更新后, Win11 上编译 C++常用库被 Defender 报毒 - V2EX
V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
Thymolblue
V2EX    Windows

更新后, Win11 上编译 C++常用库被 Defender 报毒

  •  
  •   Thymolblue 2023-12-14 23:27:46 +08:00 2434 次点击
    这是一个创于 668 天前的主题,其中的信息可能已经有所发展或是发生改变。

    各位 V 友帮我看看是我中病毒了还是确实是误报

    在今天更新完系统后,包括 opencv, zlib, eigen 在内的库均无法编译,全被 Defender 拦截了

    下面是以我编译 zlib-1.3 为例

    Environment

    • MinGW 11.2.0
    • CMake 3.24.2
    • Windows 11 (23H2, 22631.2861)
    • Security intelligence version(Defender): 1.403.485.0 (last update 2023.12.14)

    Library

    Command

    C:/Qt/Tools/CMake_64/bin/cmake.exe -G "MinGW Makefiles" -D CMAKE_C_COMPILER=gcc -D CMAKE_CXX_COMPILER=g++ -D CMAKE_C_FLAGS_DEBUG=-O3 -D CMAKE_C_FLAGS_RELEASE=-O3 -D CMAKE_CXX_FLAGS_DEBUG=-O3 -D CMAKE_CXX_FLAGS_RELEASE=-O3 -D CMAKE_BUILD_TYPE=Debug -D CMAKE_PREFIX_PATH="C:/Work/dep/MinGW11.2.0/Debug;${CMAKE_PREFIX_PATH}" -D CMAKE_INSTALL_PREFIX="C:/Work/dep/MinGW11.2.0/Debug/zlib-1.3" -B . -S .. 
    C:/Qt/Tools/CMake_64/bin/cmake.exe --build . 
    C:/Qt/Tools/CMake_64/bin/cmake.exe --install . 

    Generator

    • "MinGW Makefiles"

    Variables

    • CMAKE_C_COMPILER=gcc
    • CMAKE_CXX_COMPILER=g++
    • CMAKE_C_FLAGS_DEBUG=-O3
    • CMAKE_C_FLAGS_RELEASE=-O3
    • CMAKE_CXX_FLAGS_DEBUG=-O3
    • CMAKE_CXX_FLAGS_RELEASE=-O3
    • CMAKE_BUILD_TYPE=Debug
    • CMAKE_PREFIX_PATH=C:/Work/dep/MinGW11.2.0/Debug;${CMAKE_PREFIX_PATH}
    • CMAKE_INSTALL_PREFIX=C:/Work/dep/MinGW11.2.0/Debug/zlib-1.3

