The job of an antivirus is to monitor all the files that are created on the PC to detect, and eliminate, potential threats. If the file is reliable, it is left as is. And if it is considered a threat, it is blocked and sent to quarantine. Trusted programs are typically whitelisted to avoid unnecessary resource usage. However, recently, a bug in Chrome has been causing all files created by the browser to be detected, and deleted, by antivirus. A very annoying bug that, luckily, has already been fixed.
When a program creates a file, especially when it does so in a strange way, this file is temporarily locked until it is analyzed and it is decided whether or not it is reliable. Chrome is a program that generates many files, both cache and temporary as well as its own, configuration and user profile.
Google began using the ImportantFileWriter function in its browser to create files that the user saves. For example, to save browser bookmarks. This function, generally, tends to attract the attention of antivirus, since it is one of the most used by payloads and malware in general. This has caused many users to encounter problems when trying to save bookmarks, or other types of files, with Google Chrome. Antivirus detected the creation of the new file , and blocked it for safety. The problems ranged from not being able to save the file to a crash of the browser itself.
Luckily, one of the latest changes to Chromium has eradicated this problem.
Chrome changes the way files are created
Google has gone back in its browser, and has removed the ImportantFileWriter function by the previous method, ReplaceFile , when creating new files in Windows. This means that the antivirus no longer detects the browser activity as “malicious” and can create it correctly.
The problem with this method is that it is quite redundant. Its very name indicates that this is a function that “replaces” the file multiple times to ensure that it is created correctly. For this reason, Google has introduced a machine learning system so that, as we use the method, it checks how many retries to perform.
The change will also log (as part of telemetry) the number of retries required. In this way, in future versions this version can be adjusted much better.
This change will come soon to all users
The change was made to the Chromium code on December 30. Users of the Canary branch, as it is compiled every day with the changes that have been introduced, can already enjoy it. However, the rest of the users, those of us who use the stable version of the browser, will still have to wait a little longer before being able to enjoy it.
This issue only affects Windows users, so the solution is for her only. Specifically, the change has been introduced in the important_file_writer.cc library, one of the exclusive Microsoft operating system libraries.
This change is expected to reach all users at once with the next Chrome update. Unlike other changes and other functions, this one will not go through the Canary and Beta branches in debug mode. Therefore, if we have experienced this problem first-hand, we can only stay tuned to update as soon as possible.
