Honestly, Edmond is perfectly correct.
E.g. False positives - What are they? - Panda Security Mediacenter or What to do with false positives/negatives in Microsoft Defender Antivirus - Windows security | Microsoft Docs
i will try with other connection and browser, by the way it is possible add sinad measurements to the software?
thank you for your time.
best regards
Pio
Last edited:
False positives repoted by "Random BS Generators"
The following piece of code triggered false positives, see fig. 1.
int e;
LARGE_INTEGER QPF; // counter frequency
..............
e = QueryPerformanceFrequency( &QPF ); // get counter frequency
if( e ) cb->IQPF = 1.0 / QPF.QuadPart; // convert to double and invert
else cb->IQPF = 1.0 / 3.3E6; // error and avoid div by 0
When changed to this:
cb->IQPF = 1.0 / 3.3E6; // assume error
e = QueryPerformanceFrequency( &QPF ); // get counter frequency
if( e ) cb->IQPF = 1.0 / QPF.QuadPart; // convert to double and invert
then the false positives are gone, see fig. 2.
This clearly demonstrate how stupid some AV scanners are. Even the most simple and harmless lines of code are misinterpreted and mark them as a virus.
BTW, I also found another function call that some AV scanners dislike: AdjustTokenPrivileges()
This one is used to identify background processes that eat too many CPU cycles. I still have to find a way to hide or skip this call when DiAna is scanned by those "Random BS Generators".
Cheers, E.
Oh-really?
The following piece of code triggered false positives, see fig. 1.
int e;
LARGE_INTEGER QPF; // counter frequency
..............
e = QueryPerformanceFrequency( &QPF ); // get counter frequency
if( e ) cb->IQPF = 1.0 / QPF.QuadPart; // convert to double and invert
else cb->IQPF = 1.0 / 3.3E6; // error and avoid div by 0
When changed to this:
cb->IQPF = 1.0 / 3.3E6; // assume error
e = QueryPerformanceFrequency( &QPF ); // get counter frequency
if( e ) cb->IQPF = 1.0 / QPF.QuadPart; // convert to double and invert
then the false positives are gone, see fig. 2.
This clearly demonstrate how stupid some AV scanners are. Even the most simple and harmless lines of code are misinterpreted and mark them as a virus.
BTW, I also found another function call that some AV scanners dislike: AdjustTokenPrivileges()
This one is used to identify background processes that eat too many CPU cycles. I still have to find a way to hide or skip this call when DiAna is scanned by those "Random BS Generators".
Cheers, E.
Attachments
It seems like the reigning philosophy is, if the program takes full advantage of the system it's using it's probably a virus. After all the average computer user would never need those functions...
It seems lovely to code for windows, having to fight the antivirus BS and users' expectations created by the antivirus companies massage.
Last edited:
reigning philosophy
To get any idea:
QueryPerformanceFrequency() number of hits:
Google: 62700
in my C:\Windows\System32: 191
in my C:\Program Files: 352
AdjustTokenPrivileges() number of hits:
Google 227000,
in my C:\Windows\System32: 308
in my C:\Program Files: 369
Anyhow, I need these function calls in order to warn the user when W10 -not being a real time OS- is busy with background rubbish and swallow up a considerable part of the CPU resources.
Cheers, E.
Those two function calls are neither uncommon nor exotic.
To get any idea:
QueryPerformanceFrequency() number of hits:
Google: 62700
in my C:\Windows\System32: 191
in my C:\Program Files: 352
AdjustTokenPrivileges() number of hits:
Google 227000,
in my C:\Windows\System32: 308
in my C:\Program Files: 369
Anyhow, I need these function calls in order to warn the user when W10 -not being a real time OS- is busy with background rubbish and swallow up a considerable part of the CPU resources.
Cheers, E.
Maybe off-topic, but can I use DiAna to measure close-in phase noise of a DAC word clock.
I'm considering a setup using a software generated WAV file (Linux JAAA) to outputs e.g. 10kHz 24bit/192kHz to the DAC using the DAC clock as a master. Thereafter feed the analog output through a notch- or high-pass filter to attenuate the 10kHz by e.g. 40dB. Thereafter amplify the analog signal 40dB and feed the result into a 24bit ADC to analyse the low frequency (<1kHz) noise.
Any suggestions are greatly appreciated.
