Warning ! Trojan in VisualGDB . Projects at risk !

[b.timofte]

After i Installed Cmake and created a new project using cmake as toolchain for Windows i got this antivirus error !

Trojan:Win32/Tiggre!plock

Alert level:Severe

Status:Quarantined

Date:13/02/2018

Recommended action:Remove the threat now.

 

Category:Trojan

Details:This program is dangerous and executes commands from an attacker.

 

file: C:\Users\<censored>\Source\Repos\WindowsProject2\WindowsProject2\VisualGDB\Debug\CMakeFiles\3.10.1\CompilerIdCXX\a.exe

 

Visual Studio 2017 Cmake error

 

Loaded C:\Users\<censored>\Source\Repos\WindowsProject2\WindowsProject2\WindowsProject2.vgdbcmake. Waiting for VS to set the active configuration…
C:\Users\<censored>\Source\Repos\WindowsProject2\WindowsProject2\WindowsProject2.vgdbcmake: active configuration changed to Debug
The C compiler identification is GNU 6.3.0
CMake Error at C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:495 (file):
file STRINGS file
“C:/Users/<censored>/Source/Repos/WindowsProject2/WindowsProject2/VisualGDB/Debug/CMakeFiles/3.10.1/CompilerIdCXX/a.exe”
cannot be read.
Call Stack (most recent call first):
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:37 (CMAKE_DETERMINE_COMPILER_ID_CHECK)
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCXXCompiler.cmake:107 (CMAKE_DETERMINE_COMPILER_ID)
CMakeLists.txt:5 (project)

CMake Error at C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:501 (list):
list sub-command REMOVE_DUPLICATES requires list to be present.
Call Stack (most recent call first):
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:37 (CMAKE_DETERMINE_COMPILER_ID_CHECK)
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCXXCompiler.cmake:107 (CMAKE_DETERMINE_COMPILER_ID)
CMakeLists.txt:5 (project)

CMake Error at C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:567 (file):
file failed to open for reading (Invalid argument):

C:/Users/<censored>/Source/Repos/WindowsProject2/WindowsProject2/VisualGDB/Debug/CMakeFiles/3.10.1/CompilerIdCXX/a.exe
Call Stack (most recent call first):
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:37 (CMAKE_DETERMINE_COMPILER_ID_CHECK)
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCXXCompiler.cmake:107 (CMAKE_DETERMINE_COMPILER_ID)
CMakeLists.txt:5 (project)

CMake Error at C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:569 (string):
string begin index: 1 is out of range 0 – 0
Call Stack (most recent call first):
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:37 (CMAKE_DETERMINE_COMPILER_ID_CHECK)
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCXXCompiler.cmake:107 (CMAKE_DETERMINE_COMPILER_ID)
CMakeLists.txt:5 (project)

CMake Error at C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:577 (math):
math cannot parse the expression: ” * 16 + “: syntax error, unexpected
exp_TIMES, expecting exp_PLUS or exp_MINUS or exp_OPENPARENT or exp_NUMBER
(2)
Call Stack (most recent call first):
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:37 (CMAKE_DETERMINE_COMPILER_ID_CHECK)
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCXXCompiler.cmake:107 (CMAKE_DETERMINE_COMPILER_ID)
CMakeLists.txt:5 (project)

CMake Error at C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:579 (file):
file failed to open for reading (Invalid argument):

C:/Users/<censored>/Source/Repos/WindowsProject2/WindowsProject2/VisualGDB/Debug/CMakeFiles/3.10.1/CompilerIdCXX/a.exe
Call Stack (most recent call first):
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCompilerId.cmake:37 (CMAKE_DETERMINE_COMPILER_ID_CHECK)
C:/Users/<censored>/AppData/Local/VisualGDB/CMake/share/cmake-3.10/Modules/CMakeDetermineCXXCompiler.cmake:107 (CMAKE_DETERMINE_COMPILER_ID)
CMakeLists.txt:5 (project)

