Something is making DLLs disappear

[NewsArchive]

We've had times when we send out a software update (sb setup), then
when they go to run the program, one or more DLLs are missing.

These are commonly used and never-changing files that we use in every
version of the software.

Often, it's C60DOSX.DLL.

Today there was one that needed all of these replaced

C60ASCX.DLL
C60DOSX.DLL
C60RUNX.DLL
C60OLEX.DLL
C60TPSX.DLL
LSPUZIPX.DLL

They were definitely inside the setup.

Nothing in the (Vipre) quarantine.

This has also happened on some sites, when they come back from lunch
(no update performed) and some files were gone.

Any ideas?

Thanks.

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

Hi Jeff,

Topscan crashes, Psychedelic Colo(u)rs in listboxes, Haunted Window
Formatter and now disappearing files.
You _are_ having fun lately aren't you <VBG>

Graham

[NewsArchive]

it's just a barrel of laughs<g>

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

Avast ye lubbers. AV maybe? <G>

Lynn Howard

[NewsArchive]

He said nothing in Vipre quarantine.....

BUT - is there a second A/V running? Is this a shared location? where
one workstation is scanning and removing the files from s shared drive?

Are the being removed when the application is running? If they leave it
running those things should be open and should not be delete-able.
Then, if it's some system software trying to remove it, it may request a
reboot - then you'll find your culprit...

JAT

Paul MacFarlane

[NewsArchive]

Hi Jeff

We had the same issue today with a customer.
They had installed Avast antivirus and it destroyed a lot of our
application dlls.
As told before, Avast SUCKS! :-(
And when you mail them, they don't respond.

Best regards
Jeffrey

[NewsArchive]

That sounds like a problem that I was having with the compiler getting
an error, but wasn't reporting it. However, it knew there was an
error internally, so didn't produce the expected OBJs (and DLL). It
doesn't sound like your problem, though. Sorry.

Mike Hanson
www.boxsoft.net

[NewsArchive]

Antivirus has been kicking my ass here.

Dan Scott

[NewsArchive]

Hi Paul -

>He said nothing in Vipre quarantine.....
>
>BUT - is there a second A/V running? Is this a shared location? where
>one workstation is scanning and removing the files from s shared drive?

Well, that's a possibility, I reckon. I'll ask the question about a
2nd A/V.

This last one was just a desktop installation.

The strange thing is that this is happening on multiple sites of
different companies. And when we send them the DLLs to replace the
missing ones, nothing complains about those dlls after that.

>Are the being removed when the application is running? If they leave it
>running those things should be open and should not be delete-able.
>Then, if it's some system software trying to remove it, it may request a
>reboot - then you'll find your culprit...

The deletions are so random, that I don't know the answer to that.

I'll be sure to ask if there was a prompt for re-boot. Excellent
suggestion.

Thanks

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

Har har <g>

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

Did you ask for the happy ending?<g>

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

Oh Sure Mike, Wet his lips and then pull it all away <g>
Hmmmm

Dan

[NewsArchive]

AV often do that to HELP you <g> ...

--
JP
__________________________________________________ _____

For those who do not understand ... : "Qui bene amat bene castigat."
__________________________________________________ _____

DMC - Data Management Center : a tool to let you Migrate Import Export
Transfer your Data
www.dmc-fr.com

[NewsArchive]

>
> Nothing in the (Vipre) quarantine.
>

Some months ago, my AV received a virus definition update in the background.
I started our license registration system (written in Clarion) and it did
not work because of missing DLLs. Hmmm, I checked the application folder
and most DLLs were gone. Nothing in the quarantine. No problem, I thought.
Just copy the DLLs over from the original Clarion folder. Oops. I selected
the DLL files in Windows Explorer and I see them go. What the...? Again,
nothing in the quarantine. No problem, I thought (again). I'll restore
from a backup. No way, a few milliseconds after the restore, the files
simply disappeared. I disabled the AV, and I was able to restore the DLLs
and use the program. Reactivated the AV and DLLs disappeared. It took some
days and a few more virus definition updates to correct this issue. I hate
AV vendors and their incompetence...

