Problems with the new F-PROT v6

[Mele20]

I'm not a happy camper. I just installed the new F-Prot and it immediately did two bad things...one inexcusable IMO. It began running a scan automatically upon reboot. That is a major no-no and I am stunned that Frisk, of all AV companies, doesn't know that. The AV should never run a scan until the user has the chance to configure it even when it is a simple AV without a lot of configuration available.

The second bad thing it did, made worse by the first bad thing, was that it killed the ProcessGuard GUI before it could load in the systray and claimed that it was a virus. You can read my post about the details in the ProcessGuard forum. Suffice it to say that I had to resort to System Restore because F-Prot deleted the file even after I told it not to do that and it was not in quarantine. I did not want to have to reinstall PG so I used system restore to a point before F-Prot was installed.

I noted that F-Prot appears to be only for those who use IE as the heuristics seem to be only for IE. I don't use IE so that was disappointing. I could be wrong about that since I didn't have it very long so did not read the entire help file (did read about quarantine and nothing about what to do when F-Prot doesn't put the file in quarantine and it didn't say where quarantine folder is located) but it does have boxes to check/uncheck for heuristic support of IE. :( How disappointing for those of us that never use IE although I know IE users will welcome the heuristics protection.

I don't really mean to rain on the parade...but I believe that I have a very legitimate gripe when F-Prot throws such a bad FP and messes up Process Guard because it didn't give me a chance to change the settings so it would ask first! I know you guys worked very hard for years on this and I'm sure it will be a fine AV like earlier versions of F-Prot (before 3.15 got sort of outdated). None of this would have happened though, and I wouldn't be here complaining, if you had not made F-Prot to run a scan BEFORE the user has a chance to configure it. I never run full scans anyway so I was doubly irritated. I would never have tried F-Prot had I known you did this. I stay away from any AV that will not let me configure it before it does anything.

[Blackcat]

These problems of the initial scan and the default settings of the scanner were commented upon by users early in the beta release.

Still some fine tuning needed?

[Mele20]

-{ Quote: "These problems of the initial scan and the default settings of the scanner were commented upon by users early in the beta release.

Still some fine tuning needed?" }-

You mean this was brought up in beta and Frisk didn't listen? Grrrr....Geez! I had the beta in the beginning and I don't recall this. I didn't keep the beta very long ..it was raw then and lots of problems and I wanted to beta test another AV on the virtual machine where I had installed so I guess I missed that.

The default settings for what to do when a "virus" is found can't be changed either. At least not on my computer. I changed them to "ask first" and I'm sure I clicked ok...as I did the process twice as I feared I possibly forgot the first time to click ok...so I know I actually did everything necessary to change those settings. Then I fetched the file that was in quarantine and put it back in the PG folder and started the PG GUI. F-Prot immmediately deleted the file again. It did not ask me first what to do as I had put the settings. Plus, it did not put the file in quarantine the second time...it just deleted it..gone..poof...this is why I am irritated. I can't use F-Prot and PG both until the False Positive is fixed because of this dumb way Frisk set up the initial scan.

[Blackcat]

Some relevant past posts about the default settings here. (http://www.wilderssecurity.com/showthread.php?t=132748&highlight=f-prot)

[Littlemutt]

How the heck do you open the main program?
I have in the systray 2 icons, one for schedules, and the other merely starts/stops or exits the program.

I have looked at the help and it says open the program and tick the box, show icon ?? DUH! it won't open or does not appear anywhere...

I've restarted twice also per the help file, and still only the two icons noted above.

:blink:

[rayoflight]

I can't schedule the task:(
-{ Quote: "Click Schedule and specify how frequent the scheduled task to be performed e.g. Once, Daily, Weekly, Monthly, At logon.
If "Once" is selected, select the time and the date you would like this single scan to run.

If "Daily" is selected, select the time and the scan runs at the time specified everyday.

If "Weekly" is selected, select the time and the weekdays that you would like the scan to run. By default, all days from Sunday through Saturday are selected.

If "Monthly" is selected, select the time and the day of the month that you would like the scan to run. Permitted numbers are between 1 and 31. Please note that not all months have 31 days. If you select the number 31, scans will only be performed in months with 31 days.

If "At log on" is selected, no entry is needed for this setting. F-PROT Antivirus will scan your computer each time you logon.

Click OK.
Click Save.
" }-
I don't see "OK" at all:(

[Supportguy]

Hello Littlemutt.