The CXX compiler identification is GNU 6.3.0
Check for working C compiler: C:/MinGW/bin/gcc.exe
Check for working C compiler: C:/MinGW/bin/gcc.exe — works
Detecting C compiler ABI info
Detecting C compiler ABI info – done
Detecting C compile features
Detecting C compile features – done
Check for working CXX compiler: C:/MinGW/bin/c++.exe
Check for working CXX compiler: C:/MinGW/bin/c++.exe — works
Detecting CXX compiler ABI info
Detecting CXX compiler ABI info – failed
Detecting CXX compile features
Detecting CXX compile features – done
Configuring incomplete, errors occurred!
See also “C:/Users/<censored>/Source/Repos/WindowsProject2/WindowsProject2/VisualGDB/Debug/CMakeFiles/CMakeOutput.log”.
See also “C:/Users/<censored>/Source/Repos/WindowsProject2/WindowsProject2/VisualGDB/Debug/CMakeFiles/CMakeError.log”.
Exception reported by CMake server: Configuration failed.
wh1+x: Exception reported by CMake server: Configuration failed.
at wh1.c2[_InType,_OutType](_InType a)
at g61.x(String[] a)
at g61.l_2(Hello a)
at wh1.m1()

[support]

Hi,

It looks like your antivirus treated a test executable that got just compiled as a part of CMake tests as a trojan:

C:\Users\<censored>\Source\Repos\WindowsProject2\WindowsProject2\VisualGDB\Debug\CMakeFiles\3.10.1\CompilerIdCXX\a.exe

We regularly check the VisualGDB releases with VirusTotal and notify the antivirus companies to update their whitelists in case VisualGDB starts triggering false positives, but this looks like the antivirus got triggered by a blank executable just built on your machine.

The only advise we could give in this situation is to use a better antivirus that doesn’t get triggered by an empty program.

[b.timofte]

I see is not triggered when using visualGdb SysGcc folder compiler

Is VisualGdb downloading in those folders this version of gcc ?
<h1>mingw-w64</h1>
<p class=”claim”>GCC for Windows 64 & 32 bits</p>

 

I tested and it looks fine …. but is it officially supported ?

 

—— Rebuild All started: Project: WindowsProject1.vgdbcmake, Configuration: Debug VisualGDB ——
Removing C:\Users\<>\Source\Repos\WindowsProject1\WindowsProject1/VisualGDB/Debug…
Reconfiguring project due to missing Makefile…
The C compiler identification is GNU 7.2.0
The CXX compiler identification is GNU 7.2.0
Check for working C compiler: C:/Program Files (x86)/mingw-w64/i686-7.2.0-posix-dwarf-rt_v5-rev1/mingw32/bin/gcc.exe
Check for working C compiler: C:/Program Files (x86)/mingw-w64/i686-7.2.0-posix-dwarf-rt_v5-rev1/mingw32/bin/gcc.exe — works
Detecting C compiler ABI info
Detecting C compiler ABI info – done
Detecting C compile features
Detecting C compile features – done
Check for working CXX compiler: C:/Program Files (x86)/mingw-w64/i686-7.2.0-posix-dwarf-rt_v5-rev1/mingw32/bin/g++.exe
Check for working CXX compiler: C:/Program Files (x86)/mingw-w64/i686-7.2.0-posix-dwarf-rt_v5-rev1/mingw32/bin/g++.exe — works
Detecting CXX compiler ABI info
Detecting CXX compiler ABI info – done
Detecting CXX compile features
Detecting CXX compile features – done
Configuring done
Generating done
Code model queried in 8 msec
VisualGDB: Run “C:\Program Files (x86)\mingw-w64\i686-7.2.0-posix-dwarf-rt_v5-rev1\mingw32\bin\mingw32-make.exe ” in directory “C:\Users\<>\Source\Repos\WindowsProject1\WindowsProject1/VisualGDB/Debug” on local computer
Scanning dependencies of target WindowsProject1
[ 50%] Building CXX object CMakeFiles/WindowsProject1.dir/WindowsProject1.cpp.obj
[100%] Linking CXX executable WindowsProject1.exe
[100%] Built target WindowsProject1
========== Rebuild All: 1 succeeded, 0 failed, 0 skipped ==========

• This reply was modified 6 years, 10 months ago by b.timofte.
• This reply was modified 6 years, 10 months ago by b.timofte.

[support]

Hi,

It looks like your technical support period has expired. To keep on receiving technical support, please renew your license here: https://sysprogs.com/splm/mykey

[Author]

Posts