GearHeads Corner

I find that of most of them now, virus scanners seem to simply say " I havent seen that often enough, so its a virus.". Its getting
to a ridiculous level. Ironically its happening as it gets harder and harder to actually get a virus due to Windows security. Most of
them have gone down the "heuristic" road where they guess if its a virus or not..which of course leads to the "better safe than
sorry" way they decalre something off limits now.
  I use Microsofts protection.. never seem to get trouble, but then Im pretty carefull as to what I open..

Art

Like I said before most virus authors depend on people not being attentive. You know the I am assuszuu the clever my uncle died last year leaving me millions, I need help to get my millions out of the country for this help I will give you half of my fortune my 4 wives and 20 children, please click on this link to help.

Nothing will jump out and attack you until you press the "I wonder what this does" button.

Many years ago and I do mean many... I was asked when commissioning a network, which was the best virus protection and anti hack system I could recommend.

I still contend to this day you can't beat this system.

No floppy access, no usb access no network access offline operation only.

But wheres the fun in that.

Stojan wrote:I am assuszuu the clever my uncle died last year leaving me millions, I need help to get my millions out of the country for this help I will give you half of my fortune my 4 wives and 20 children, please click on this link to help.

Can I skip the wives and get my pick of the kids?  If so, count me in...

Interesting article (put on your tinfoil had first) that towards the bottom discusses how the CIA reportedly exploits virus scanners.  Perhaps Art could pick up some tricks to get rid of the annoying false alarms.

Kirk

As the saying goes of course they do, if not them it's someone else, A lot of people forget how WW2 was won.

Over here they say what they do and no one realy cares.

DanL wrote: As the saying goes of course they do, if not them it's someone else, A lot of people forget how WW2 was won.

Over here they say what they do and no one realy cares.

Just read the article, no surprises there really. Being the insignificant peon that I am I have nothing to worry about. Apart from my making the Obituary one day, that's about all the fame I will have in newspaper appearances.

But we the people voted and we the people allow them to do so.

If they did not and if they could do it but just did not do it and something bad happened they will get their arse handed to them, Me I hope they do it.

Argg, WinHozed.  I run the latest stable version of Windows Insider Preview on my laptop, early test for work back when I cared about such things.  The latest version has pronounced GearoticSETUP2.exe a deadly virus that will destroy humanity as we know it.  Chrome and M$ Edge refuse to download it while Firefox will download but w$ won't allow me to run it; I'll set an exception for the downloaded file and try again.

While I have Vexx 2.23 it was getting confused while I was trying celtic knots and thought I'd try a refresh before complaining.  Now the Gatesian fortune generator is demonstrating it's evil empire aspect.  Unless it really contains spursint.f!cl, but I really doubt it.  It's a common complaint generated by their artificial unintelligencent cloudy scanner, were I cynical I'd say it's an attempt to fill the M$ coffers with their digital signing package.

Trojan:Win32/Spursint.F!cl

Kirk

After whitelisting it in WinHose Defiler all I got was the usual we're all gonna die if you run this, run anyway worked fine.&nbsp; <sigh>

I did click the wrong download button the first time, the current development file is GearoticSetup, no 2

Kirk

Incidentally, I just (literally right now) got a Windows Security warning saying:

Threat detected: Trojan:Win32/Spursint.F!cl
Alert level: Severe
Category: Trojan
Details: This program is dangerous and executes commands from an attacker.
file: C:\Users\[username]\Downloads\GearoticSETUP2.exe

...anyway, I'm unconcerned, but figured I'd post the note here in case others get similar messages and freak out or something (this warning appears to come from the MS "cloud analysis" security system).

Oh, and I forgot to note: anyone getting this same message will probably need to remove the file from quarantine.

I really hate those virus AI sensors...

Art

And they make it really hard for developers, particularly if you want to support anything before Windows 8.&nbsp; You can make a private cert according to the directions, for "local deployment only" - whatever that means.&nbsp; However they say you can't deploy signed apps except on Win8 and up.

Makes me really glad I retired...

Kirk

Art

The Windows 10 virus scanner seems to have the mistaken view that CoInstall.exe and GearoticsSETUP.exe contain viruses.&nbsp; The error in particular is "severe"&nbsp; Trojan:Win32/Spursint.F!cl

There is apparently some characteristic in the executable files that makes Windows think that the .exe files contains the Trojan virus.

In the past I've been able to simply ignore the virus scanner warnings.&nbsp; While trying to eliminate a problem with the most current version of Vexx (missing msvcr120D DLL error) I ran&nbsp; across another annoying Win10 "feature"

I tried copying the CoInstall and GearoticsSETUP exe files to a backup folder&nbsp; and the files disappeared.&nbsp; I tracked this issue down to the Virus scanner & the erroneous Trojan:Win32/Spursint.F!cl detection.&nbsp; I examined the Windows Security Virus protection history where I was able to restore the files and temporarily allow(hence ignore) the Trojan:Win32/Spursint.F!cl detection.

After Gearotics & Vexx were successfully installed using the "stable" version of Gearotics, I re-enabled detection of Trojan:Win32/Spursint.F!cl viruses just in case some other software might really contain that virus

Bill

Bill:

Thanks for the information. Im looking into how to stop these false readings..

Art

Art

I looked up some information about the type of virus warning being triggered.&nbsp; I've tried to make some sense of the types of things Windows is concerned about as described in:
&nbsp; https://www.malware-board.com/blog/remo ... le-process

The name of the file probably has nothing to do with the detection.&nbsp; There is perhaps some sort of windows feature where your programs are calling Windows system functions (probably defined in a windows system .dll file) to execute external .exe files or to get information from&nbsp; memory locations external to the running program.

One example comes to mind: the relationship between Vexx and Gearotics to get a gear from Gearotics, modify it in Vexx and then replace the modified gear back into Gearotics might resemble behaviors similar to the Trojan.

I'm not too familiar with Augie except for the simulation capabilities where pressing CONS button brings up another window.

After I re-enabled detection of&nbsp; Trojan virus as soon as I tried to rename GearoticsSetup.exe to a different name the system&nbsp; once again not only deleted the file I tried to rename but it also deleted the different versions of CoInstall.exe and Gearoitics within the same windows folder.

To say that the virus protection is aggressive would be an understatement.

Bill

It might be simpler than that, the scanners look for "signatures", strings of code that match things found in virii.&nbsp; One of these days they'll start deleting everything that includes the x86 equivalent of x=2+2 after assigning the task to a new junior programmer.

Way back when I ran an email system, the new guy decided to block all email from aol.com (ancient floppy delivery system) because he got a spam email from an aol address.&nbsp; I was out of town for a couple days, came back to a big mess...

Kirk