trojan horse in wfpdisable.exe?

hi there,

I just did a scan after viruses on my system with the "knoppicillin"-CD (bootable Linux) from the German mag "c't" and it found the "wfpdisable.exe" ("C:WINDOWSFLYAKITEOSXTOOLSWFPDISABLE.EXE") infected by "Trojan.Wfpdis.A".

The anti-virus engines used were Kaspersky and Sophos.

Is that a false alarm, or did anyone else have had the same alert?

#377261

at work, sophos anti-virus also gives me false positives regarding flyakite. ignore them, flyakite is 100% virus-free. always has been; always will be.

#377268

According to my sources (below) this file disables the "System File Check" - the main Windows File Protection module, this is probably done to patch certain system-dlls.

Sources:

http://www.winfuture-forum.de/index.php?showtopic=68118 (german, sorry)

http://www.spywaredb.com/remove-wfpdisable/

http://diamondcs.com.au/processguard/index...tack-disablewfp

#377282

Yeah, it's a false positive...trust me (us), Flyakite doesn't have any Trojans in it.

-NC

#377293

According to my sources (below) this file disables the "System File Check" - the main Windows File Protection module, this is probably done to patch certain system-dlls.http://diamondcs.com.au/processguard/index...tack-disablewfp

Windows has System File Protection built in which yes, is good in terms of protecting your system because if a virus were to delete or replace one of your core system files, then Windows will overwrite it with a new copy, meaning that viruses have less impact on a system in this way. It also stops you accidentally deleting important system files aswell.

However, for system modders this has become a problem. The reason why it's probably being picked up as a false positive is that it's possible that some people do use them alongside other trojans as a way of compromising a system. This isn't the case with FlyakiteOSX.

As people have said, flyakite's software is virus & trojan free and always will be (he's definately a guy you can trust!)

FlyakiteOSX uses that file to temporarily disable the file protection on your system so that it can modify your system files. After it has finished, file protection is re-enabled. Early versions did pop up annoying warning messages and it's taken flyakite a lot of work to make the installation process as simple as possible without those scary warnings.

So yeah, don't worry about that file. Just sit and bask in the knowledge that your system is not only fine, but that it looks a heck of a lot better than it did before you installed FlyakiteOSX

#377382