The Icons you are referring to can be found in the old version of F-PROT. Version 3.16f. Version 6 only contains one Icon that is displayed in the task tray.

Mele,

I cannot reproduce the FP with the ProcessGuard so it seems that Frisk has already implemented a fix for this FP. However I am testing the free version so do correct me if you are using an older version or the full version of PG.

SG

[larryb52]

I installed it & yes it scanned, it canned my baseball exe file 1st off. I than had to reinstall the game (got lucky didn't lose copy protect on game). I than included it in the exclusions but it wouldn't let me run the game. Needless to say I uninstalled it...

[Supportguy]

Larry

There any way you could tell us what game this is that is being detected as malicious?

[rayoflight]

Supportguy
I'm sorry,but what about my problem?

[Supportguy]

Rayoflight

What version of F-Prot are you running. Check the version number under "Updates"-"F-PROT Antivirus Version number"

[larryb52]

-{ Quote: "Larry

There any way you could tell us what game this is that is being detected as malicious?" }-

text baseball game called stratomatic, don't worry it's not a graphic baseball game like EA sells. It's based on real stats, so is a small market type game, Kis6 saw it too but their exclusions didn't stop it from being run for some reason I can't run it...

[Technodrome]

-{ Quote: "Supportguy
I'm sorry,but what about my problem?" }-

Your DPI settings are either high or your screen resolution is non-standard. That’s why you can’t see”OK” button. Click "TAB" key 4 times and then enter. Your scheduled scan should appear.


tD

[Littlemutt]

False positive:

This was flagged during the startup scan just after installing F-Prot:

Found file, D:\Adobe\AdbeRdr80_en_US.exe, infected with

For more information please visit http://www.f-prot.com/support/index.htm

This is the installer for the new Adobe Reader Ver: 8.0

[Supportguy]

I suggest that you update F-Prot. This should not be an issue with the latest definition files and seems to be present only in the default definition files that come with the installation.

Go go go ;)

[Supportguy]

Hmms well lets see now.

-{ Quote: "I'm not a happy camper. I just installed the new F-Prot and it immediately did two bad things...one inexcusable IMO. It began running a scan automatically upon reboot. That is a major no-no and I am stunned that Frisk, of all AV companies, doesn't know that. The AV should never run a scan until the user has the chance to configure it even when it is a simple AV without a lot of configuration available. " }-

This behavior is quite normal for any regular user. However if you had read the last or second last setup window you were given the option to cancel this scan. As well as you can easily abort this scan when it has finished being set up.

-{ Quote: "The second bad thing it did, made worse by the first bad thing, was that it killed the ProcessGuard GUI before it could load in the systray and claimed that it was a virus. You can read my post about the details in the ProcessGuard forum. Suffice it to say that I had to resort to System Restore because F-Prot deleted the file even after I told it not to do that and it was not in quarantine. I did not want to have to reinstall PG so I used system restore to a point before F-Prot was installed." }-

Its unfortunate that F-PROT had a FP in the Processguard executables but this was remedied within 24 hours of the launch of F-PROT.

-{ Quote: "I noted that F-Prot appears to be only for those who use IE as the heuristics seem to be only for IE. I don't use IE so that was disappointing. I could be wrong about that since I didn't have it very long so did not read the entire help file (did read about quarantine and nothing about what to do when F-Prot doesn't put the file in quarantine and it didn't say where quarantine folder is located) but it does have boxes to check/uncheck for heuristic support of IE. :( How disappointing for those of us that never use IE although I know IE users will welcome the heuristics protection." }-

For now this plugin is made for use with IE but we are looking into support for Firefox/Thunderbird. I'm personally a Firefox user and I'm rooting for more support for alternative browsers such as Opera and Firefox. We'll just have too see how effective my campaign will be ;)


-{ Quote: "I don't really mean to rain on the parade...but I believe that I have a very legitimate gripe when F-Prot throws such a bad FP and messes up Process Guard because it didn't give me a chance to change the settings so it would ask first! I know you guys worked very hard for years on this and I'm sure it will be a fine AV like earlier versions of F-Prot (before 3.15 got sort of outdated). None of this would have happened though, and I wouldn't be here complaining, if you had not made F-Prot to run a scan BEFORE the user has a chance to configure it. I never run full scans anyway so I was doubly irritated. I would never have tried F-Prot had I known you did this. I stay away from any AV that will not let me configure it before it does anything." }-

Just remember that the option to cancel a scan at bootup is there in the installation so we do give advanced users the option to cancel this. Also the scan right after the installation is quite normal in almost 99% of the time.
Otherwise we recommend that everyone give us as much feedback as possible because we welcome any comments you can give.

