ESET AV And Fillable Forms

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

Hi All 
We have a showstopper with ESET AV.  As soon as we declare a Global JavaScript package it reads the pdf as a trojan virus.  Has anyone seen this before?

Cheers
André

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
André Labuschagné Members Profile Find Members Posts Beginner Joined: 20 Sep 19 Location: Sandton Status: Offline Points: 17	Post Options Post Reply Quote André Labuschagné Report Post Thanks(0) Quote Reply Topic: ESET AV And Fillable Forms Posted: 29 Sep 19 at 12:06PM
	Hi All We have a showstopper with ESET AV. As soon as we declare a Global JavaScript package it reads the pdf as a trojan virus. Has anyone seen this before? Cheers André

Ingo Members Profile Find Members Posts Moderator Group Joined: 29 Oct 05 Status: Offline Points: 3524	Post Options Post Reply Quote Ingo Report Post Thanks(0) Quote Reply Posted: 29 Sep 19 at 2:04PM
	the only possible action is to call ESET AV with the description of your issue to make a future ESET AV more accurate. In the past (very past past ;-) i've made several trys with exe- and dll-compressors. There i've got similar actions from av-tools ;-) The question is: Is the javascript package the problem (perhaps you can remove some functionalities) or is the GetGlobalJavaScript-syntax from QuickPDF the problem?
	Cheers, Ingo

André Labuschagné Members Profile Find Members Posts Beginner Joined: 20 Sep 19 Location: Sandton Status: Offline Points: 17	Post Options Post Reply Quote André Labuschagné Report Post Thanks(0) Quote Reply Posted: 29 Sep 19 at 4:06PM
	Hi Ingo I have actually been in contact with them a week ago and sent them the pdf to check for a false positive and they came back clueless. Go figure. I was completely gobsmacked. IMHO AV programmers are clueless. It is their algorithm. They should know what the heck they wrote and why their algorithm is not happy with the javascript. They have requested a before and after example and I have tracked it to perfectly acceptable Acrobat JS without which these fillable forms would not exist. These functions cannot be removed. I am going to send that to them first thing tomorrow morning. It is not the get global as I have rebuilt the entire pdf without any javascript call to any global scripts. It is failing on the set global. Maybe there is something wrong in there - I will play around with the very first one and revert if I get it sorted. I doubt that Foxit have got it all wrong. I know of developers who use fillable forms with Foxit and the very reason why we have joined the club. Thanks for the input. Cheers André

André Labuschagné Members Profile Find Members Posts Beginner Joined: 20 Sep 19 Location: Sandton Status: Offline Points: 17	Post Options Post Reply Quote André Labuschagné Report Post Thanks(0) Quote Reply Posted: 29 Sep 19 at 6:09PM
	Hi Ingo I have found where ESET is gong south - SetOpenActionJavaScript(TheJavascript) - it does not like either the running of a script on file open or the code itself. All I am doing is setting : commitOnSelChange to true for the combos. Maybe it does not like the syntax or the concept of running the code when the document is open. Will keep you posted. Cheers André

André Labuschagné Members Profile Find Members Posts Beginner Joined: 20 Sep 19 Location: Sandton Status: Offline Points: 17	Post Options Post Reply Quote André Labuschagné Report Post Thanks(0) Quote Reply Posted: 29 Sep 19 at 10:53PM
	Hi Ingo Well, well, well. In my estimate ESET is pretty buggy. I introduced the javascript into the pdf bit by bit and now it is happy with the pdf. Nothing else has changed. Will send this pdf to ESET as well. You gotta just love AV products. Cheers André

Ingo Members Profile Find Members Posts Moderator Group Joined: 29 Oct 05 Status: Offline Points: 3524	Post Options Post Reply Quote Ingo Report Post Thanks(0) Quote Reply Posted: 30 Sep 19 at 9:55PM
	Hi Andre, please keep in mind that users of pdf-readers are able to deactivate javascript code for some security reasons... http://pdfcomments.blogspot.com/2012/04/my-dear-readers-regarding-trojan-and.html
	Cheers, Ingo

André Labuschagné Members Profile Find Members Posts Beginner Joined: 20 Sep 19 Location: Sandton Status: Offline Points: 17	Post Options Post Reply Quote André Labuschagné Report Post Thanks(0) Quote Reply Posted: 02 Oct 19 at 1:01PM
	Hi Ingo Thanks for that - we are aware of that and warn them before hand. The interesting thing is that it worked and then did not work and then did again with zero changes to the AV. We now have a direct line into the ESET developers and have sent them the one attracting the block and the one not attracting the block. Both of course have javascript in it. Weird stuff. Have not heard from them but will revert if and when we do. And thanks for the link. Cheers André