[solved] Avast detect Delphi 7 programs at win32:Killxp trojan!

Hello team!

I coding with delphi 7 and when i compiling empty project or other project, Avast! detect this at Killxp trojan … WTF ?
no problem with vps 649-x … but the problem is here since the update of VPS 650-2

Look the code :

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs;

type
  TForm1 = class(TForm)
  private
    { Déclarations privées }
  public
    { Déclarations publiques }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

end.

Push F9 and laugh !

http://darklineteam.free.fr/crazy-avast.gif

indeed, don’t panic ! :-\

thank you to repair that as fast possible :slight_smile:

cya.

edit : oops … sorry, i think i’ve don’t posted in the good section :-[

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
You can use wildcards like * and ?. But be carefull, you should ‘exclude’ that many files that let your system in danger.

No problems, false positives could be posted in the Viruses and Worms board :slight_smile:

Try looking at this :

http://forum.avast.com/index.php?topic=25009.msg204838#msg204838

Welcome to the Forum :wink:

Al968

Huhuhu, it’s not a solution!

because my working directory properties are :

http://darklineteam.free.fr/crazy-avast2.gif

502 projects/executables in … and i help others coders to debuging their programs, that require I compile them on my PC…

thus, the only TRUE solution is the fix of win32:killxp sign in the vps.

thanks, i go to step 5 directly : “send it to virus(at)avast(dot)com and put as the subject “False Possitive” and add as an attachement a zip file protected by the password “virus” containing the suspicious file.”

large zip has envisaged… ^^

thanks all.

edit : i think, the report of false possitive is not really concluant for this problem … because, delphi can generate many many many differents executables and for the moment all are recognized by avast like killxp trojan… :-
how i can report that ?!

Alwil will figure out :wink:
Be confident
I have had this problem before and they changed it :slight_smile:
You just need patience
Al968

Same problem being reported here http://forum.avast.com/index.php?topic=25104.0, seems like a false positive.

Lets put it this way if you don’t send anything even if each is different, there will be nothing to analyse at all, if you can send a few samples to avast.

Send the sample to virus@avast.com zipped and password protected with password in email body and false positive/undetected malware in the subject.

hello!

problem is solved with vps 651!

thanks all for your disponibility, thanks to alwil for the big great job! :smiley:

you can lock this post.

Thanks for posting…
Thanks for your patience and report the false positive.
Welcome to forums :wink: