Re: [Jmri-developers] Clamware scan

[Matthew H. <mat...@gm...>]

Walt,

These seem to be two separate things.

On 15 July 2016 at 09:45, Walter Thompson
<wal...@gm...> wrote:
> Clam ware found this
> C:\Users\Walt\AppData\Local\Temp\LaunchJMRI\PanelPro.exe:
> Win.Malware.Agent1012317919/CRDF-1 FOUND
>
> What should I do?
>

The 'PanelPro.exe' in the Temp folder is, in essence, a copy of
'javaw.exe' that's put there by 'LaunchJMRI.exe' to facilitate the
display in the Task Manager of the specific JMRI application being
run.

Now, some anti-virus suites (and system policies) do not like the
running of applications from the Temp folder as certain malware use
this technique.

It should be safe but to verify, double check the size of this versus
javaw.exe from your Java installation (probably in 'C:\Program
Files\Java\jre1.8.0_91\bin').


> Clamware removed it and when I launch PP it seems to works OK: But the
> system Console doen't look good.
> System Console:
> 2016-07-15 02:40:26,000 util.Log4JUtil                        INFO  - ******
> JMRI log ******* [main]
> 2016-07-15 02:40:26,051 util.Log4JUtil                        INFO  - This
> log is appended to file: C:\Users\Walt\JMRI\log\messages.log [main]
> 2016-07-15 02:40:26,051 util.Log4JUtil                        INFO  - This
> log is stored in file: C:\Users\Walt\JMRI\log\session.log [main]
> 2016-07-15 02:40:26,071 apps.Apps                             INFO  -
> PanelPro version 4.5.1-R44ce773 starts under Java 1.8.0_91 on Windows 10 x86
> v10.0 at Fri Jul 15 02:40:26 CDT 2016 [main]
> 2016-07-15 02:40:29,904 apps.Apps                             INFO  -
> Starting with profile HOn3.3ec971a3 [main]
> 2016-07-15 02:40:30,631 node.NodeIdentity                     INFO  - Using
> jmri-64006A824CD2-3ec971a3 as the JMRI Node identity [main]
> [Fatal Error] :-1:-1: Premature end of file.

These would seem to suggest that there is a problem reading the profile files

> 2016-07-15 02:40:30,681 prefs.JmriConfiguration               WARN  - Cannot
> parse
> C:\Users\Walt\JMRI\HOn3\profile\jmri-64006A824CD2-3ec971a3\user-interface.xml

Please verify if this file exists on your system and is readable in
something like Notepad or some other XML editor. Don't change it, just
verify that it can be read.