And here is another good one. Installer updates in-use (locked) files.
Because the files can't be overwritten, Windows queues the files (in a
temporary location) for replacement at next reboot. But the AV is so smart
that it removes the new DLLs (heuristic detection) from the temporary
location. A very bad idea. Windows reboots and removes the old original
files.

Friedrich

[NewsArchive]

Welcome in the world of "big brother is helping you protect your
computer" <g>

--
JP
__________________________________________________ _____

For those who do not understand ... : "Qui bene amat bene castigat."
__________________________________________________ _____

DMC - Data Management Center : a tool to let you Migrate Import Export
Transfer your Data
www.dmc-fr.com

[NewsArchive]

Yeah, eh. <g>

Mike Hanson
www.boxsoft.net

[NewsArchive]

"It became necessary to destroy the village in order to save it...."

Jane Fleming

[NewsArchive]

It became necessary to destroy human beings in order to preserve them!

It became necessary to close all doors of our OS in order to be able to
say it is secure ....
(compared to Linux world)

There are times when I wonder why no one spaeks up or why no one is
litened when such _stupidities_ are engraved and "approoved"

A doubt on a dll because of "something" ? no problem "quarantain it"
and flag it as such and warn the user but deleting without a word is
beyond human understanding (the human destroyed for it's benefit <g> ?)

--
JP
__________________________________________________ _____

For those who do not understand ... : "Qui bene amat bene castigat."
__________________________________________________ _____

DMC - Data Management Center : a tool to let you Migrate Import Export
Transfer your Data
www.dmc-fr.com

[NewsArchive]

BTW I use sophos and never had such "problems"

when a file or dll or exe is flagged a "bad" I SEE it immediately and
can decide to clean - allow delete etc ....

But I do understand also that for some grandma's using youbook and
facetube ....

--
JP
__________________________________________________ _____

For those who do not understand ... : "Qui bene amat bene castigat."
__________________________________________________ _____

DMC - Data Management Center : a tool to let you Migrate Import Export
Transfer your Data
www.dmc-fr.com

[NewsArchive]

Dang. Thanks Friedrich.

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

And what AV were you using?

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

>
> And what AV were you using?
>

That was avast! Antivirus (the latest version). I am still using avast! but
I went back to the previous version. I am testing Symantec Endpoint
Protection on another machine at the moment.

Friedrich

[NewsArchive]

Thanks.

Symantec products have always made me happy to get rid of them.

Kaspersky behaves well for me. Seeing how the world is evolving, what
could possibly go wrong?<g>
http://www.zdnet.com/how-a-digital-cold-war-with-russia-could-threaten-the-it-industry-7000027591/

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

Wowsers!

Mike Hanson
www.boxsoft.net

[NewsArchive]

Friedrich -

Do you think it's possible that an SB "support" dll could cause this
stuff if the support.dll loads other DLLs dynamically (that exist in
the installation target folder)?

One of those DLLs that gets loaded dynamically is protected by
Armadillo.

This missing file stuff is really hitting us hard.

Thanks

Jeff Slarve
www.jssoftware.com
www.twitter.com/jslarve
I'll search help files & Google for you.

[NewsArchive]

Hi Jeff,

> Do you think it's possible that an SB "support" dll could cause this
> stuff if the support.dll loads other DLLs dynamically (that exist in
> the installation target folder)?
>
> One of those DLLs that gets loaded dynamically is protected by
> Armadillo.
>
> This missing file stuff is really hitting us hard.

No, I don't think that a SB "support" DLL causes this.

Are you sure that the installer copies the DLL files at all? Do you see the
new DLLs (with the new version/time stamps) in the uninstall .log? In most
cases, the AV systems make use of heuristic analysis. If it would be caused
by your support DLL then the AV would only "remove" that specific support
file and not the other dynamically loaded DLLs or dependency files.

BTW, did the installer ask for a reboot (would be an indicator for a
locked/in-use file scenario). Or do you check for an "active" application
(e.g. check if the app is running and ask the user to shut it down to avoid
a reboot request)?

Friedrich