minor but interesting FP - Trojan.ExitWindows.e

Discussion in 'ewido anti-spyware forum' started by Trencherman, Sep 13, 2006.

Thread Status:
Not open for further replies.
  1. Trencherman

    Trencherman Registered Member

    Joined:
    Aug 28, 2006
    Posts:
    10
    For a couple of weeks now, this 37-character text string has been identified as Trojan.ExitWindows.e.
    Code:
    WINDOWS\RUNDLL32.EXE user,exitwindows
    To see, save it as a txt file (or htm, etc.) and scan. That txt file is not a trojan. The string is part of a legitimate shortcut command line.

    ewido anti-spyware 4.0.0.172, last update 9/13/206
     
    Trencherman, Sep 13, 2006
    #1
  2. vinzenz.ewido

    vinzenz.ewido former ewido team

    Joined:
    Dec 9, 2005
    Posts:
    425
    Location:
    Brno, Czech Republic
    If you know that this file is legal on your pc then put it on your exception list.

    We cannot remove it since a trojan is using exactly this command. We're sorry for the inconvenience.

    Regards,
    Vinzenz
     
    vinzenz.ewido, Sep 14, 2006
    #2
  3. Trencherman

    Trencherman Registered Member

    Joined:
    Aug 28, 2006
    Posts:
    10
    OK. Then there are, I guess, a thousand web pages such as this one on Aumha that contain the same string:
    http://www.aumha.org/win4/a/shutcut.php

    I'm not complaining, just fascinated.
     
    Trencherman, Sep 14, 2006
    #3
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...