> [main]
> org.xml.sax.SAXParseException; Premature end of file.
> at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
> at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
> at jmri.util.xml.XMLUtil.parse(XMLUtil.java:364)
> at
> jmri.util.prefs.JmriConfiguration.getConfigurationFragment(JmriConfiguration.java:52)
> at
> jmri.managers.JmriUserPreferencesManager.readElement(JmriUserPreferencesManager.java:1327)
> at
> jmri.managers.JmriUserPreferencesManager.readComboBoxLastSelections(JmriUserPreferencesManager.java:1029)
> at
> jmri.managers.JmriUserPreferencesManager.readUserPreferences(JmriUserPreferencesManager.java:997)
> at
> jmri.managers.JmriUserPreferencesManager.getDefault(JmriUserPreferencesManager.java:85)
> at apps.Apps.<init>(Apps.java:222)
> at apps.PanelPro.PanelPro.<init>(PanelPro.java:41)
> at apps.PanelPro.PanelPro.main(PanelPro.java:98)
> [Fatal Error] :-1:-1: Premature end of file.
> 2016-07-15 02:40:30,704 prefs.JmriConfiguration               WARN  - Cannot
> parse
> C:\Users\Walt\JMRI\HOn3\profile\jmri-64006A824CD2-3ec971a3\user-interface.xml
> [main]
> org.xml.sax.SAXParseException; Premature end of file.
> at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
> at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
> at jmri.util.xml.XMLUtil.parse(XMLUtil.java:364)
> at
> jmri.util.prefs.JmriConfiguration.getConfigurationFragment(JmriConfiguration.java:52)
> at
> jmri.managers.JmriUserPreferencesManager.readElement(JmriUserPreferencesManager.java:1327)
> at
> jmri.managers.JmriUserPreferencesManager.readPreferencesState(JmriUserPreferencesManager.java:1056)
> at
> jmri.managers.JmriUserPreferencesManager.readUserPreferences(JmriUserPreferencesManager.java:998)
> at
> jmri.managers.JmriUserPreferencesManager.getDefault(JmriUserPreferencesManager.java:85)
> at apps.Apps.<init>(Apps.java:222)
> at apps.PanelPro.PanelPro.<init>(PanelPro.java:41)
> at apps.PanelPro.PanelPro.main(PanelPro.java:98)
> [Fatal Error] :-1:-1: Premature end of file.
> 2016-07-15 02:40:30,706 prefs.JmriConfiguration               WARN  - Cannot
> parse
> C:\Users\Walt\JMRI\HOn3\profile\jmri-64006A824CD2-3ec971a3\user-interface.xml
> [main]
> org.xml.sax.SAXParseException; Premature end of file.
> at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
> at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
> at jmri.util.xml.XMLUtil.parse(XMLUtil.java:364)
> at
> jmri.util.prefs.JmriConfiguration.getConfigurationFragment(JmriConfiguration.java:52)
> at
> jmri.managers.JmriUserPreferencesManager.readElement(JmriUserPreferencesManager.java:1327)
> at
> jmri.managers.JmriUserPreferencesManager.readSimplePreferenceState(JmriUserPreferencesManager.java:1122)
> at
> jmri.managers.JmriUserPreferencesManager.readUserPreferences(JmriUserPreferencesManager.java:999)
> at
> jmri.managers.JmriUserPreferencesManager.getDefault(JmriUserPreferencesManager.java:85)
> at apps.Apps.<init>(Apps.java:222)
> at apps.PanelPro.PanelPro.<init>(PanelPro.java:41)
> at apps.PanelPro.PanelPro.main(PanelPro.java:98)
> [Fatal Error] :-1:-1: Premature end of file.
> 2016-07-15 02:40:30,707 prefs.JmriConfiguration               WARN  - Cannot
> parse
> C:\Users\Walt\JMRI\HOn3\profile\jmri-64006A824CD2-3ec971a3\user-interface.xml
> [main]
> org.xml.sax.SAXParseException; Premature end of file.
> at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
> at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
> at jmri.util.xml.XMLUtil.parse(XMLUtil.java:364)
> at
> jmri.util.prefs.JmriConfiguration.getConfigurationFragment(JmriConfiguration.java:52)
> at
> jmri.managers.JmriUserPreferencesManager.readElement(JmriUserPreferencesManager.java:1327)
> at
> jmri.managers.JmriUserPreferencesManager.readTableColumnPreferences(JmriUserPreferencesManager.java:1143)
> at
> jmri.managers.JmriUserPreferencesManager.readUserPreferences(JmriUserPreferencesManager.java:1000)
> at
> jmri.managers.JmriUserPreferencesManager.getDefault(JmriUserPreferencesManager.java:85)
> at apps.Apps.<init>(Apps.java:222)
> at apps.PanelPro.PanelPro.<init>(PanelPro.java:41)
> at apps.PanelPro.PanelPro.main(PanelPro.java:98)
> [Fatal Error] :-1:-1: Premature end of file.
> 2016-07-15 02:40:30,708 prefs.JmriConfiguration               WARN  - Cannot
> parse
> C:\Users\Walt\JMRI\HOn3\profile\jmri-64006A824CD2-3ec971a3\user-interface.xml
> [main]
> org.xml.sax.SAXParseException; Premature end of file.
> at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
> at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
> at jmri.util.xml.XMLUtil.parse(XMLUtil.java:364)
> at
> jmri.util.prefs.JmriConfiguration.getConfigurationFragment(JmriConfiguration.java:52)
> at
> jmri.managers.JmriUserPreferencesManager.readElement(JmriUserPreferencesManager.java:1327)
