Page 1 of 1

Virus Alert on program Ampstart.exe

PostPosted: 20. September 2007 02:37
by Barney Fife
I'm getting a Trojan horse alert on ampstart.exe a program I found advertised on this forum.

If you are using this program to run your test server I recommend you run your anti virus.

I had used this program for just a day or 2 and as soon as I got my daily anti virus update it went off.

PostPosted: 20. September 2007 02:48
by Izzy
Please see this post and it's subsequent replies:
http://community.apachefriends.org/f/viewtopi ... 025#108025


=================================================
Take a look at the new DeskTopXampp launch control for XAMPP and XAMPPlite (DTX.exe)
http://nat32.com/dtx/
posted by ridgewood:
http://community.apachefriends.org/f/viewtopi ... 967#103967
Also available here: http://zedfiles.com/DTX/
I highly recommend DTX.
=================================================

Re: Virus Alert on program Ampstart.exe

PostPosted: 20. September 2007 02:57
by lyntuan
Barney Fife wrote:I'm getting a Trojan horse alert on ampstart.exe a program I found advertised on this forum.

If you are using this program to run your test server I recommend you run your anti virus.

I had used this program for just a day or 2 and as soon as I got my daily anti virus update it went off.

Replace your antivirus software with another better one.
Thousands of users downloaded AMPstart and found no problem.

Ampstart and SdBot3 Trojan

PostPosted: 22. September 2007 03:35
by lascasas
I had been using Ampstart for a while with no problems. I then started using the Pidgin IRC client (I had never used IRC before), and when I attempted to start Ampstart, AVG Free flagged a trojan:

Trojan horse IRC/BackDoor.SdBot3.SFO

Needless to say, highly suspicious...

Re: Ampstart and SdBot3 Trojan

PostPosted: 22. September 2007 06:11
by lyntuan
lascasas wrote:I had been using Ampstart for a while with no problems. I then started using the Pidgin IRC client (I had never used IRC before), and when I attempted to start Ampstart, AVG Free flagged a trojan:

Trojan horse IRC/BackDoor.SdBot3.SFO

Needless to say, highly suspicious...

I am surprised that lascasas registered a new account in order to post only this message. You are new user of Apache friends forum, but you had been using Ampstart for a while ???
Needless to say, highly suspicious... I think you don't know what AMPstart is or you have a bad purpose!
I don't care, but you can post an original picture (not modified) of AVG's warning, or post your complain to manufactory of your LCD... :)

Ampstart and trojan

PostPosted: 22. September 2007 13:29
by lascasas
Obviously I didn't need to join until I had this problem.

http://bartolome.d.l.c.googlepages.com/ampstart.png

PostPosted: 23. September 2007 01:18
by lyntuan

PostPosted: 23. September 2007 03:30
by Izzy
This 'you show me yours and I'll show you mine' type double postings are not helping to allay any doubts about the integrity of this exe file.

What it is clearly showing up is that the main stream anti-virus programs out there can't agree.

So in light of the many virus checking software programs that have shown it to have suspicious content I had it independently analyzed by the very reputable institution Secure Systems Lab, Vienna University of Technology.


Although this is a very thorough method and took many hours to complete, they conclude with a caution that their results in no way mean that the file is safe to execute.

Click for more Anubis Analysis Info or project info Anubis: Analyzing Unknown Binaries

Click here to see the Anubis - Analysis Report for AMPstart.exe - which took many hours to complete.

My conclusion is that the program AMPstart.exe is quite safe and free of malware (as I had pointed out in another post about this subject) but that it may contain code that may be misinterpreted as suspicious by a small minority of anti-virus checking programs who rely on Heuristics.

As a precaution for those who still might have their doubts use a firewall to block/report any perceived Internet activity. If your firewall is setup correctly then it should block and/or report all Internet in/out connection attempts by any running process on your PC.


=================================================
Take a look at the new DeskTopXampp launch control for XAMPP and XAMPPlite (DTX.exe)
http://nat32.com/dtx/
posted by ridgewood:
http://community.apachefriends.org/f/viewtopi ... 967#103967
Also available here: http://zedfiles.com/DTX/
I highly recommend DTX.
=================================================

PostPosted: 15. October 2007 13:05
by lyntuan
.