iseekyoda2 Posted February 10, 2009 ID:55137 Share Posted February 10, 2009 I continue to get FPs from two batch files that I wrote. Not during a scan, but from the protection TSR. The batch files reboot / shutdown my system and are tied into two buttons on my desktop. I get a pop-up everytime asking me what I want to do, ... Ignore, Terminate... The system only seems to give you an option to add to the ignore list if it is picked up in a scan, which my two .bat files do not get noticed. Any help on how I can manually add the files the to ignore list for scans and or protection TSR? Link to post Share on other sites More sharing options...
Staff nosirrah Posted February 10, 2009 Staff ID:55178 Share Posted February 10, 2009 Can you attach those two files here please ? Unless CMD is replaced with a malware version I don't see how a batch file could do this .Not during a scan, but from the protection TSR.This should also not be possible . Link to post Share on other sites More sharing options...
iseekyoda2 Posted February 10, 2009 Author ID:55219 Share Posted February 10, 2009 Can you attach those two files here please ? Unless CMD is replaced with a malware version I don't see how a batch file could do this .This should also not be possible .The forum won't let me upload the files, so here is the contents / text of the files.[Reboot.bat]shutdown -r -t 00[shutdown.bat]shutdown -s -t 00 Link to post Share on other sites More sharing options...
Staff nosirrah Posted February 10, 2009 Staff ID:55257 Share Posted February 10, 2009 Zip and attach please .I also need for you to take a screenshot of the detection and zip and attach that as well .I have a feeling that it is not malwarebytes even detecting this . Link to post Share on other sites More sharing options...
iseekyoda2 Posted February 11, 2009 Author ID:55393 Share Posted February 11, 2009 Zip and attach please .I also need for you to take a screenshot of the detection and zip and attach that as well .I have a feeling that it is not malwarebytes even detecting this .Seeing is believing, I always say Enjoy!Malwarebytes_Upload.zipMalwarebytes_Upload.zip Link to post Share on other sites More sharing options...
exile360 Posted February 11, 2009 ID:55399 Share Posted February 11, 2009 Hah! Kaspersky detects Shutdown.bat as well (as a trojan no less) even though it's just a .bat file calling the shutdown.exe command. Perhaps it's because it could potentially be used maliciously to disallow a computer from being booted up. If I modify the time value Kaspersky no longer detects it. It must be because it forces an immediate shutdown. I changed the 00 to 01 and Kaspersky no longer detects it. Link to post Share on other sites More sharing options...
Root Admin RubbeR DuckY Posted February 12, 2009 Root Admin ID:55760 Share Posted February 12, 2009 We strongly suggest you move the file out of root as that is a common infection ground for worms. There are certain folders that we kick up heuristics on the product (including root) and that is what is making this hit. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now