Feedreader.com - Self modifying code problem - Comments

Greetings, does this event

ingmar — Mon, 21 Jan 2008 16:02:50 +0200

Greetings,

does this event occurs every time ? Could you perform test like, leave just 3-4 (non https) feeds and run FR.
Feedreader uses also, embedded Internet Explorer object, is IE with all latest updates.

Could you test FR 3.12, we are using now latest (stable) Firebird dll's.

FR is developed under Delphi with range checking and other datasafe options,
so "buffer overflow attack" is quite unlikely.

Also you could test Feedreader MYSQL edition, this is alfa state product, does this error occours also there.

Ingmar
------
FR dev

We are using Cisco Security

id09542 — Mon, 21 Jan 2008 15:51:49 +0200

We are using Cisco Security Agent which monitors Registry changes, code execution etc. The company is turning up the agreesiveness of this function which is causing the above message to appear. Currently, I can bypass, but I fear in the future I will no longer be able to.

Greetings,

ingmar — Fri, 18 Jan 2008 23:30:36 +0200

Greetings,

FR doesn't modify code at all, we don't do those hacks.
Feedreader uses Firebird database librarys , SSL and embedded IE;
Do you have in FR some feeds that are requiring SSL, maybe something there, but this code is also protected. You could disable such feeds and try again.

Which program gives such error ? DEP or some antivirus heuristics.

Also our products are always scanned with antivirus programs.

Ingmar
------
FR dev

Self modifying code problem

id09542 — Fri, 18 Jan 2008 20:01:03 +0200

Running FR 3.11 on Win/XP. Our corporate machines are beginning to strngthen policies on what can run on our machines, the latest victim is FR, we are not allowing code to modfy itself due to some virus attacks use this route. I now receive this meesage when FR runs:

1/18/2008 10:56:44 AM: The process 'D:\Program Files\FeedReader30\feedreader.exe' (as user xxxxxx\yyyyyyy) attempted to call the function CreateThread from a buffer (the return address was 0x404eaf). The code at this address is '0c5250b8 3c4e4000 505653e8 a9c4ffff 5f5e5b5d c20c008b c050e8a2 c4ffffc3' This either happens when a process uses self-modifying code or when a process has been subverted by a buffer overflow attack.

Thoughts anyone?