FiveTech Support Forums

Hi,

Malwarebytes flagged specifically the harbour.exe as a threat, from the Borland 32 bit download.

https://fivetechsoft.github.io/Harbour_builder/

https://github.com/FiveTechSoft/Harbour_builder/actions/runs/35991083031#artifacts

https://github.com/FiveTechSoft/Harbour_builder/actions/runs/35991083031/artifacts/10804352696

Even if I exclude the Harbour bin folder from the Malwarebytes quarantine, it doesn't do anything when it's run.

In other words, if we type

harbour.exe

at the command prompt, it displays nothing. There's version number, no syntax list, nothing.

At this point, I'm moving completely to Mingw, but was just curious to see what the borland distribution would do.

Hi FWExplorer,

Thank you for flagging this. We need to identify the exact file before drawing a conclusion. The Actions run and artifact linked in your post are labelled "Harbour for Windows 32 using MinGW", rather than the Borland/BCC 32-bit build you mention. Could you share the exact ZIP download URL or run/artifact ID for the package from which the flagged harbour.exe came?

Please also share the SHA-256 hash of that extracted harbour.exe, the exact Malwarebytes detection name and log or screenshot (including whether it quarantined or blocked the file), and the output and exit code from your command-prompt tests. You mentioned a bare harbour.exe invocation; if you have already tried harbour.exe -h, its output and exit code would help too. There is no need to run a file that Malwarebytes is blocking just to collect these details.

Once we know which build and file are involved, we can investigate the detection and the no-output behavior separately. I don't want to guess whether the alert is correct or the executable is faulty from the information available so far.

Regards,
FiveTech AI

It is clearly a false positive. Please report it to your antivirus maker.

That may well be true, Enrico, but it's still not doing anything after I unflagged it.

I'll try it on a different PC that doesn't have malwarebytes, and report back here.

Hi,

Sorry that I pasted the wrong url. I was downloading both the Mingw and Borland one.

I shut off Malwarebytes, and re-downloaded harbour_win32_bcc_20260829.zip from

https://github.com/FiveTechSoft/Harbour_builder/actions/runs/33276169586#artifacts
https://github.com/FiveTechSoft/Harbour_builder/actions/runs/33276169586/artifacts/9721590484
sha256:86c85dc5f01171497ff9576a74d5afe30a1f61c7ce4a24e422dd7ac7a85dd4b2

, and confirmed that harbour.exe doesn't do anything. Same if I type harbour.exe - h

Here's the result of the test, after I re-downloaded the borland hb:

TCC 34.00.24 x64 Windows 10 [Version 10.0.19045.6466]
Copyright 2024 JP Software Inc. All Rights Reserved
Registered to DESKTOP-Q9535IQ

[C:\TCMD34]c:\hbbc32_test\bin\

[C:\hbbc32_test\bin]harbour

[C:\hbbc32_test\bin]harbour -h

[C:\hbbc32_test\bin]

FiveTech AI wrote:

Hi FWExplorer,

Thank you for flagging this. We need to identify the exact file before drawing a conclusion. The Actions run and artifact linked in your post are labelled "Harbour for Windows 32 using MinGW", rather than the Borland/BCC 32-bit build you mention. Could you share the exact ZIP download URL or run/artifact ID for the package from which the flagged harbour.exe came?

Please also share the SHA-256 hash of that extracted harbour.exe, the exact Malwarebytes detection name and log or screenshot (including whether it quarantined or blocked the file), and the output and exit code from your command-prompt tests. You mentioned a bare harbour.exe invocation; if you have already tried harbour.exe -h, its output and exit code would help too. There is no need to run a file that Malwarebytes is blocking just to collect these details.

Once we know which build and file are involved, we can investigate the detection and the no-output behavior separately. I don't want to guess whether the alert is correct or the executable is faulty from the information available so far.

Regards,
FiveTech AI

Hi FWExplorer,

Thanks for checking the Borland artifact again and for the details. The SHA-256 you reported for the ZIP matches the digest GitHub lists for that CI artifact. That confirms we are discussing the same published ZIP, but it does not yet tell us why harbour.exe shows no output, or what triggered Malwarebytes.

For anyone checking a SHA-256 on Windows: open Command Prompt in the folder containing the downloaded file and run:

certutil -hashfile harbour_win32_bcc_20260829.zip SHA256

For this ZIP, compare the 64-character hash in the result with GitHub's artifact digest (omit its sha256: prefix):

86c85dc5f01171497ff9576a74d5afe30a1f61c7ce4a24e422dd7ac7a85dd4b2

To hash the extracted executable, go to its bin folder and run:

certutil -hashfile harbour.exe SHA256

Alternatively, in PowerShell, use Get-FileHash .\harbour.exe -Algorithm SHA256 and read the Hash column. The file path must point to the file you actually tested; hashing the ZIP and hashing the EXE give different values.

Could you share the Malwarebytes detection name and log or screenshot, including the file path and whether it was quarantined or blocked? Please also send the SHA-256 of the extracted harbour.exe, plus the exit code after harbour -h and whether the same test behaves differently on the other PC. There is no need to run a file that Malwarebytes blocks just to collect these details.

Regards,
FiveTech AI

Thanks,

I'll get you that info tomorrow morning.

Can you tell me how to add an image to a post? Will a google drive link work?

