Trojan Downloader File in VEDA FE

[finorgan]

Found the following Trojan downloader in my VEDA FE folder this morning:

https://www.f-secure.com/v-descs/trojan-...eric.shtml

[Vikrant]

Hi Finorgan,

Are you trying to say trojan found during installation? or found in existing installation?

[finorgan]

Hi Finorgan,

Are you trying to say trojan found during installation? or found in existing installation?

Hi Vikrant,

File found is called a Trojan Downloader. Details in link I included in original post represent my full knowledge:

"Technical Details

A Trojan-downloader is a type of trojan that installs itself to the system and waits until an Internet connection becomes available to connect to a remote server or website in order to download additional programs (usually malware) onto the infected computer."

Trojan was found during routine scan. I last installed VEDA about 2 months ago

Fionn

[Vikrant]

Fionn, Antivirus detects this trojan in which file?

As you said your installation is two months older and if antivirus did not found this in the past then something happen recently so you have to contact your IT team to fix this.

[finorgan]

C:\VEDA\VEDA_FE\CheckComments.exe was the rogue file. Was deleted by F-Secure, my anitvirus-software.

[Antti-L]

Yes, this is a known issue. It was reported here already before by Abdulaziz: http://forum.kanors-emr.org/showthread.php?tid=573
"I have already disabled the antivirus (F secure) because it keeps detecting a Trojan in the CheckComments.exe and quarantining it."

I can also myself confirm that F-Secure Client Security marks the file as a Trojan.  
I have now submitted it to F-Secure for their review, hoping that they can vindicate it.

[finorgan]

Thanks Antti

[Vikrant]

Hi Fionn,

This feature is under development, so you can delete that from your machine. Infact I am removing it from installer as well.
And it is very strange that only F-Secure antivirus has issue with this application. Maybe INI file generation trigger alarm for it because except INI this application has only some SQL queries.

Thanks Antti for pointing out the last post releated to same issue. and let's see what F-Secure say about this.

[Antti-L]

Reply from F-Secure Security Labs (Mon, 20 Nov 2017 17:49:32 +0000):

Thank you for bringing this to our attention. Our analysis indicates that the file you submitted is clean.
We have identified the issue as a False Positive, which will be resolved in an upcoming database update.
In the meantime, you may exclude this file from further scanning by the security product.

[AKanudia]

Thanks Antti!