search

kliment / Printrun

Pronterface, Pronsole, and Printcore - Pure Python 3d printing host software
GNU General Public License v3.0
2.38k stars 996 forks source link

Quickheal virus scanner screaming #1220

Closed virenchocha closed 3 years ago

virenchocha commented 3 years ago

Quickheal virus scanner is detecting Pronterface.exe is virus putting in qurantine. I am talking about pronterface-windows-x64_3.8-2.0.0rc8.zip and pronterface-windows-x86_3.8-2.0.0rc8.zip. Older version of pronterface runs without any issue. Moreover, I am finding around 6 instance of Pronterface running in background in Task manager.

System detail : Windows 10 X64 AMD processor with built in graphics card.

virenchocha commented 3 years ago

No file to attach.

DivingDuck commented 3 years ago

False positive.

volconst commented 3 years ago

@virenchocha Did you start it 6 times, probably after you start one and no UI appears? Do you have enough disk space in tmp directory? Each run extracts directories in tmp dir.

virenchocha commented 3 years ago

Pronterface 1.6.0 runs without a hitch.....no 6 timer required....(wait 6 times ! is it a joke ?)

volconst commented 3 years ago

I am finding around 6 instance of Pronterface

Do the 6 processes appear after a single start of Pronterface? Is it processes or threads? I think taskviewer does not display threads. And having 6 pronterface processes seems wrong.

DivingDuck commented 3 years ago

@volconst For sure no, this happen either when a virus scanner block pronterface and the user do not recognize it and then start Pronterface multiple times or Pronterface crash during starting like with the wxpython issue.

As you had mentioned before, once this happen he can check this by checking running processes and/or the application temp folder (c:\Users\YourUserName\AppData\Local\Temp) where you can find multiple directories starting with _MEIxxxxxx where x is a number. Each of those directories represent a running Pronterface instance that a user had started.

virenchocha commented 3 years ago

Ok. But the anti virus scanner tells "This program is asking for acess to internet. If you don't recognise this program, this is your chance to block it from reaching the network". Just could not understand, why pronterface wants to access internet ? image

DivingDuck commented 3 years ago

Pronterface is able to make tcp connections what do NOT mean it is connecting to internet but you are able to connect a printer in your network via network address if you make the decision to do so. Look for RPC SERVER in readme documentation.

It is false positive as I wrote before and something you want to discuss with your AV manufacturer. Understanding how your AV/firewall detection and protection works is also a benefit to understand what happen. Setup a rule and you are fine.

You can find this kind of question and answers multiple times when you search in issue listing.

virenchocha commented 3 years ago

This clarifies.....issue closed...hope not malicious and I am going to click on 'Allow' button next time. Thanks...

volconst commented 3 years ago

@virenchocha You can disable rpc server in pronterface Settings. I think it is ok to Deny network access. The rpc server tries to open a port on localhost network interface, which can be misused by programs running on your computer, but not from an attacker from the internet, unless they compromise a local program. https://github.com/kliment/Printrun/blob/5a328ff8a64bf25532ed866d85c74b1d42def6d0/printrun/rpc.py#L35