Bug - Not A Bug Ransomware shield triggered

[Phantom Watson]

Downloading and running the .jar file for build 27136 results in my ransomware shield getting triggered.

 

[fronobulax]

Install and run KoLmafia from an unprotected folder. C:\KoLmafia is normally unprotected and C:\Users\graha\kolmafia is probably unprotected so you could create either one and try again.

Alternatively back up Downloads\Images and then delete it and then run KoLmafia.

My going in position is that Avast is being cautious because of where you have tried to store and run KolMafia.

 

[Ryo_Sangnoir]

Try running Mafia in a folder that isn't Downloads. The "Byte" folder isn't created by KoLMafia -- it's presumably something you've created.

 

[Phantom Watson]

My issue is less "I can't run KoLMafia" and more "KoLMafia is apparently accessing unrelated folders". My first impression was that actual ransomware snuck its way into a release.

If this is a false positive, what legitimate reason would the program have to start scanning and accessing unrelated directories in the user's system?

 

[katyarn]

On Windows, KoLmafia.jar will attempt to create folders for its data in the same location as the .jar file. If you have an existing images folder beside it, then it will access that. That's part of the expected behavior. I would guess that this was a false positive as a result of having an existing Images folder in the Downloads folder.

It's best to put the KoLmafia.jar file in a separate folder on its own so it can generate its folders and files and not mix them up with other data.

 

[Phantom Watson]

Oh, that's interesting. Thanks for explaining! I'll switch this thread to "not a bug".

A note in https://wiki.kolmafia.us/index.php/Installation might help others avoid the same issue.