I just downloaded and installed InstallFSharp-1.9.3.14.msi and my AVG anti-virus reports that fsyacc.exe, fslex.exe and fsc.exe are all infected with Downloader.Swizzor. I'm running "Spybot - Search & Destroy" and "Ad-Aware" to see if I can verify. Anyone else seeing this?

By on 1/28/2008 7:42 PM ()

Cutrona, you're not going crazy -- I noticed this on my laptop last night and was going to post something about this today.

There must be a problem with AVG's virus fingerprinting because it tagged 3 F# binaries on my machine as having Downloader.Swizzor: fslex.exe, fsc.exe, and fsyacc.exe. AVG also quarantined them.

Seeing that I'm using the Grisoft "Free" version, I doubt that there's any recourse that I have. It won't even let me configure when it downloads updates. Not quite sure what to do except get rid of AVG...

-Matt

By on 1/29/2008 4:07 AM ()

Can you check if your binaries have been modified?

The original binaries are digitally signed with a Microsoft certificate. You can check the signatures under the file "properties" and "Digital Signatures" tab. Are your files signed?

Also, the relevant md5sums for 1.9.3.14 binaries are:

4bec4c99d6607d00a8f69ea0e2499047 *fsc.exe
69eee75147c1b970a8c6470b0f9531ee *fslex.exe
c02f63398173a8c76db0dd4e82ec7875 *fsyacc.exe

James.

By on 1/29/2008 5:51 AM ()

Hi James,

Nope, the binaries have not been modified. Once I unquarantined the files from AVG (right click -> Restore... for those running AVG), I checked the digital signatures.

They were all digitally signed by Microsoft Corporation on Friday, January 18, 2008 around 11:41 AM

My MD5 sums match exactly with the ones you listed.

Looks like AVG is detecting a false positive. Thanks for looking into that James.

-Matt

By on 1/29/2008 6:27 AM ()

Looks like AVG is detecting a false positive.

We've contacted AVG on this issue and these false positives will be fixed in next today's update

thanks,
Mike

By on 1/29/2008 6:54 AM ()

Fantastic :) That really was a fast response time.

After AVG started causing all kinds of weird problems with Visual Studio when working with Silverlight apps ("oh! ha! a Javascript file! NOOO that must be BLOCKED!"), I've pretty much taken anything it says with a grain of salt and didn't even consider that fsc/fsyacc/fslex were "infected". Still a pain when those files were completely moved somewhere else (the quarantine), though.

By on 1/29/2008 7:06 AM ()

I personally use Avast! at home. I didn't know Grisoft was so popular.

If I see anything when I install at home I will be sure to report.

By on 1/29/2008 7:51 AM ()

Thanks to all who responded so quickly and so thoroughly. I just downloaded the AVG update, restored the three f# executables and rescanned. No problem reported.

By on 1/29/2008 8:39 AM ()

F# releases are virus scanned using internal tools before release. 1.9.3.14 scanned clean:

JobID: 1754593

Desc: F# 1.9.3.14 dublin

The above job has scanned clean.

Following your post, the msi and the installed bin directory have been scanned with an up to date version of AVG - and it did not report any threats.

James.

F# Team.

By on 1/29/2008 2:27 AM ()

You got me scared...

... but virustotal.com doesn't report any viruses for the fsc.exe and fsyacc.exe from the 1.9.3.14 distribution that I downloaded some days ago:
[link:www.virustotal.com]
[link:www.virustotal.com]

It seems likely that your system is infected with some virus, but not the original F# distribution.

Stephan

By on 1/29/2008 12:30 AM ()

Whoops, looks like I beat Don to the punch :)

Here's more details about the latest release:

[link:blogs.msdn.com]

Nice work!

I've noticed that this version fixes the bug where there is a "pure virtual function call" when closing down Visual Studio 2008.

By on 1/25/2008 5:48 AM ()

> I've noticed that this version fixes the bug where there is a "pure virtual function call"
> when closing down Visual Studio 2008.

Oh good. It's definitely a happy morning. :-)

By on 1/25/2008 5:59 AM ()

Hi guys,

We didn't do anything specific to fix this bug (which I do occasionally see, but only very occasionally). So it' spossible it will reappear.

The code responsible is gogint to be thrown away as part of our maange-code rewrite of the language service, currently in progress. So if it comes back we'll have to ask you to bear with us.

Thanks

don

By on 1/26/2008 3:48 AM ()
IntelliFactory Offices Copyright (c) 2011-2012 IntelliFactory. All rights reserved.
Home | Products | Consulting | Trainings | Blogs | Jobs | Contact Us | Terms of Use | Privacy Policy | Cookie Policy
Built with WebSharper