WinBatch Falsely Flagged as a Virus

Database Search

If you can't find the information using the categories below, post a question over in our WinBatch Tech Support Forum.

TechHome

WinBatch

Miscellaneous

Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.

WinBatch Flagged as a Virus

Keywords:

Virus Anti-Virus AntiVirus Scanner False Positive Alert Detection Signature Definitions win32:evo-gen Whitelist White List Exclusion Exclude Exploit

Sometimes Antivirus tools report that a program is infected with a Virus or Trojan, even when the program is not really infected with any malicious code. This kind of problem is known as "False Positive" or "False Alert", If you have your virus scanner scan for unknown type virues AND you have an old version of the virus definitions, then WinBatch might get flagged. We have had issues in the past with various Virus scanners falsely claiming a virus on the WIL DLL, the WBCompiler.exe or even a Compiled EXEs generated by our Compiler.

So What Can You Do About It?

First, make sure your Antivirus software has all of the latest virus definitions. This is gnerally handled via an update inside said antivirus software.
Once you have confirmed you have all of the latest definitions and you continue to have problems, you may have to temporarily "whitelist" the file or add it to the "exclusions" list. The method to handle this is dependant on the Antivirus tool you are using. Consult the documentation.
Now you should be up and running again, but you should still submit a 'false positive' report to the antivirus vendor. That way they can update their virus definitions to no longer flag healthy files. Some tools allow you to submit directly from the software, where as others require to submit online. See the table below for a list of antivirus tools and links to their Online False Positive Submission forms.

Question:

FYI, Trend Micro AV reports "Generic Trojan" on WBDCI34I.DLL and WBOIC34I.DLL (These are the WB DLLs for WB2002K).

Has anyone else reported this? I assume it is bogus, but wanted to check.

Answer:

Sometimes Antivirus scanner reports that a program is infected with a Virus or Trojan, even when the program is not really infected with any malicious code. This kind of problem is known as "False Positive" or "False Alert",

If you have your virus scanner to scan for unknown type virues AND you have an old version of the virus tables, then WinBatch might get flagged.

We have had issues before with various Virus scanner falsely claiming a virus on the WIL DLL.

Question:

Here is the situation:
I had a coworker of mine bring me his son's pc. It's is running WinXP Home Edition. When he logs in w/admin privs under his username a porn XXX dialer dialog pops up and hijacks the pc to the point where I cannot do anything administratively, like run regedit, msconfig, services control panel, not even task manager runs.
I have removed all sorts of spy/malware from the computer, but the XXX dialer persists. What lead me to think that it might be WINBATCH being used is that in the registry there is a Wilson Window Ware key that appears to load a .DLL called WBDCC34I.DLL. So my questions are these:
1 - Is Winbatch capable of being maliciously used for such purposes?
2- Would it harm anything to delete the Wilson Window Ware reg key.

BTW...Nothing about Wilson or WINBATCH show up in Add/Remove Programs

Answer:

Should not harm anything, but just deleting the key probably would no do anything.

However. Lets figure it out first.

a) Search the hard drive for that file WBDCC34I.DLL. What directory is it in?

If it is in a directory with a manageable number of files...withat other files, especially EXE's are in that directory.

If there are a manageable number of exe;s right click the exe name and select "Properties". Select the Version Tab and read the information in the box at the bottom. Anything mention WinBatch? If there is a "ToolSet Info" line in there, what does it say?

Also, if still a management number of files, what other DLLs are in there. Is there a WWRAS34I.DLL or a WWWSK34I.DLL?

BTW...Nothing about Wilson orWINBATCH show up in Add/RemovePrograms Well, it seems you have a copy of some program compiled with the Winbatch compiler and installed on your system. However this may have nothing do do with your problem as a number of computer manufacturers also use Winbatch for initial system setup and also to keep track of PC health type info, so having a WinBatch program that runs on your system everytime you boot up is not necessarily a bad thing.

However WinBatch is also fairly easy to get and also to program, so it can also be used for less than desireable purposes.

User Reply:

I'm glad I posted here before proceeding. You appear to be correct about it being a legit copy.

It is an HP Pavilion PC That .DLL was in C:\hp\IAccess The only other .DLL in that dir was WBOCC34I.DLL The only .EXE in that dir was HPIAccess.EXE toolsetinfo read: Compiled with WinBatch by Hewlett Packard

I look down other avenues for my culprit, and thanks again for your assistance/expertise.

Article ID:   W16510

File Created: 2017:07:18:07:57:28

Last Updated: 2017:07:18:07:57:28