[solved] Avast detect Delphi 7 programs at win32:Killxp trojan!

[deefaze]

Hello team!

I coding with delphi 7 and when i compiling empty project or other project, Avast! detect this at Killxp trojan ... WTF ?
no problem with vps 649-x ... but the problem is here since the update of VPS 650-2


Look the code :

Code: [Select]

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs;

type
  TForm1 = class(TForm)
  private
    { Déclarations privées }
  public
    { Déclarations publiques }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

end.

Push F9 and laugh !





indeed, don't panic ! 


thank you to repair that as fast possible

cya.


edit : oops ... sorry, i think i've don't posted in the good section 

[Lisandro]

I coding with delphi 7 and when i compiling empty project or other project, Avast! detect this at Killxp trojan ... WTF ?
no problem with vps 649-x ... but the problem is here since the update of VPS 650-2
edit : oops ... sorry, i think i've don't posted in the good section 

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the 'a' blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button...
You can use wildcards like * and ?. But be carefull, you should 'exclude' that many files that let your system in danger.

No problems, false positives could be posted in the Viruses and Worms board 

[mouniernetwork]

Try looking at this :

http://forum.avast.com/index.php?topic=25009.msg204838#msg204838

Welcome to the Forum 

Al968

[deefaze]

I coding with delphi 7 and when i compiling empty project or other project, Avast! detect this at Killxp trojan ... WTF ?
no problem with vps 649-x ... but the problem is here since the update of VPS 650-2
edit : oops ... sorry, i think i've don't posted in the good section 

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the 'a' blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button...
You can use wildcards like * and ?. But be carefull, you should 'exclude' that many files that let your system in danger.

No problems, false positives could be posted in the Viruses and Worms board 

Huhuhu, it's not a solution!

because my working directory properties are :



502 projects/executables in ... and i help others coders to debuging their programs,  that require I compile them on my PC...

thus, the only TRUE solution is the fix of win32:killxp sign in the vps.

Try looking at this :

http://forum.avast.com/index.php?topic=25009.msg204838#msg204838

Welcome to the Forum 

Al968

thanks, i go to step 5 directly : "send it to virus(at)avast(dot)com and put as the subject "False Possitive" and add as an attachement a zip file protected by the password "virus" containing the suspicious file."

large zip has envisaged… ^^

thanks all.


edit : i think, the report of false possitive is not really concluant for this problem ... because, delphi can generate many many many differents executables and for the moment all are recognized by avast like killxp trojan...
how i can report that ?!

[mouniernetwork]

Alwil will figure out 
Be confident
I have had this problem before and they changed it 
You just need patience
Al968

[DavidR]

Same problem being reported here http://forum.avast.com/index.php?topic=25104.0, seems like a false positive.

Lets put it this way if you don't send anything even if each is different, there will be nothing to analyse at all, if you can send a few samples to avast.

Send the sample to virus@avast.com zipped and password protected with password in email body and false positive/undetected malware in the subject.

[deefaze]

hello!

problem is solved with vps 651!

thanks all for your disponibility, thanks to alwil for the big great job! 

you can lock this post.

[Lisandro]

problem is solved with vps 651!

Thanks for posting...
Thanks for your patience and report the false positive.
Welcome to forums