[rayoflight]

-{ Quote: "Your DPI settings are either high or your screen resolution is non-standard. That’s why you can’t see”OK” button. Click "TAB" key 4 times and then enter. Your scheduled scan should appear.
" }-
Thank you.
Yes I have 120 DPI (non-standard) and 1280X1024 (standard) screen resolution.

-{ Quote: "Click "TAB" key 4 times and then enter. Your scheduled scan should appear" }-
It doesn't work.

Supportguy
I use latest version 6.0.5.0
Can your company fix this problem with non-standard DPI?

[Supportguy]

-{ Quote: "Yes,my I have 120 DPI and 1280X1024 screen resolution.


It doesn't work.

Supportguy
I use latest version 6.0.5.0
Can your company fix this problem with non-standard DPI?" }-

There will be most likely be a fix for nonstandard DPI settings for the scheduler in the next incremental version update of F-Prot. So untill then you need to either switch back to the default 96 DPI or wait for the program update to be released.

[Technodrome]

rayoflight,
When you see Schedule Task is highlighted hit the tab key 5 times not 4 (my bad, sorry). Its temporary fix. I have the same problem on my laptop.


tD

[Technodrome]

-{ Quote: "So untill then you need to either switch back to the default 96 DPI or wait for the program update to be released." }-

It’s not possible for me. My laptop screen has WSXGA resolution and if I switch back to 96 DPI everything looks so tiny.;)


tD

[Supportguy]

-{ Quote: "It’s not possible for me. My laptop screen has WSXGA resolution and if I switch back to 96 DPI everything looks so tiny.;) " }-


Oks but we will issue a fix as soon as possible which should be applied automatically when we do. :)

[Technodrome]

-{ Quote: "Oks but we will issue a fix as soon as possible which should be applied automatically when we do. :)" }-

Splendid! ;D


tD

[The Hammer]

-{ Quote: "

I could be wrong about that since I didn't have it very long so did not read the entire help file (did read about quarantine and nothing about what to do when F-Prot doesn't put the file in quarantine and it didn't say where quarantine folder is located)" }- Interesting point here Supportguy.

[The Hammer]

-{ Quote: " Suffice it to say that I had to resort to System Restore because F-Prot deleted the file even after I told it not to do that and it was not in quarantine. " }-Is this behavior normal?

[Supportguy]

-{ Quote: "I could be wrong about that since I didn't have it very long so did not read the entire help file (did read about quarantine and nothing about what to do when F-Prot doesn't put the file in quarantine and it didn't say where quarantine folder is located)

Suffice it to say that I had to resort to System Restore because F-Prot deleted the file even after I told it not to do that and it was not in quarantine.

" }-

Files that are found and deleted are always backed up under "Virus scanners"-Advanced"-"Backup". So resorting to a system restore is quite a drastic measure because you should be able to restore the file through the F-PROT GUI.

Sg

[The Hammer]

Thanks for the responses Supportguy. 8)

[Mele20]

-{ Quote: "Hmms well lets see now.

This behavior is quite normal for any regular user. However if you had read the last or second last setup window you were given the option to cancel this scan. As well as you can easily abort this scan when it has finished being set up.

Its unfortunate that F-PROT had a FP in the Processguard executables but this was remedied within 24 hours of the launch of F-PROT.

For now this plugin is made for use with IE but we are looking into support for Firefox/Thunderbird. I'm personally a Firefox user and I'm rooting for more support for alternative browsers such as Opera and Firefox. We'll just have too see how effective my campaign will be ;)

Just remember that the option to cancel a scan at bootup is there in the installation so we do give advanced users the option to cancel this. Also the scan right after the installation is quite normal in almost 99% of the time.
Otherwise we recommend that everyone give us as much feedback as possible because we welcome any comments you can give." }-

I was out of town all day yesterday. Got back at 11PM. I knew Mike was going to fix the FP yesterday but I was too tired last night to try installing it again. So, I just did so today. I am happy to report that F-Prot no longer alerts on procguard.exe. :)

THERE IS NO OPTION TO CANCEL THE INITIAL SCAN ON BOOT AFTER INSTALLING. Maybe there is if you are a licensed user. I am using the TRIAL version and that option does not exist, as far as I could see, unless I didn't want a key and didn't want any update of the virus definitions.