    Windows Defender

    CMake

    -- The C compiler identification is GNU 11.2.0 -- Detecting C compiler ABI info -- Detecting C compiler ABI info - failed -- Check for working C compiler: C:/Qt/Tools/mingw1120_64/bin/gcc.exe -- Check for working C compiler: C:/Qt/Tools/mingw1120_64/bin/gcc.exe - works -- Detecting C compile features -- Detecting C compile features - done -- Looking for sys/types.h -- Looking for sys/types.h - found -- Looking for stdint.h -- Looking for stdint.h - found -- Looking for stddef.h -- Looking for stddef.h - found -- Check size of off64_t CMake Error at C:/Qt/Tools/CMake_64/share/cmake-3.24/Modules/CheckTypeSize.cmake:146 (try_compile): Cannot copy output executable 'C:/Work/tmp/pack/zlib-1.3/build_zlib_1.3_MinGW11.2.0_Debug/CMakeFiles/CMakeTmp/cmTC_8af1e.exe' to destination specified by COPY_FILE: 'C:/Work/tmp/pack/zlib-1.3/build_zlib_1.3_MinGW11.2.0_Debug/CMakeFiles/CheckTypeSize/OFF64_T.bin' Call Stack (most recent call first): C:/Qt/Tools/CMake_64/share/cmake-3.24/Modules/CheckTypeSize.cmake:277 (__check_type_size_impl) CMakeLists.txt:40 (check_type_size) -- Looking for fseeko -- Looking for fseeko - found -- Looking for unistd.h -- Looking for unistd.h - found -- Configuring incomplete, errors occurred! See also "C:/Work/tmp/pack/zlib-1.3/build_zlib_1.3_MinGW11.2.0_Debug/CMakeFiles/CMakeOutput.log". See also "C:/Work/tmp/pack/zlib-1.3/build_zlib_1.3_MinGW11.2.0_Debug/CMakeFiles/CMakeError.log". 
    V28a19cc
        1
    V28a19cc  
       2023-12-15 00:47:27 +08:00   1
    1. 建议综合多个杀软的结果来确定是否误报,具体操作是将报毒的文件上传到 [VirusTotal]( https://www.virustotal.com)
    2. 建议禁用 Defender 以**大幅加快**编译速度,随便换个杀软性能都比 Defender 好很多
    miaomiao888
        2
    miaomiao888  
       2023-12-15 05:33:46 +08:00   1
    不确定你的情况
    但最近 Defender 似乎更新了病毒库导致一些误报,反正我有个软件是突然收到误报反馈。
    Defender 很恶心,加白除了添加排除路径,还得关实时保护,否则软件运行后照样扫内存强行删除。
    同样建议换,这坨东西一点都不专业。
    j16ZgMV9cs6ZB23n
        4
    j16ZgMV9cs6ZB23n  
       2023-12-15 10:03:50 +08:00
    MinGW 的不清楚,我用 msvc 编译的上传再下载就当病毒了,自己都觉得很惊奇。
    Thymolblue
        5
    Thymolblue  
    OP
       2023-12-15 10:35:48 +08:00 via Android
    @miaomiao888
    @chilledheart
    确实 defender 的报毒很迷,而且连操作时间都不给
    sariya
        6
    sariya  
       2023-12-15 12:22:18 +08:00 via Android
    放排除列表吧,可能是一些动态生成 exe 的操作触发了误报
    klosw
        7
    klosw  
       2023-12-15 14:51:43 +08:00
    为啥不把项目目录在 Defender 中排除呢
    Thymolblue
        8
    Thymolblue  
    OP
       2023-12-15 15:14:49 +08:00 via Android
    @klosw 被 defender 报毒是在 14 号更新后发生的,主要是不确定是否真的中毒了
    Thymolblue
        9
    Thymolblue  
    OP
       2023-12-16 09:03:27 +08:00
    来结一下题,就是微软的误报,把 CMake 更新到 3.27 之后就能成功编译了。
    关于     帮助文档     自助推广系统     博客     API     FAQ     Solana     920 人在线   最高记录 6679       Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 22ms UTC 18:48 PVG 02:48 LAX 11:48 JFK 14:48
    Do have faith in what you're doing.
    ubao snddm index pchome yahoo rakuten mypaper meadowduck bidyahoo youbao zxmzxm asda bnvcg cvbfg dfscv mmhjk xxddc yybgb zznbn ccubao uaitu acv GXCV ET GDG YH FG BCVB FJFH CBRE CBC GDG ET54 WRWR RWER WREW WRWER RWER SDG EW SF DSFSF fbbs ubao fhd dfg ewr dg df ewwr ewwr et ruyut utut dfg fgd gdfgt etg dfgt dfgd ert4 gd fgg wr 235 wer3 we vsdf sdf gdf ert xcv sdf rwer hfd dfg cvb rwf afb dfh jgh bmn lgh rty gfds cxv xcv xcs vdas fdf fgd cv sdf tert sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf shasha9178 shasha9178 shasha9178 shasha9178 shasha9178 liflif2 liflif2 liflif2 liflif2 liflif2 liblib3 liblib3 liblib3 liblib3 liblib3 zhazha444 zhazha444 zhazha444 zhazha444 zhazha444 dende5 dende denden denden2 denden21 fenfen9 fenf619 fen619 fenfe9 fe619 sdf sdf sdf sdf sdf zhazh90 zhazh0 zhaa50 zha90 zh590 zho zhoz zhozh zhozho zhozho2 lislis lls95 lili95 lils5 liss9 sdf0ty987 sdft876 sdft9876 sdf09876 sd0t9876 sdf0ty98 sdf0976 sdf0ty986 sdf0ty96 sdf0t76 sdf0876 df0ty98 sf0t876 sd0ty76 sdy76 sdf76 sdf0t76 sdf0ty9 sdf0ty98 sdf0ty987 sdf0ty98 sdf6676 sdf876 sd876 sd876 sdf6 sdf6 sdf9876 sdf0t sdf06 sdf0ty9776 sdf0ty9776 sdf0ty76 sdf8876 sdf0t sd6 sdf06 s688876 sd688 sdf86