0

I have a C# .NET 4.8 project that will cause my antivirus software to prevent it from running the executable file for the project. Here is the error it throws in Visual Studio:

enter image description here

And here is the notification my antivirus software appears to give me:

enter image description here

I have narrowed down the code that is causing this... In summary, I am using a timer that will run every minute, and on its tick event (when the timer is up) it will do a check to look for a file name (I call this file "Terminate"), if there is this file it will close the program after 3 minutes.

The end users are all on a virtual environment on the same network and are all running this program from the same directory. Thus, if there is any maintenance that needs to be performed on these virtual environments, I can manually change the file name from "xTerminate" to "Terminate" and the programs will close in all of those environments without having to get users to do it manually.

public Timer poisonPill = new Timer();
poisonPill.Interval = (1 * 60 * 1000);  // every 1 minutes
poisonPill.Tick += new EventHandler(poisonPill_Tick);
poisonPill.Start();

When this 1-minute timer reaches the interval time-length, it runs this event:

private void poisonPill_Tick(object sender, EventArgs e)
    {
        if (File.Exists("Terminate.txt"))
        {
            poisonPill.Enabled = false;

            string message;

            try
            {   // Open the text file using a stream reader.
                using (StreamReader sr = new StreamReader("Terminate.txt"))
                {
                    // Read the stream to a string
                    String line = sr.ReadToEnd();
                    message = line;
                }
            }
            catch (Exception ex)
            {
                message = "Application closing in 3 minutes for maintenance by administrator";
            }

            Timer terminator = new Timer();
            terminator.Interval = (3 * 60 * 1000);
            terminator.Tick += terminator_Tick;
            terminator.Start();

            MessageBox.Show(message + "\n\nNotification Time:  " + DateTime.Now.ToString("h:mm tt") +
                "\n\nApplication closes 3 minutes after Notification Time.", "3-Minute Application Closing Alert");
        }
    }

And then once that 3-minute timer finishes...:

private void terminator_Tick(object sender, EventArgs e)
    {
        Application.Exit();
    }
9
  • 4
    antivirus aside, you should be using a FileSystemWatcher to do this. It's designed to do literally this, and it's much better at it.
    – Servy
    Commented Jan 27, 2023 at 15:59
  • @Servy great insight! Checking out the Docs now and seeing that this will work perfectly. I'll implement this and see if the error throws again. However, I am still curious as to why this was flagged originally. Commented Jan 27, 2023 at 16:02
  • 1
    @Idle_Mind are the design issues you are referring to same that Servy has mentioned in regard to using FileSystemWatcher? Commented Jan 27, 2023 at 18:56
  • 1
    Yes. Sorry. Crowdstrike most likely doesn't care what kind of code you're using (your design), it's probably just flagging it because it's a NEW executable (possibly being changed frequently as you change code and re-run).
    – Idle_Mind
    Commented Jan 27, 2023 at 18:59
  • 1
    @Idle_Mind I was changing it pretty frequently, so I thought perhaps this could have been the root cause. However, commenting out the code I have in the question and rebuilding is totally fine. If I don't comment/exclude the code CrowdStrike sees it as malware. I am playing between having these blocks of code commented and uncommented and it goes from running the program to not being able to. I guess it ultimately is CrowdStrike's algorithm for determining/identifying malware which is probably pretty secretive, and thus hard to know for certain how it looks at these situations and handles them Commented Jan 27, 2023 at 19:14

1 Answer 1

3

Anti-Virus software does that often because it's a new executable with weird behavior that it's not used to. It doesn't recognize it like an official app like Steam or Discord. It does it with pirated games, too. But it's nothing to worry about, you made the app, you know what it was made to do. The antivirus doesn't know, and it's just defending. I usually just turn off my antivirus temporarily, or add an exception so it won't turn my app off when I'm testing. You can add an exception in the antivirus settings, depending on what antivirus you use, there must be a place where you can select the exe location, and the antivirus will ignore it.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.