Perhaps, you mean that I should have declined a key (why do I need a key for a trial anyway)? If I had declined to get a trial key during the install, then from what the setup window said, I believe that I would have gotten NO virus definition updates and there probably would not have been a scan done but there was NOTHING CLEAR about what would happen if I declined to get a key during the install. Obviously I want the latest definitions. The install window said I needed to get a trial key during install. It did not indicate that I could get this key later after I installed. If that is possible then the installer should say that! It said "get subscription, update and scan my computer". That does NOT tell me that it will scan my computer AUTOMATICALLY ON REBOOT. It indicates, at least to me, that F-Prot won't work if I don't get the subscription key and that I must get the key DURING THE INSTALL since that window is there. It does NOT indicate that a scan will start AUTOMATICALLY after reboot, only that I will get the latest definitions and be able to do a scan.

So, I went ahead and got the trial key during the install. I put in my name and email address. Then I was told to reboot to finish the install. I did so, and there was NO opportunity to cancel the scan after rebooting. I did immediately click STOP on the GUI but by the time the GUI was on my screen so I could click, F-Prot had updated and scanned a number of files - 36 I think it was. If there had been another FP in those files then I would have had a problem like I did with ProcessGuard.

So, it is not accurate for you to state that Frisk gives an option to not do the initial scan during setup unless the setup for a person who is ALREADY A LICENSED F-Prot user is different from the setup for a trial. Plus, I want to emphasize that there is NOTHING in the install process that tells the user that a scan will be done AUTOMATICALLY ON REBOOT. That needs to be fixed along with the confusing stuff about getting a key during install if that isn't necessary and that can be done later.

[Mele20]

-{ Quote: "Files that are found and deleted are always backed up under "Virus scanners"-Advanced"-"Backup". So resorting to a system restore is quite a drastic measure because you should be able to restore the file through the F-PROT GUI.

Sg" }-

I explained that the first time F-Prot placed procguard.exe in quarantine. The second time it did not put a copy in quarantine. I also checked Backup from the GUI and it was empty. So, how could I have restored the file? I did restore it from Quarantine the first time but there was nothing to restore the second time. Might there still be a few bugs in F-Prot? Maybe it works right the first time but if you restore the file, and it deletes it again (because either "ask me first" doesn't work right or you forgot to set it to ask), maybe there is a bug and F-Prot doesn't put it in Quarantine/backup the second time. I don't know...maybe what happened to me was a one time weird thing that will never happen to anyone else ...I hope that is the case. But I won't be sure unless I get a nasty and test F-Prot.

[Mele20]

I have the 120dpi problem also. It makes no sense to suggest that someone use 96dpi instead, even if just for awhile, until F-Prot fixes this. People generally use 120dpi because they need it and they can't use 96dpi.

I'm surprised this bug is still there! I think I was the first beta tester to report the 120dpi bug to F-Prot way back when the beta began. Of course, it was a much bigger problem then and was fixed. I guess this small problem with the GUI on 120dpi just slipped by. Fortunately, I generally don't schedule tasks so it doesn't affect me like someone who always schedules.

I have NO F-Prot icon in the systray. ProcessGuard reports that "fprottray.exe" was allowed to start and ProcessExplorer says its running, but I have no icon and no way to interact with F-Prot. :(

Further, ProcessGuard is a bit messed up. It was fine after I used System Restore the other day so I think F-Prot is interfering with it somehow. It's minor but irritating. I cannot minimize PG to the task bar now. I also cannot right click and copy anything from PG. Another probably minor thing was that Gadwin PrintScreen did not load on reboot after I installed F-Prot. I started it manually and it seems ok but it should have loaded at boot. I have not booted another time...just the reboot after installing F-Prot.

EDIT: I rebooted again and now I have an F-Prot icon in the systray. :) I also have the Proxomitron icon which was also missing from the systray back and PrintScreen loaded properly. Things look good now. :)

[Mongol]

With the impressive level of support the Frisk folks are offering here I bring the proposal to vote for F-Prot to open a forum here at Wilders and cast the first Yay vote right now...:thumb: ;)

[Inspector Clouseau]

-{ Quote: "With the impressive level of support the Frisk folks are offering here I bring the proposal to vote for F-Prot to open a forum here at Wilders and cast the first Yay vote right now...:thumb: ;)" }-

Nope, that will not happen. Or in other words "That's not gotta fly" ;D And i would kindly ask that you guys do not open for every F-Prot Question or Problem a new Thread here. Reason is being that this Forum is NOT the Support Forum for our product. With new Threads and Questions you force us to answer, what looks somehow "spammy" when the whole Other Antivirus Section gets filled with fprot topics here. Wilders hosts the Eset Forums. HOWEVER... We will see what we can do regarding this forum "problem" ;)

[Supportguy]

Well lets see.

