Printable View
Norton prevented stdrt.exe from install on my friends computer. "My norton anti-virus software did not like stdrt.exe and deleted it as soon as I tried to activate the program."
I have the recent mmf2dev 251 and comodo virus signatures and it picked up: Multimedia Fusion Developer 2\Extensions\kcmouse.mfx.
I did report it as false positive.
Any antivirus that deletes a user's file before it asks the user if it's okay is a bad antivirus.
Thank you!Quote:
I did report it as false positive.
Since false positives with certain files seems a common problem i am just wondering, would it be possible to maybe allow the user to rename the stdrt.exe before build?
So rather than having stdrt.exe you could have myappsdata.exe etc. Then if there are people making apps that do bad things which the anti-virus apps don't like it would be more likely to focus on that rather than all of the apps made with MMF2.
Maybe a similar things for .mfx where it randomizes the id/name/memory use some way so if you used kcmouse.mfx it would be abc123.mfx etc and less likely detect any apps using the mouse object as having a included virus.
It doesn't go off the name...
(in fact random names are often considered to be a sign that the file is a virus)
It's always been annoying knowing i should avoid certain extensions like kcmouse.mfx when someone says that it's reporting them as a virus.
Even if something is a false positive, to a customer/player unless they trust you then it will just put them off, it can even give other games/software made a bad name also.
I don't know if it's possible to avoid this but i hope for MMF3 there is a better method so there will be less false positives for games/apps.
It would still be nice to be able to rename the stdrt.exe to have a custom name anyway also.
I had this issue as well stdrt.exe and kcmouse.mfx.
i had to contact norton via HELP to add the files to the exclusions.
basicly they added mmf2 program files and extensions to both of the exclusions, but even he had trouble getting it.
You would think they would know after helping so many people to make it safe on their data base.
I reported both to them as NOT a virus.
It is disheartening after spending 8 long months on a commercial project, only to wonder if it may or may not be trustworthy to some customer's anti-virus program. A few bad apples can ruin the hole barrel of apples.
Anti-virus programs are really getting sensitive. They pay more attention to the bigger companies, and people don't always update their signatures, they turn auto update off.
There has to be some way, because I really enjoy mmf and would hate to see it loose to this false positive virus battle. I sure it can be achieved, I just don't know how.
I also wish Anti-virus companies would do a better job.
Its odd how some people will think an anti-virus word is gold yet they don't feel the need to ever update it to make sure they are using the most current definitions.
I once talked to a lawyer about anti-virus companies repeatedly detecting false positives, he said us and developers using the products affected by their negligence would have a pretty good lawsuit.
I can remember when i first used MMF2 i thought stdrt.exe was some sort of virus when i noticed it running in task manager. I had to search online and after a while found out it was a MMF2 thing because i was not sure what it was. I have yet to have it show as a virus but i am guessing people that play MMF2 made games might wonder what it is also so a way to rename it would be useful.
I have just asked Yves if there could be a option to rename it so you could name it like the game/app and people would always know what it was. Hopefully it is possible to do and can be added as a option.
Jeff, maybe sign stdrt.exe containing part or all of the mmf purchased serial number (encrypted), thus it can be tracked back to the culprit who misuses mmf (in part). I'm only guessing, but I think people report stdrt.exe as a virus or as suspicious behavior because of misuse or poor programming.
Maybe include a fail safe which always enables the escape key for desktops with a popup, preventing complete lockouts from those pesky full screen apps with no menu.
The idea like Atom mentioned separation, and then also include additional prevention, and then virus free reputation follows.
Just some thoughts!
Well you can disable it by changing the Compress the runtime setting however i don't know how much difference it makes.
As i say though being able to customize the name would be good as it lets the user know it's part of the game/app rather than something else. There are also various other compression algorithms that could be used like UPX compression that don't run separately to the app.
Renaming the stdrt.exe would be great.
