Results 1 to 11 of 11

Thread: Bazaar behavior

  1. #1

    Thread Starter
    Addicted Member Gymbo's Avatar
    Join Date
    Jan 2006
    Location
    The Oregon Coast
    Posts
    202

    Bazaar behavior

    I have several programs that after running, they open another piece of software, I decided to modify these programs to open a calculator program before performing its duties. The first one I modified worked as expected, the next one works fine when run from the IDE, but when compiled and I click on the .exe file, the .exe file is deleted! Just tried it with a third program and it did the same thing, works fine in IDE, deletes itself when run from the .exe file. The added code is in red.

    Code:
    Option Explicit
    
    Private Declare Function ShellExecute Lib "shell32.dll" Alias "ShellExecuteA" _
        (ByVal hWnd As Long, ByVal lpOperation As String, ByVal lpFile As String, _
        ByVal lpParameters As String, ByVal lpDirectory As String, _
        ByVal nShowCmd As Long) As Long
    Private Const SW_SHOWMAXIMIZED = 3
    Private Const SW_SHOWNORMAL = 1
    .
    .
    .
    sFileSpec = "C:\Program Files (x86)\J. A. Associates\RPN Engineering Calculator\rpn.exe"
    
    R = True
    
    GoSub DoIt
    
    R = False
    
    sFileSpec = "D:\Documents\DesignCAD\Drawings\Puzzles\star13puzzle.dcd"
    .
    .
    .
    DoIt:
    
    rtn = ShellExecute(0, "Open", sFileSpec, vbNullString, vbNullString, SW_SHOWNORMAL)
    
    If R = True Then Return
    
    The only other thing that has changed is I added the "MouseWheel Fix", which was added before modifying the first program.

  2. #2
    PowerPoster
    Join Date
    Nov 2017
    Posts
    3,116

    Re: Bazaar behavior

    Sounds like AV is thinking your exe file is malicious for some reason and is deleting the exe file.

  3. #3

    Thread Starter
    Addicted Member Gymbo's Avatar
    Join Date
    Jan 2006
    Location
    The Oregon Coast
    Posts
    202

    Re: Bazaar behavior

    Not sure what AV is, why would the first one work, the added code is exactly the same.

  4. #4
    PowerPoster
    Join Date
    Nov 2017
    Posts
    3,116

    Re: Bazaar behavior

    AV = AntiVirus

    It is possible that increasing the number of external processes spawned by your program moved it into a "potentially malicious" category.

    Good luck.

  5. #5
    PowerPoster
    Join Date
    Feb 2012
    Location
    West Virginia
    Posts
    14,205

    Re: Bazaar behavior

    That code looks very strange. Been probably 20 years or more since I saw anyone use a gosub in code. and in this case it is adding more code with no real value.

    The code below would do the same thing without that ugly gosub and extra lines of code.
    Code:
    sFileSpec = "C:\Program Files (x86)\J. A. Associates\RPN Engineering Calculator\rpn.exe"
    rtn = ShellExecute(0, "Open", sFileSpec, vbNullString, vbNullString, SW_SHOWNORMAL)
    sFileSpec = "D:\Documents\DesignCAD\Drawings\Puzzles\star13puzzle.dcd"
    rtn = ShellExecute(0, "Open", sFileSpec, vbNullString, vbNullString, SW_SHOWNORMAL)
    Or better yet you could get rid of that filespec variable and just have the two shellexecute lines as that is all that is needed.

  6. #6

    Thread Starter
    Addicted Member Gymbo's Avatar
    Join Date
    Jan 2006
    Location
    The Oregon Coast
    Posts
    202

    Re: Bazaar behavior

    Quote Originally Posted by OptionBase1 View Post
    AV = AntiVirus

    It is possible that increasing the number of external processes spawned by your program moved it into a "potentially malicious" category.

    Good luck.
    Thanks, that's it, Malwarebytes got it, the trial is over tomorrow so it can wait.

  7. #7
    PowerPoster
    Join Date
    Nov 2017
    Posts
    3,116

    Re: Bazaar behavior

    Quote Originally Posted by Gymbo View Post
    Thanks, that's it, Malwarebytes got it, the trial is over tomorrow so it can wait.
    Glad you tracked it down. I think with all of the recent high profile RansomWare attacks, anti-virus companies are updating their definitions/scanning to be super aggressive with trying to prevent such attacks, with the not-surprising outcome that false-positives will also increase, like in your case.

    Good luck.

  8. #8

    Thread Starter
    Addicted Member Gymbo's Avatar
    Join Date
    Jan 2006
    Location
    The Oregon Coast
    Posts
    202

    Re: Bazaar behavior

    I agree, but it would be nice if they mentioned what they were doing instead of just deleting the file.

  9. #9
    PowerPoster yereverluvinuncleber's Avatar
    Join Date
    Feb 2014
    Location
    Norfolk UK (inbred)
    Posts
    2,235

    Re: Bazaar behavior

    Bizarre being in a bazaar, but barely bizarre beyond a bazaar. Bizarre eh?

    Does anyone want to buy this gourd? It's worth at least three shekels!

  10. #10
    PowerPoster
    Join Date
    Feb 2006
    Posts
    24,482

    Re: Bazaar behavior

    I was expecting Indiana Jones toppling over large baskets in search of a girl.

  11. #11
    PowerPoster SamOscarBrown's Avatar
    Join Date
    Aug 2012
    Location
    NC, USA
    Posts
    9,145

    Re: Bazaar behavior

    Wait for it Dile...#5!
    Sam I am (as well as Confused at times).

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width