Scan at first boot after install imo is fine because you can abort all scans manually. FP are not the norm in any case and we stamp them out as soon as they are brought to our attention.

It seems I took someone's word for the feature to abort the scan at first boot after install instead of testing it myself. (Bad Supportguy bad) I then tried a fresh install and could not locate this feature myself. Again, personally I believe this feature is something that needs to be there for 99% of our home use customers.

The FP on ProcessGuard did of course start you off on the wrong foot and if you see any blatant reproducible error with the Quarantine/backup then please let me know. However we aren't aware of any error's with this feature.

The 120DPI bug is a minor graphical bug that we will fix with a automatic update when the fix has been implemented.

-{ Quote: "EDIT: I rebooted again and now I have an F-Prot icon in the systray. I also have the Proxomitron icon which was also missing from the systray back and PrintScreen loaded properly. Things look good now. " }-

I'm glad to hear that everything is working fine overall. I check this forum everyone in awhile and will answer as many questions as I can.

[Mele20]

-{ Quote: "Nope, that will not happen. Or in other words "That's not gotta fly" ;D And i would kindly ask that you guys do not open for every F-Prot Question or Problem a new Thread here. Reason is being that this Forum is NOT the Support Forum for our product. With new Threads and Questions you force us to answer, what looks somehow "spammy" when the whole Other Antivirus Section gets filled with fprot topics here. Wilders hosts the Eset Forums. HOWEVER... We will see what we can do regarding this forum "problem" ;)" }-

Does this mean my question about eicar and F-Prot isn't going to be answered? Should I email support instead?

As for the "forum" problem, I think it would be GREAT if Frisk could set up a forum somewhere. I would REALLY like that and I think others would too although I don't know how much use it would get simply because F-Prot is not a complex, complicated AV (from the end user's point of view) and thus probably would generate a lot of questions when a new version comes out but perhaps not many after the dust settles down...so...

I do understand your point and I won't ask further questions here about problems, etc. with the new F-Prot.

[Inspector Clouseau]

-{ Quote: "As for the "forum" problem, I think it would be GREAT if Frisk could set up a forum somewhere. " }-

Right now under work ;D Most likely online later today. :-*

[Supportguy]

Btw, if you want to cancel the scan at boot the just uncheck the box in the setup that is found here. Make not to read the text at the top. "To update F-PROT Antivirus for windows and run a full scan after restarting the computer..."

185906

Its one of those unforgettable "Gotcha" moments ain't it, dint notice this at first myself.

[Miyagi]

Supportguy:

That screenshot with scan my computer message is really hard to see. It would be nice if there is a separate screen to allow to scan my computer. I, too, don't like the idea of the automatic scan when you first install it. Better yet, just UPDATE message would be enough.

As for the F-PROT forum, please keep us posted IC. Thank you. ;)

[Mele20]

-{ Quote: "Btw, if you want to cancel the scan at boot the just uncheck the box in the setup that is found here. Make not to read the text at the top. "To update F-PROT Antivirus for windows and run a full scan after restarting the computer..."

Its one of those unforgettable "Gotcha" moments ain't it, dint notice this at first myself." }-

Yeah....that is a "gotcha" for sure. It wouldn't have bothered me nearly as much if there had been no PG False Positive. I would have been a bit miffed because I don't like automatic scans after installing an AV program but I would have stopped it once the GUI loaded and it would not have been a big thing. I do understand why you feel most home users benefit from and need the automatic scan so I probably would have said nothing about it IF that FP had not happened.

Mike, let us know when you get the forum up...that is fast moving to get a forum so quickly. :)

[Chubb]

-{ Quote: "Supportguy:

That screenshot with scan my computer message is really hard to see. It would be nice if there is a separate screen to allow to scan my computer. " }-
I have brought this up during the beta stage, and hopefully have a separate enlargable scan window, similar to that of Command AV and Norman 6 beta, so that infected details including the full path can be clearly shown, but it turns out that it is still a small window in the final release. :(