August 2017 at 16:58:33 UTC, Rainer Schuetze wrote:
 On 03.08.2017 14:00, ShadoLight wrote:
 [...]
It seems this is getting worse for dmd built executables. VirusTotal also shows the McAfee failures, and 3 other engines complain, too. If I build Visual D against the MS-Runtime instead of the DigitalMars-Runtime, no virus is detected. Unfortunately the DLL grows from 3 MB to 9 MB, which seems to uncover a bug somewheree in the tool chain. That might not be a show stopper, though, and I wanted to switch to the COFF builds eventually anyway. The autotester has also created the same version, maybe it passes McAfee as is: https://ci.appveyor.com/project/rainers/visuald/build/job/2g40k1 gyxg58avv/artifacts It isn't built with the precise GC, though, so it might eat a bit more memory if you edit large files.
it still does not work with my VS 2017. after install it does not show up in the menu, it does not know d. sorry for the bad news.
Sorry to hear that but I didn't really expect any magic solution just from bumping the version number. From your last posted error message, I suspect that the 3 files written by the installer at "c:\Program Files (x86)\Microsoft Visual Studio\2017\Community\Common7\IDE\Extensions\Rainer Schuetze\VisualD\0.45" exist? Maybe there are older files in parallel folders? If yes, try deleting these. VS2017 transfers settings from these extension files into a "private registry" %AppData%\Local\Microsoft\VisualStudio\15.0_ade21380\privateregistry.bin, maybe you can make that file available for download somewhere so I can check whether entries in there look ok. Are you using the english version of VS or some other language? Maybe there is something wrong in how Visual D handles this, but I have seen it working with german versions (though not with VS2017 yet).
Aug 04
prev sibling parent reply Rainer Schuetze <r.sagitario gmx.de> writes:
On 03.08.2017 14:00, ShadoLight wrote:
 Hi,
 
 For other users of McAfee AV software: Note that, during the 
 installation of VisualD 0.45.0, the VisualD.dll is detected as 
 GenericRXBS-NK!9A26B67896F trojan by my McAfee AV (Enterprise v8.8 in my 
 case).
 
 Since I have been using VisualD (and D) for practically forever I am 
 sure this is a false-positive, and caused by McAfee's new-fangled 
 'generically detected malware' algorithm!
 
 I tried using the Quarantine Manager to 'restore' VisualD.dll, but this 
 does not work since McAfee does not 'remember' previously restored 
 files, and quarantine it every time VS loads the DLL.
 
 Since this is a corporate PC I cannot disable McAfee, so this even stops 
 me from ZIPping the damn DLL (to email to McAfee for analysis).
 
 I'll have to revert to VisualD 0.45.0-rc2 for now, but it would be 
 useful if someone can report this according to [1).
 
 [1]: https://kc.mcafee.com/corporate/index?page=content&id=KB85567
 
This seems to pass most anti-virus programs on virustotal: https://github.com/dlang/visuald/releases/tag/v0.45.1-rc1
Aug 06
parent ShadoLight <ettienne.gilbert gmail.com> writes:
On Sunday, 6 August 2017 at 12:03:37 UTC, Rainer Schuetze wrote:
 On 03.08.2017 14:00, ShadoLight wrote:
 [...]
This seems to pass most anti-virus programs on virustotal: https://github.com/dlang/visuald/releases/tag/v0.45.1-rc1
Thanks Rainer, very much appreciated!
Aug 07