AntiVirus oneAPI Compiler

[Doug2500]

My McAfee Antivirus software interferes with the Intel oneAPI Fortran Compiler.  Specifically, it creates Bad Null values at the beginning of the executable file.

The vendor for my tool has verified this, by compiling/linking my fortran source on his computer.  On his computer (that does not have McAfee), he verified that my source code is fine and he successfully compiled/linked an executable that runs.

Unfortunately, I am stuck with McAfee.  It's what my company uses.

I'm wondering if there are any ifort commands to work with McAfee or turn off some flags.  I'm grasping at straws.

Thanks in advance.

[ArpanB_Intel]

Hi Douglas, we have transferred the thread to the respective forum: Intel® Fortran Compiler. Your issue will be addressed soon.

[James_T_Intel]

Interesting. Does this behavior also occur with ifx? If so, please provide the reproducer and exact error message. I have successfully run ifort and built/linked applications on systems with McAfee in the past with no issues.

[Doug2500]

James_T_Intel,

Thanks for your response.  I am not very savvy with the Intel Compilers, specifically ifx.  That is, I don't know how to use ifx.

I am not certain McAfee is causing the problems.  It's possible my Windows machine got cluttered with system files.  It is impossible to tell.  Is there some kind of flag to put in the compile line of ifort to help identify errors that may be generated during compiling.  Something like -debug?

Alternatively, if you could give me formatting for ifx commands?

 I am grasping at straws.  This is a very elusive problem and very frustrating.

Thanks,

Doug W.

[Doug2500]

James_T_Intel,

I did try the ifx command, using the same commands as used for ifort.

I get an error that ifx does not support HAVCPA = 1

See attached image.

I am not sure what that means, but wanted to let you know.

Thanks, Doug W.

[Steve_Lionel]

My suspicion is that it is the linking phase that is the issue, not compiling. Therefore, no compiler option is going to help. AV tools often seize upon newly created EXEs as this is something some malware does. I haven't encountered AV tools that corrupt the EXE, however.

You can test this by doing just a compile (/c from the command line), and the a link, and see where the change happens.

When I was at Intel we used McAfee AV tools and I never encountered this, though sometimes I would get errors that the link (or manifest tool) could not open the EXE because the AV tool had it locked. The solution there was to tell the AV tool to not scan my development directory.

You could also have malware running that corrupts EXEs

[cryptogram]

Anti-virus tools have been the bane of my existence, and I've seen all sorts of bizarre things happen, including corruption of executables.

This was years ago, and was a bug in the anti-virus that was resolved with an update.   Mostly these days what I see is executables that disappear shortly after you try to run them.  In this case, the antivirus sees that the executable has changed, and not having seen it before, deems it suspicious and gets rid of it.   To get around this, I run a batch file after creating executables that signs the executable.

It's our corporate environment this is a bit of a hassle to set up, as you first have to be added to an AD group that allows you to sign executables, then you have to get and install a digital certificate, and finally you have to send you certificate off to the corporate antivirus

guru to get your certificate added to the anti-virus softwares whitelist.  

[James_T_Intel]

Regarding ifx, it is our new Fortran compiler and will be replacing ifort.

Regarding the exact error you show, it indicates that you are using a capability not yet supported in ifx. What is HAVCPA in your code?

[Doug2500]

Honestly, I don't know what HAVCPA is.  I am not the writer of the code.  I only use it... a thermal analysis tool automatically generates the Fortran code and compiles it.  It's strange that a simple statement like that would cause a problem.

[James_T_Intel]

I don't think it's that statement specifically, it's more likely to be related to what the variable actually is.

[Steve_Lionel]

I think @James_T_Intel  is on the wrong track here - the program itself is irrelevant. Some external process is interfering with the link or manifest tool embedding.

Here's another experiment you can try. In the project properties, change Linker > Manifest File, set Generate Manifest to No. Rebuild the solution - does the problem still appear?

[Doug2500]

Thank you Steve_Lionel,

I will have to find out how to try that.  I may not be in the exact same application as you, or don't know how to run it.  I am just editing commands in a file on a compile line.

I use:  ifort @infonCur15_SAVE.txt

Is there a way to try what you recommend in a the infonCur15_SAVE.txt file (attached)?

Thank you!

[Steve_Lionel]

The suggestion of turning off manifests doesn't apply to your build. 

[Doug2500]

Thank you Steve_Lionel,

I was away on personal travel since last Wed., so I could not respond until now.

I should state we haven't verified that McAfee is causing the problem.  It is possible a corrupted DLL that is required for linking is causing the problem.

We have had this issue before.  That time, my IT specialist "cleaned" the computer.  I am not fully aware of all of the operations he performed, but it was not an OS refresh.  It was a utility that cleans DLLs and other system files.  Then he reloaded the application that uses the Fortran Compiler.  At the time, about a year ago, that fixed the problem.  We could try that again, but it is a rather time-consuming exercise and we would like to identify the root cause, so that we can easily fix this issue.... if that is possible.   Last year, we never ID'd the exact cause.

In an earlier post, I mentioned the NULL executable file, seen with the HEX reader:  HxD.  I cannot coherently understand anything in the executable file, even if reading with the HEX reader.  I am not sure my IT expert has that skill either.  He is very willing to learn and a very capable expert in other areas... however, no one knows it all.

Are there any things you would recommend I tell my IT expert to look for, to try identify a potentially corrupted DLL/other file(s)?

Thanks again,

Doug W.

[Steve_Lionel]

The only thing that I can think of is rather complex. It would be to run Process Monitor, have it log file accesses, and see which processes and images access the executable. Don't ask me for detailed instructions on this! 

But let me ask you this - how did the problem come to light? What's the symptom?  There are always several null bytes at the beginning of a Windows executable, though not in the first two bytes (which are the characters MZ.) Please show the output of your hex dumper of the beginning of the executable; it's always a "DOS stub" that looks like this:

I find myself wondering if you're chasing the wrong thing.

[Doug2500]

Thank you Steve_Lionel,

1)  I will look into the Process Monitor and pass it along to my IT support.  I won't ask for detailed instructions. 

2)  "How did the problem come to light?"  When I try to run the executable, I get a message that says: "The system cannot execute the specified program."   This is rather useless because there are no clues as to what is causing the problem.

3)  I have attached the first couple dozen lines of the HEX Executable file, in image.png.  The first 15 lines or appear to be Null to me, more so than in the example you provided.

Any help you provide is much appreciated.

Doug2500

[Steve_Lionel]

OK - that is some serious corruption. Is the EXE on a local disk, or a network drive? I'm VERY skeptical that an AV program is involved here - it feels more like an underlying system problem.

Can you share the link map from this executable? You'd have to add  "/link /map" at the end of the ifort command. I'm wondering if you've exceeded the 2GB static code and data limit, which sometimes results in corrupt EXEs and no error messages. However, you say the same program can be built on another computer without problems - the EXACT same?