Yves said it creates ton of false positives and tehy removed it from Install Creator due to this reason.Quote:
Originally Posted by Atom
Yeah i just read, it is a good compression method though and also a very popular and well known one. He also says "original runtimes of Install Creator" though so not in MMF2 and also UPX is always being updated so it might have been a much older version that was used.Quote:
Originally Posted by Jacob
When i have used it before there has never been any problems though and i have also seen it built into other apps and never seen many issues reported. If the compression method remains the same though as i said before just the option to rename the extra exe would be great.
Anti virus is a joke, you can only address viruses you know about and if 1% of the myspace, u-tube, and other social network users were 13 year old virus writers learning to write viruses how can anyone keep up with that. Because of that there is a ton of generalization done by anti-virus software and that is what jacks all developers, not just MMF developers.
Lets evaluate Anit-Virus. You install it to protect you from programs on your computer (viruses) that will take up hard drive space, as they run in the background they take up processor time, and they replicate themselves or send data over the Internet taking up your bandwidth.
What is Anti-Virus. A program that sits on your hard drive taking up your hard drive space, runs in the background taking your processor time and updates itself over the Internet taking up your bandwidth.
While no virus protection is not a good choice, you can not look at anyone but the virus companies for the false positives. I recently just lost 3 months worth of backed up data (external drive) because of a new network AV program. It thought one of my MMF object was a virus, but it was in a Zip/Rar file (several) and the AV trashed all the Zip/Rar files "fixing" the virus. Back to backing up on optical media, AV cant remove that.
Well my 2 cents anyway.
K
No matter how many times I try to restore kcmouse.mfx , Norton removes it automatically and classes it as a trojen.gen.
Okay, my friend whose norton prevented running my app did have his norton set to auto updates (he had the most recent signatures). I gave him another version of my program without the "Compress the runtime" being checked.
My program installed and worked prefect, without any issues from norton, Yeah!
Does the added 300K at runtime make that much of a difference with todays computers?
I don't think 330K is anything these days.
That was why i suggested UPX compression instead which can have 50%+ reduction of the original exe size and is also multi-platform, not a separate exe and a open source project.Quote:
Originally Posted by The_Geohound
I haven't done a load of comparison tests of anything but if in general it only gets about 330K reduction then there doesn't seem much point in stdrt.exe anyway. Also if it is now being detected as a virus a lot it might as well just be removed as there is not much point.
Is Norton doing this now with a current update/version or only the old version?
It's still doing it. I have Norton 360 installed with the latest updates.
Ah thats great -- I wonder how many times we need to tell them about the problem.
Just get every CT user to send them a message about it, it'll be more efficent ;)
I am sure that it has been posted in the past but if I had a link to click on I would let Symantec know how I feel! :whistle:
After about two decades of being a Nortons user, I am no longer one because of this. When my subscription came up for renewal last November, I moved all the house computers over to Eset NOD32 Antivirus. It does all ths stuff Notons did, and it hasn't caused me one bother. Well, the first time I lauched MMF it did nap one of the extensions, the Quicktime one I think, but I told it it was not infected and no issues since.
I informed Symantic of the Nortons issue with MMF LOADS OF TIMES and the issue went unresolved so after a lifetime of PC use as a Nortons user, I finally moved away and haven't looked back since.
Norton tells me that the stdrt.exe file is a risk. Does this mean that everyone who uses my software can't run it on a norton protected system???? If yes, this is catastrophic! How can I work around this?
Tom
Yell at Norton everyday until they get the hint and fix it?
I tried that for a long time. Kept getting the Nortons stardard reply...Quote:
Originally Posted by StephenL
"Thanks very much...
It will be resolved in 24 hours..."
It never got resolved, hence I moved. And I created this video to show folks running Nortons Antivirus software that my software is not a risk, it's a false positive.
http://www.youtube.com/watch?v=Gvs4iW5P1nw
Uncheck the "Compress the runtime" option in the properties of the application.Quote:
How can I work around this?
PS: that's weird though, I can't reproduce the problem at all with the stdrt.exe of the build 251 of MMF2 Dev, Norton doesn't report any warning on virustotal.com. twister maybe the application was built with an older version of MMF2?
