MRI iso has a trojan?

No replies
neotek's picture
SX Retired
Joined: 2008/06/11

In both the unmodified and SOLDIERX releases of MRI malware\utilities\Atribune\\rdrivrem\swsc.exe reports as being infected by a trojan virus by many AntiVirus products. The following information should answer anybody's questions about the file in question:

Due to the large number of complaints about swsc.exe, I decided to look into it. It's a tool to control services in windows from the command line. It's written in Delphi and packed with UPX. I'm not sure what parts of the code are making it be recognized as a trojan, but this isn't all that uncommon when dealing with packed Delphi (see ). I know that many people on here will still not feel comfortable with this answer, so I have an even better one.

The tool in question (swsc.exe) has been updated and the newest version does not flag AV scanners as a virus. You can get the newest version (2.0 last time I checked) from It shouldn't cause any problems to replace the version that is currently in the MRI iso. Due to the fact that this is NOT a virus, we will not be doing another release of If anybody has any questions about how to do this, feel free to ask me on the forums. Also, if anybody needs an unpacked version of the swsc.exe from the MRI disk, contact me and I will get you one.

I hope that this puts everybody's fears to rest.

Life is just a dream that seems never ending...