> at
> jmri.managers.JmriUserPreferencesManager.readWindowDetails(JmriUserPreferencesManager.java:1232)
> at
> jmri.managers.JmriUserPreferencesManager.readUserPreferences(JmriUserPreferencesManager.java:1001)
> at
> jmri.managers.JmriUserPreferencesManager.getDefault(JmriUserPreferencesManager.java:85)
> at apps.Apps.<init>(Apps.java:222)
> at apps.PanelPro.PanelPro.<init>(PanelPro.java:41)
> at apps.PanelPro.PanelPro.main(PanelPro.java:98)
> 2016-07-15 02:40:31,188 locobuffer.LocoBufferAdapter          INFO  - COM3
> port opened at 57600 baud with DTR: true RTS: true DSR: false CTS: true  CD:
> false [main]
> [Fatal Error] :-1:-1: Premature end of file.
> 2016-07-15 02:40:31,381 prefs.JmriConfiguration               WARN  - Cannot
> parse
> C:\Users\Walt\JMRI\HOn3\profile\jmri-64006A824CD2-3ec971a3\user-interface.xml
> [main]
> org.xml.sax.SAXParseException; Premature end of file.
> at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
> at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
> at jmri.util.xml.XMLUtil.parse(XMLUtil.java:364)
> at
> jmri.util.prefs.JmriConfiguration.putConfigurationFragment(JmriConfiguration.java:78)
> at
> jmri.managers.JmriUserPreferencesManager.saveElement(JmriUserPreferencesManager.java:1337)
> at
> jmri.managers.JmriUserPreferencesManager.saveWindowDetails(JmriUserPreferencesManager.java:1315)
> at
> jmri.managers.JmriUserPreferencesManager.setProperty(JmriUserPreferencesManager.java:606)
> at jmri.jmrit.roster.Roster.setDefaultRosterGroup(Roster.java:1309)
> at jmri.jmrit.roster.Roster.<init>(Roster.java:162)
> at jmri.jmrit.roster.Roster.<init>(Roster.java:168)
> at jmri.jmrit.roster.Roster.getDefault(Roster.java:209)
> at
> jmri.jmrit.roster.RosterConfigManager.initialize(RosterConfigManager.java:64)
> at
> jmri.implementation.JmriConfigurationManager.initializeProvider(JmriConfigurationManager.java:249)
> at
> jmri.implementation.JmriConfigurationManager.lambda$2(JmriConfigurationManager.java:245)
> at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
> at java.util.stream.ReferencePipeline$Head.forEach(Unknown Source)
> at
> jmri.implementation.JmriConfigurationManager.initializeProvider(JmriConfigurationManager.java:244)
> at
> jmri.implementation.JmriConfigurationManager.lambda$1(JmriConfigurationManager.java:178)
> at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
> at java.util.stream.ReferencePipeline$Head.forEach(Unknown Source)
> at
> jmri.implementation.JmriConfigurationManager.load(JmriConfigurationManager.java:177)
> at
> jmri.implementation.JmriConfigurationManager.load(JmriConfigurationManager.java:166)
> at apps.Apps.<init>(Apps.java:266)
> at apps.PanelPro.PanelPro.<init>(PanelPro.java:41)
> at apps.PanelPro.PanelPro.main(PanelPro.java:98)
> 2016-07-15 02:40:33,088 startup.StartupActionModelUtil        ERROR - Did
> not find class "jmri.jmrix.srcp.srcpmon.SRCPMonAction" [main]
> 2016-07-15 02:40:33,166 startup.StartupActionModelUtil        ERROR - Did
> not find class "jmri.jmrix.srcp.packetgen.PacketGenAction" [main]
> 2016-07-15 02:40:35,122 configurexml.PerformFileModelXml      INFO  - Load
> file C:\Users\Walt\Dropbox\jmri\HOn3\Walts Narrow Gauge.xml [main]
> 2016-07-15 02:40:36,973 util.FileUtilSupport                  INFO  - File
> path program: is C:\Program Files (x86)\JMRI\ [main]
> 2016-07-15 02:40:36,973 util.FileUtilSupport                  INFO  - File
> path preference: is C:\Users\Walt\Dropbox\jmri\HOn3\ [main]
> 2016-07-15 02:40:36,974 util.FileUtilSupport                  INFO  - File
> path profile: is C:\Users\Walt\JMRI\HOn3\ [main]
> 2016-07-15 02:40:36,975 util.FileUtilSupport                  INFO  - File
> path settings: is C:\Users\Walt\JMRI\ [main]
> 2016-07-15 02:40:36,975 util.FileUtilSupport                  INFO  - File
> path home: is C:\Users\Walt\ [main]
> 2016-07-15 02:40:36,979 util.FileUtilSupport                  INFO  - File
> path scripts: is C:\Users\Walt\Dropbox\jmri\HOn3\py scripts\HOn3 loco's\
> [main]
> 2016-07-15 02:40:37,824 util.prefs                            WARN  - Could
> not open/create prefs root node Software\JavaSoft\Prefs at root 0x80000002.
> Windows RegCreateKeyEx(...) returned error code 5. [init prefs]

And this is not a problem per se, but is more of an annoying message
in the console. It can be resolved through adding a Windows registry
entry, but let's not worry about that now.

Anyhow, if the xml file highlighted earlier is existing and is able to
be read, then I'd suggest telling Clam that PanelPro.exe in the Temp
folder is OK and not to remove it.

Depending on when it was removed (i.e. if during launch of PanelPro),
it's possible that Java had a bit of the 'rug pulled from underneath
it' and started behaving a bit odd...

Best regards,

Matt H