topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Thursday March 28, 2024, 8:08 am
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: ThreatFire Antivirus can cause data loss in fSekrit.exe data  (Read 11644 times)

sinum

  • Charter Member
  • Joined in 2006
  • ***
  • Posts: 12
    • View Profile
    • Donate to Member
Before some weeks I try ThreatFire Antivirus ( http://www.threatfire.com ). I change some text within fSekrit and save, I answer all secure Popups from ThreatFire with yes to allow the modifications and end with an empty fSekrit.exe, all data was lost.

So if you use ThreatFire and fSekrit make sure you have a Backup of the fSekrit file, i was very lucky as i found a Backup. :)
.sinum.

f0dder

  • Moderator
  • Joined in 2005
  • *****
  • Posts: 9,153
  • [Well, THAT escalated quickly!]
    • View Profile
    • f0dder's place
    • Read more about this member.
    • Donate to Member
Re: ThreatFire Antivirus can cause data loss in fSekrit.exe data
« Reply #1 on: August 30, 2009, 01:49 PM »
Thanks for the heads-up :)

It's understandable that threatfire balks at fSekrit, since writing to executable files can be seen as pretty darn suspicious. But that it causes it to lose data, even though you answer yes to the modification attempt? That's plain old nasty! :down:

Sounds like I need to review the file save code though, there might be some corner cases where I don't detect an error; on errors, fSekrit definitely shouldn't think it has saved the file properly and thus allow the user to discard modification.
- carpe noctem

sinum

  • Charter Member
  • Joined in 2006
  • ***
  • Posts: 12
    • View Profile
    • Donate to Member
Re: ThreatFire Antivirus can cause data loss in fSekrit.exe data
« Reply #2 on: September 01, 2009, 06:07 PM »
Sounds like I need to review the file save code though, there might be some corner cases where I don't detect an error; on errors, fSekrit definitely shouldn't think it has saved the file properly and thus allow the user to discard modification.
OK, I install ThreatFire on my netbook with default Config and test it again. ThreatFire don't pop up any notes! fSekrit pop up 2 times, "Error saving file" and end up with no data and no password! fSekrit Version is 1.35, ThreatFire Version is 4.5.0.24 (Free)

Crazy, I never had problems with other Antivirus Software.
.sinum.
« Last Edit: September 01, 2009, 06:56 PM by sinum »

f0dder

  • Moderator
  • Joined in 2005
  • *****
  • Posts: 9,153
  • [Well, THAT escalated quickly!]
    • View Profile
    • f0dder's place
    • Read more about this member.
    • Donate to Member
Re: ThreatFire Antivirus can cause data loss in fSekrit.exe data
« Reply #3 on: October 07, 2009, 02:14 PM »
Just verified this with XP+SP2 32bit in VMWare, fSekrit 1.35 (official release version), and ThreatFire 4.6.0.

When trying to do a regular save, I get three pop-ups from TF where I choose "allow" (without "remember") - and then I get two popups from fSekrit with error messages. When I terminate fSekrit and say yes to save changes, the same thing happens - except that fSekrit ignores the error status and exits! Whoops, that's a "small bit" of program logic error there :-[ :-[ :-[ :-[ :-[ :-[ :-[ :-[ :-[ :-[ :-[ :o

It's still pretty weird that TF fscks up the save process when actually allowing the operation to happen!

Anyway, I've finally gotten around to adding way more robust saving code to fSekrit (save to tempfile, delete existing file, rename tempfile) which has the added benefit of shutting up TF warnings. I'll hunt down the flawed program logic that allows you to exit with unsaved changes, then I'll upload a beta version. I'm really sorry for having such serious flaws lying around for so long :(
- carpe noctem

f0dder

  • Moderator
  • Joined in 2005
  • *****
  • Posts: 9,153
  • [Well, THAT escalated quickly!]
    • View Profile
    • f0dder's place
    • Read more about this member.
    • Donate to Member
Re: ThreatFire Antivirus can cause data loss in fSekrit.exe data
« Reply #4 on: October 07, 2009, 02:43 PM »
OK, here we go - both bugs should be fixed. Please run through some heavy testing :)

Check this thread for the new beta version, and post replies about the beta there please :)

(other ThreatFire issues are welcome in this thread, though).
- carpe noctem

sinum

  • Charter Member
  • Joined in 2006
  • ***
  • Posts: 12
    • View Profile
    • Donate to Member
Re: ThreatFire Antivirus can cause data loss in fSekrit.exe data
« Reply #5 on: October 31, 2009, 09:07 AM »
Sorry for my late response and thanks for the new beta,

I agree, TF should not block anything when someone click "allow". I'm sure fSekrit data is a lot better protected with your new beta code and it should also prevent data loss with other Antivirus Software.
.sinum.