minor but interesting FP - Trojan.ExitWindows.e

Discussion in 'ewido anti-spyware forum' started by Trencherman, Sep 13, 2006.

Thread Status:
Not open for further replies.
  1. Trencherman

    Trencherman Registered Member

    Joined:
    Aug 28, 2006
    Posts:
    10
    For a couple of weeks now, this 37-character text string has been identified as Trojan.ExitWindows.e.
    Code:
    WINDOWS\RUNDLL32.EXE user,exitwindows
    To see, save it as a txt file (or htm, etc.) and scan. That txt file is not a trojan. The string is part of a legitimate shortcut command line.

    ewido anti-spyware 4.0.0.172, last update 9/13/206
     
  2. vinzenz.ewido

    vinzenz.ewido former ewido team

    Joined:
    Dec 9, 2005
    Posts:
    425
    Location:
    Brno, Czech Republic
    If you know that this file is legal on your pc then put it on your exception list.

    We cannot remove it since a trojan is using exactly this command. We're sorry for the inconvenience.

    Regards,
    Vinzenz
     
  3. Trencherman

    Trencherman Registered Member

    Joined:
    Aug 28, 2006
    Posts:
    10
    OK. Then there are, I guess, a thousand web pages such as this one on Aumha that contain the same string:
    http://www.aumha.org/win4/a/shutcut.php

    I'm not complaining, just fascinated.
     
Thread Status:
Not open for further replies.