Or is it possible to paste an image or attach a .jpg to a post on the forum?

Malwarebytes detects harbour.exe as malware, MachineLearning/Anomalous.95% File

I'll get the rest of the information for you tomorrow, thanks.

Hi FWExplorer,

Thanks for the update. The Malwarebytes detection name you reported is MachineLearning/Anomalous.95%; we'll keep the alert and the no-output behavior as separate questions while you gather the remaining details.

For the screenshot: in this forum's reply editor I don't see an attachment upload control, so a public image link is the simplest route. Upload the JPG or PNG to an image host, then paste its direct public image URL in your reply. To display it inline, wrap that direct URL in [img]...[/img]; a plain link is fine too. The forum FAQ says inline images need a publicly accessible image URL. A Google Drive link may let readers open the file if sharing is set to “anyone with the link,” but it is not necessarily a direct image URL and may not render inside [img].

Before sharing a Malwarebytes screenshot publicly, please crop or blur your username, computer name, local paths, and any other private details you don't want on the forum. The detection name and file details that matter should remain readable.

Regards,
FiveTech AI

Hi FWExplorer,

Quick update: image attachments are now available directly in the reply editor. Open the Attachments tab and choose Add files; JPG, PNG, GIF and WebP images are accepted, up to 2 MiB per file. You no longer need an image host.

Please crop or blur usernames, computer names, local paths and any other private details before posting your Malwarebytes screenshot.

Regards, FiveTech AI

I confirm the problem. Please use this instead:

https://github.com/FiveTechSoft/harbour_and_xharbour_builds/blob/master/harbour_bcc770_32_20260404.zip

I can update the builds using latest Harbour sources, if you want.

FiveTech AI wrote:

Hi FWExplorer,

Quick update: image attachments are now available directly in the reply editor. Open the Attachments tab and choose Add files; JPG, PNG, GIF and WebP images are accepted, up to 2 MiB per file. You no longer need an image host.

Please crop or blur usernames, computer names, local paths and any other private details before posting your Malwarebytes screenshot.

Regards,
FiveTech AI

Great! I was not aware of that! :-)

Thanks FiveTech_AI,

I'm going to test Enrico's solution. He confirmed there was a problem, and provided an alternate link to a Harbour distribution.

[C:\hbbc32_test\bin]certutil -hashfile d:\download\harbour_win32_bcc_20260829.zip SHA256
SHA256 hash of d:\download\harbour_win32_bcc_20260829.zip:
86c85dc5f01171497ff9576a74d5afe30a1f61c7ce4a24e422dd7ac7a85dd4b2
CertUtil: -hashfile command completed successfully.

[C:\hbbc32_test\bin]certutil -hashfile harbour.exe SHA256
SHA256 hash of harbour.exe:
51350bca9d14c8d83aaed953ac0fe57f61a8dd0dc93c78facee389a18ced8294
CertUtil: -hashfile command completed successfully.

FiveTech AI wrote:

Hi FWExplorer,

Quick update: image attachments are now available directly in the reply editor. Open the Attachments tab and choose Add files; JPG, PNG, GIF and WebP images are accepted, up to 2 MiB per file. You no longer need an image host.

Please crop or blur usernames, computer names, local paths and any other private details before posting your Malwarebytes screenshot.

Regards,
FiveTech AI

Enrico,

Thanks, but the harbour.exe executable in your distribution, is from way back in April. Antonio didn't announce the official 3.2.0 stable release until July 7th.

I have a working distribution of BC 32 from Antonio's source that seems to work ok, although I haven't fully tested it yet.

https://drive.google.com/file/d/1a-Ik327_KHCR7WKhTTLwMvfahly47bTb/view?usp=drive_link

[C:\hb32_bcc_prod_my_version\bin]harbour
Harbour 3.2.0 (r2607071000)
Copyright (c) 1999-2025, https://harbour.github.io/

Syntax:  C:\hb32_bcc_prod_my_version\bin\harbour.exe <file[s][.prg]|@file> [options]

Options:  -a               automatic memvar declaration

...
...

The only problem is that I'm not able to patch the libraries in the extra folder. The patch.exe utility just opens a blank window and doesn't do anything.

Edit: I was able to get patch.exe working. I had the wrong command line parameters.

Funny thing is, when I worked with Claude to generate the BC 5.8.2 binaries, Claude didn't explain how to run patch. I had to do a google search to figure it out.

Alright, I'm going to patch all of the extras, then build the libraries, test the compiler with different modules, and then share.

Antonio - as always, thanks for your support. Indispensable.

Enrico Maria Giordano wrote:

I confirm the problem. Please use this instead:

https://github.com/FiveTechSoft/harbour_and_xharbour_builds/blob/master/harbour_bcc770_32_20260404.zip

I can update the builds using latest Harbour sources, if you want.

FWExplorer wrote:

Enrico,

Thanks, but the harbour.exe executable in your distribution, is from way back in April. Antonio didn't announce the official 3.2.0 stable release until July 7th.

I can update the builds using latest Harbour sources from the repository. Just need a confirm from Antonio.

Sounds good, thanks.

Enrico Maria Giordano wrote:

Enrico,

Thanks, but the harbour.exe executable in your distribution, is from way back in April. Antonio didn't announce the official 3.2.0 stable release until July 7th.

I can update the builds using latest Harbour sources from the repository. Just need a confirm from Antonio.