Yves, you could be correct. I don't remember when I updated to 251. It was close.
Give me a few days to test and repost. I'll rebuild my app using 251 as a different version with "Compress the runtime" checked, and have my friend install it to see if it repeats.
I haven't updated to 251 either, I'm still on 249. I had to go through a lengthy process of adding stdrt.exe to its list of exclusions, which was not particularly easy to find.
The numbers of people who would have released their application would be in their gazillions (maybe), and unwittingly have compressed the application down. Many won't even see this thread. Users downloading the application would then think "hey, this can't be trusted, let's delete it".
Norton are slacking big time.
Yves, norton is catching the mmf2 Dev 251 test build with a checked stdrt.exe "Compress the runtime". A unchecked 251 build runs fine without norton catching stdrt.exe. I'm guessing that the stdrt.exe is not used in the unchecked build, therefore it's not there for norton to catch it.
ChrisStreet, the frustration is shared. I rebuilt my older apps in 251 unchecking the "Compress..". But all the past downloads are unknown.
Edit: P.S. I am sure the original norton catch was from 249 because I updated thinking 251 resolved it. The second build was with 251 with "Compress..." unchecked (to be safe). The third test was with 251 "Compress.." checked.
Honestly guys I'm tired of people saying Norton deletes stdrt.exe although it doesn't generate any alarm on virustotal, that's frustrating.
It must not happen with every installation of Norton, because given the number of Norton users we would be flooded with messages if this was happening with all the applications created with MMF2...
twister, please tell your friend to submit the file to Norton. I've already submitted it to them some time ago as someone else reported it too, but I didn't get any answer from them and anyway as I can't reproduce it I can't tell them what happens...
And could any Norton user that sees this post scan the Data\runtime folder of MMF2 and if a false positive is detected submit the file to Symantec, please? And post here "yes I use Norton and I can reproduce the problem" or "no, I use Norton and I can't reproduce the problem". Thanks!
I've had this problem at one point. But I no longer have Norton...
Yves I can understand and I'm sure this will be fixed one way or the other. You guys are great and I really enjoy using mmf. I remember Amos and Stos.
My friend is very strict when it comes to things like this unless he is absolutely sure, so I don't know if he will report it as false. I trust his home computer and judgment because he is the back end programmer for Nintendo, not a gamer. His home computer is connected to them and must pass their international security scrutiny which he programs. I am only telling you this to understand why I trust him and his computer.
Perhaps he is overkill. Maybe norton has different security level setting and scans.
Edit
P.S. The app in question that started this post is here at www.fishraptor.com. Only to give roots to this post.
Edit2
I trust mmf and designers as well :) and there was no intentional name dropping.
Hi Yves.
I can confirm that this issue happened on four different computers running Nortons software, from the Antivirus to the full 360 Internet Security pack. I posted my files to Nortons loads of time, I always got the standard email reply saying yes, it is a false positive, and it would be resolved in 24 hours. It never got resolved. Once my subscription with Nortons Antivirus expired, I moved over to Esat NOD32 and haven't had any bother since.
I am very disappointed with Symantic over this because they are a huge name in the antivirus world and I would have thought they would have addressed this within the four months odd I had between encountering the issue and my subscription expiring. I don't have Nortons installed any more but the next time I'm at a friends house who has the software on their computer, I'll check it out again and see if it's still happening.
Having being with Nortons since the days of DOS I had a lot of respect for this company and its sortware. I lost that very fast over this issue and I no longer recommend this software when folks ask me.
what does humble pie taste like?
Thank you Paul! I'm more interested in real tests from current Norton users who use the latest version though.
I agree with what you say. Symantec don't care. ESET or Kaspersky reacts in a couple of hours when you send them a false positive, plus they say they are sorry, that's almost a pleasure to submit them a false positive because you know they listen their customers or the other companies and react very quickly. I used Norton too, but now I recommend people not using Norton nowadays.
But that's not the point of the post. Please any current Norton user tell us if you experience the same issue with the latest virus definitions, and if so please submit the file to Symantec, thanks!