I'm considering a setup using a software generated WAV file (Linux JAAA) to outputs e.g. 10kHz 24bit/192kHz to the DAC using the DAC clock as a master. Thereafter feed the analog output through a notch- or high-pass filter to attenuate the 10kHz by e.g. 40dB. Thereafter amplify the analog signal 40dB and feed the result into a 24bit ADC to analyse the low frequency (<1kHz) noise.
Any suggestions are greatly appreciated.
Hi Athelas,
Disclaimer: I have never done this kind of noise measurements before. So I can't guarantee you will get meaningful and accurate results.
As for THD measurements, it does work. keantoken has done it before. Good luck.
Regards, E.
DiAna can measure the signal to noise ratio. So when the amplitude of the fundamental is known, you can calculate (by hand) the absolute noise level.
You can import wav files (see the File menu). Using the DAC clock as a master is also possible by switching on the External sync option in the Distortion menu under Preferences.
Also in the Distortion menu, you may specify the noise bandwidth (in Hz).
Disclaimer: I have never done this kind of noise measurements before. So I can't guarantee you will get meaningful and accurate results.
As for THD measurements, it does work. keantoken has done it before. Good luck.
Regards, E.
@Marcus, don't worry, it's just a false positive. It's your AV scanner that is "infected" with hyperallergic algorithms.
BTW, also these two totally harmless lines of code (which opens my website), triggers some AV scanners:
static char site[] = "http://www.data-odyssey.nl/Diana.html";
ShellExecute( hwnd, "open", site, 0, 0, SW_SHOW );
Cheers, E.
BTW, also these two totally harmless lines of code (which opens my website), triggers some AV scanners:
static char site[] = "http://www.data-odyssey.nl/Diana.html";
ShellExecute( hwnd, "open", site, 0, 0, SW_SHOW );
Cheers, E.
To all who were complaining about an alleged virus.
When closing DiAna the .ini file is updated with new data, but first the old content is saved in a backup file with .bak as extension.
It's done by means of this Windows API: MoveFileEx( OldFileName, NewFileName, flags );
Even this harmless and innocent function triggers one of those "hyperallergic" AV scanners (in this case it was Kaspersky).
In an attempt to avoid this false positive I replaced above function call by:
DeleteFile( OldFileName );
rename( OldFileName, NewFileName );
Well guess what, even three more AV scanners were whining about an alleged virus (Avira, Cynet, Trellix). So I gave up.
But one thing is clear: apparently any program that goes beyond more than simply displaying "Hello world" is a serious threat according those AV scanners (read: random BS generators).
So my dear DIYers, ignore this nonsens or even better, buy a decent AV scanner (I'm using NOD32).
Cheers,
E.
When closing DiAna the .ini file is updated with new data, but first the old content is saved in a backup file with .bak as extension.
It's done by means of this Windows API: MoveFileEx( OldFileName, NewFileName, flags );
Even this harmless and innocent function triggers one of those "hyperallergic" AV scanners (in this case it was Kaspersky).
In an attempt to avoid this false positive I replaced above function call by:
DeleteFile( OldFileName );
rename( OldFileName, NewFileName );
Well guess what, even three more AV scanners were whining about an alleged virus (Avira, Cynet, Trellix). So I gave up.
But one thing is clear: apparently any program that goes beyond more than simply displaying "Hello world" is a serious threat according those AV scanners (read: random BS generators).
So my dear DIYers, ignore this nonsens or even better, buy a decent AV scanner (I'm using NOD32).
Cheers,
E.
My 2 cents that large software vendors have quirks for their software in the major AV systems, nicely paid for in my guess.
Hi Pavel,
I'm not sure sure whether these false positives are generated intentionally or not, but I've decided to remove this backup stuff anyhow, because it's of little use (in all those years, I have never peeked into these ini backup files).
Cheers, E.
I do not think the false positives are intentional, simply the code fits their signatures. But major softwares which would most likely trigger them too could be on some trigger blacklist. Just guessing...
@ Pavel,
Even the smallest possible Windows program, which does absolutely nothing, triggers some (crazy) AV scanners.
This is the 'program':
int APIENTRY WinMain( HINSTANCE hInst, HINSTANCE phi, char *CmdLine, int CmdShow )
{
return 0;
}
And below the five panic-mongers. Just wondering who still takes those idiotes seriously.
Even the smallest possible Windows program, which does absolutely nothing, triggers some (crazy) AV scanners.
This is the 'program':
int APIENTRY WinMain( HINSTANCE hInst, HINSTANCE phi, char *CmdLine, int CmdShow )
{
return 0;
}
And below the five panic-mongers. Just wondering who still takes those idiotes seriously.
