Question

客户已报告McAfee在使用Delphi XE3编写的Delphi应用程序安装过程中检测到“Generic BackDoor.add”。我已经使用Virus Total复制了这个结果，它在我在Delphi中用控制台应用程序编写的小实用程序EXE文件中返回此病毒，并认为这是导致报告的文件（不是主要的应用程序EXE））。

该实用程序在Innosetup的[Run]阶段调用服务控制管理器（SCM）来安装'.sys'文件。我实际上部署了这个实用程序EXE的两个版本，一个作为控制台应用程序，另一个具有相同的Delphi SCM代码单元，但它添加了一个带按钮的小型GUI表单。后一个实用程序不会显示为病毒阳性，只显示控制台应用程序。我的应用需要使用“{$ R uac_manifest.res}”包含来提升。我的实用程序应用程序的DPR部分如下所示。（请注意，这不会显示服务控制管理器调用，因为它们位于另一个单元中，但是我的GUI实用程序版本使用了其他单元，它不会触发病毒检测，因此我得出结论，问题出在我的DPR中 - 也许？）：

    program ArtSCM;

uses
  SysUtils,
  Windows,
  UArtSysDriverInstaller;

{$APPTYPE CONSOLE}

{$R uac_manifest.res}
{$R *.res}

var
  sDriverName : string;


function CommandLineParamExistsWithArg(
     const ALookFor  : string;
     var   AArgument : string ) : boolean; overload;
{ Looks for the occurance of 'ALookFor' on the command line,
  of the form ALookFor=<AArgument>, where if found, AArgument returns
  the argument in upper case, AArgCaseAsIs returns the argument case as is. }
var
   I : integer;
   S : string;
begin
  Result := False;
  AArgument := '';

  For I := 1 to ParamCount do
    begin
    S := AnsiDequotedStr(ParamStr(I), '"');
    AArgument := UpperCase(S);
    Result := Pos( UpperCase(ALookFor)+'=', AArgument) = 1 ;
    If Result then
       begin
       Delete( AArgument, 1, Length(ALookFor)+1);
       Break;
       end;
    end;

  If not Result then
    AArgument := '';

end;




function PerformCommandLineAction : boolean;
var
  Installer : TArtSysDriverInstaller;

  procedure Install;
  begin
    Result := True;
    Installer := TArtSysDriverInstaller.Create( sDriverName );
    try
      Installer.InstallDriver;
    finally
      Installer.Free;
    end;
    Writeln( '  Driver installed OK.' );
  end;


  procedure Query;
  var
    S : string;
  begin
    Result := True;
    Installer := TArtSysDriverInstaller.Create( sDriverName );
    try
      If Installer.DriverIsInstalledAndRunning then
        begin
        S := Installer.DriverVersionString;
        S := Format('The driver is installed and running - Version %s.', [S] );
        end
       else
        S := 'The driver is *NOT* installed and running.';
    finally
      Installer.Free;
    end;
    Writeln( '  Status: ', S );
  end;

  procedure GetArtInfo;
  var
    S : string;
  begin
    Result := True;
    Installer := TArtSysDriverInstaller.Create( sDriverName );
    try
      If Installer.DriverIsInstalledAndRunning then
        begin
        S := Installer.ARTDriverInfoString;
        S := Format('Driver info string: %s', [S] );
        end
       else
        S := 'The driver is *NOT* installed and running.';
    finally
      Installer.Free;
    end;
    Writeln( '  Status: ', S );
  end;

  procedure Remove;
  begin
    Result := True;
    Installer := TArtSysDriverInstaller.Create( sDriverName );
    try
      Installer.RemoveDriver;
    finally
      Installer.Free;
    end;
    Writeln( '  Driver removed OK.' );
  end;



begin

  Result := False;

  try

    If not CommandLineParamExistsWithArg(
      '/DriverName',
      sDriverName )
       or (Length( sDriverName ) < 3) then
        Raise Exception.Create( 'Missing or invalid /DriverName=xxx parameter' );

    Writeln( '  Driver name: ', sDriverName );    

    If FindCmdLineSwitch(
      'QUERY' ) then
        Query
     else
    If FindCmdLineSwitch(
      'GETARTINFO' ) then
        GetArtInfo
     else
    If FindCmdLineSwitch(
      'REMOVE' ) then
        Remove
     else
    If FindCmdLineSwitch(
      'INSTALL' ) then
        Install
    else
      Raise Exception.Create( 'Missing command - QUERY, GETARTINFO, REMOVE or INSTALL required.' );

  except
    on E:Exception do
      begin
      Writeln( '  Error: ', E.Message );
      ExitCode := 1;
      end;
  end
end;


function IsRunningInDelphiIDE : boolean;
// Returns TRUE if the program is running in the IDE, FALSE otherwise.
begin
  Result := DebugHook <> 0;
end;








var
  dwVersion : DWORD;
begin
  dwVersion := GetFileVersion( ParamStr(0));

  Writeln( Format(
    'ArtDrvSC V%d.%d (c) Applied Relay Testing Ltd 2011',
    [HiWord(dwVersion), LoWord(dwVersion)] ));

  PerformCommandLineAction;

  If IsRunningInDelphiIDE then
    begin
    Writeln( 'Press a key ..' );
    Readln;
    end;
end.

如您所见，如果我从命令行运行它，“{$ R uac_manifest.res}”行正确请求提升，清单是：

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?> 
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> 
  <assemblyIdentity type="win32" name="Applied Relay Testing Ltd" version="3.1.0.0" processorArchitecture="*"/> 
  <dependency> 
    <dependentAssembly> 
    </dependentAssembly> 
  </dependency> 
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> 
    <security> 
      <requestedPrivileges> 
        <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/> 
        </requestedPrivileges> 
    </security> 
  </trustInfo> 
  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> 
    <application> 
      <!--The ID below indicates application support for Windows Vista --> 
      <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> 
      <!--The ID below indicates application support for Windows 7 --> 
      <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> 
    </application> 
  </compatibility> 
</assembly>

有人可以评论我应该做些什么来消除这种病毒检测吗？

来自我的Delphi控制台实用程序的假病毒阳性

0 个答案: