Strange Access Denied warning when running the simplest C++ program.

Question

I am just starting to learn C++ (coming from a Java background) and I have come across something that I can't explain. I am working through the C++ Primer book and doing the exercises. Every time I get to a new exercise I create a new .cpp file and set it up with the main method (and any includes I think I will need) e.g.:

#include <list>
#include <vector>

int main(int argc, char **args) {

}

and just to make sure I go to the command prompt and compile and run:

g++ whatever.cpp
a.exe

Normally this works just fine and I start working on the exercise, but I just did it and got a strange error. It compiles fine, but when I run it it says Access Denied and AVG pops up telling me that a threat has been detected 'Trojan Horse Generic 17.CKZT'. I tried compiling again using the Microsoft Compiler (cl.exe) and it runs fines. So I went back, and added:

#include <iostream>

compiled using g++ and ran. This time it worked fine.

So can anyone tell me why AVG would report an empty main method as a trojan horse but if the iostream header is included it doesn't?

UPDATE:

I added a return statement to the main method and now I find that I only get the error if I return 0. Any other return value and it seems to work fine.

Answer 1

You're not the first person to encounter false positives by antivirus software.

What probably happened is that the antivirus heuristics tripped up on the standard runtime libraries present in your programs, since malware uses them as well. Of course, legitimate software uses them too! The fact that it didn't trip up on iostream probably means that iostream isn't very popular among malware writers.

Answer 2

If you only want to overcome the problem as fast as possible,
just put the folder of the executables into AVG's whitelist.

My preferred steps:

1. For safety's sake, you should send your executable
   to an online virus/malware scanner like these:
   • www.virustotal.com : VirusTotal - Free Online Virus and Malware Scan
   • virusscan.jotti.org/en : Jotti's malware scan
     
     

2. if they report 'false positive', then insert the path of the compiled executables
   into AVG's whitelist, so it doesn't scan that folder. I'm not conversant with AVG,
   but every antivirus has an option to exclude files from scan.

3. If you're brave enough, debug the executable and find the causing call.

4. An alternative solution may be to virtualize a lightweight linux system,
   install gcc (with g++, of course) on it, and use that "g++ dedicated environment"
   to develop your commandline apps.

---

// The 1st step is a sum-up of this conversation.
// If you send me the source and the 'infected' executable that you compiled, then I'll check it.
// The missing return statement in the (C++) main function means returns 0.