[Rd] OfficeScan deletes Rterm as malware

[Jeroen Ooms]

On Thu, Dec 20, 2018 at 2:52 PM Roland Fuß <roland.fuss using thuenen.de> wrote:
>
> I'm not sure if the problem is actually with R but thought I should
> report this anyway.
>
> After Peter's email regarding the R 3.5.2 release today, I installed the
> Windows version right away (directly from CRAN and not from a mirror).
>
> Unfortunately, my institute's AV sofware TrendMicro OfficeScan 12.0.5147
> Service Pack 1 stops and deletes Rterm.exe when running Rcmd.exe INSTALL
> with a local source package. It reports "OfficeScan detected a Behavior
> Monitoring policy violation and blocked the offending process(es)." and
> "Unauthorized File Encryption" by Rterm.exe.

I can't think of anything that has changed between R 3.5.1 and 3.5.2.
What does "Behavior Monitoring policy violation" mean? Does it say
what sort of policy?

A quick search reveals that the TrendMicro "Unauthorized File
Encryption" message is a frequent false positive for many different
software programs, including this thread at the rstudio forum:
https://support.rstudio.com/hc/en-us/community/posts/208171047-rsession-exe-flagged-as-virus

Perhaps it's just because you're one of the first people to install
this version, and your AV might use some "smart" learning system such
that the false positive will automatically disappear after a few more
people have installed and whitelisted the new R binaries.