ThreatFire Antivirus can cause data loss in fSekrit.exe data

[sinum]

Before some weeks I try ThreatFire Antivirus ( http://www.threatfire.com ). I change some text within fSekrit and save, I answer all secure Popups from ThreatFire with yes to allow the modifications and end with an empty fSekrit.exe, all data was lost.

So if you use ThreatFire and fSekrit make sure you have a Backup of the fSekrit file, i was very lucky as i found a Backup.

[f0dder]

Thanks for the heads-up

It's understandable that threatfire balks at fSekrit, since writing to executable files can be seen as pretty darn suspicious. But that it causes it to lose data, even though you answer yes to the modification attempt? That's plain old nasty!

Sounds like I need to review the file save code though, there might be some corner cases where I don't detect an error; on errors, fSekrit definitely shouldn't think it has saved the file properly and thus allow the user to discard modification.

[sinum]

Sounds like I need to review the file save code though, there might be some corner cases where I don't detect an error; on errors, fSekrit definitely shouldn't think it has saved the file properly and thus allow the user to discard modification.

-f0dder (August 30, 2009, 01:49 PM)

OK, I install ThreatFire on my netbook with default Config and test it again. ThreatFire don't pop up any notes! fSekrit pop up 2 times, "Error saving file" and end up with no data and no password! fSekrit Version is 1.35, ThreatFire Version is 4.5.0.24 (Free)

Crazy, I never had problems with other Antivirus Software.

[f0dder]

Just verified this with XP+SP2 32bit in VMWare, fSekrit 1.35 (official release version), and ThreatFire 4.6.0.

When trying to do a regular save, I get three pop-ups from TF where I choose "allow" (without "remember") - and then I get two popups from fSekrit with error messages. When I terminate fSekrit and say yes to save changes, the same thing happens - except that fSekrit ignores the error status and exits! Whoops, that's a "small bit" of program logic error there

It's still pretty weird that TF fscks up the save process when actually allowing the operation to happen!

Anyway, I've finally gotten around to adding way more robust saving code to fSekrit (save to tempfile, delete existing file, rename tempfile) which has the added benefit of shutting up TF warnings. I'll hunt down the flawed program logic that allows you to exit with unsaved changes, then I'll upload a beta version. I'm really sorry for having such serious flaws lying around for so long

[f0dder]

OK, here we go - both bugs should be fixed. Please run through some heavy testing

Check this thread for the new beta version, and post replies about the beta there please

(other ThreatFire issues are welcome in this thread, though).

[sinum]

Sorry for my late response and thanks for the new beta,

I agree, TF should not block anything when someone click "allow". I'm sure fSekrit data is a lot better protected with your new beta code and it should also prevent data loss with other Antivirus Software.