Why Mt5 ICmarket's (icmarkets dot com) setup.exe detected like a Trojan ?

New comment
 
Hello, today my pc antivirus found interesting Trojan. Maybe somebody know something about that ? It was installation file from IC markets site (icmarkets dot com)  icmarketssc5setup.exe
this is the link where i downloaded the file  download.mql5.com/cdn/web/18040/mt5/icmarketssc5setup.exe
this is my analysis from virustotal
virustotal.com/gui/file/4b29e01140e89df57638880e52141711bce094a22a180136be231ee5a762d102/detection

can somebody help to understand ? 
VirusTotal
  • www.virustotal.com
VirusTotal
Files:
Screenshot_1.png  240 kb
 

Forum on trading, automated trading systems and testing trading strategies

About False Alerts by Anti-Virus Software

MetaQuotes, 2010.05.21 13:57

In order not to write "A False Alarm" over and over again, one more time we make a statement:

  1. Our software does not contain trojan or any other viruses (this is nonsense - our reputation and our work is very important to us).

  2. All the authorized updates that are received by your terminals are checked for being additionally signed by our digital signature - no update can be accepted and installed if it has no digital signature (RSA 1024) of our revision builder.

    It means that if the terminal got a message "Update available", they are fully trusted and created within our company. Though updates are distributed via brokers' trade servers, brokers can't modify update packages, cause this will change digital signatures of the update archive.

  3. All executable files of our programs are signed by trusted and verified digital certificates by Thawte, which guarantees that files will not be changed and proves our copyright.

  4. Any anti-virus warnings about problems with updates or authorized installers (downloaded from files.metaquotes.net) are only incorrect interpretations.

  5. Errors of anti-virus programs are based on heuristic engines that erroneously interpret Themida advanced protection system (developers' website http://www.oreans.com) as resembling a trojan or virus. The polymorph protection engine is subject to constant changes, influencing the detection by anti-virus software, producing one name or another.

  6. Warnings are generated only by a few not very popular anti-viruses, who do not take the trouble of deep analysis. Instead they simply block all software protected by Themida (as for example AVG, who earnestly warn "Win32/Themida"). More responsible anti-viruses do not generate suchlike messages.

  7. All builds of our software are automatically sent to AVG under the program "AVG Whitelisting Service" for software developer - we expect this will efficiently solve the problem of whitelisting.

 
Guten Berg:

In old days this happened after almost every update! As per Alains post from year 2010.

1. you need to add an exception rule to both your firewall and antivirus program. Note these are usually 2 different steps! not just 1.

2. need to report the false report to your antivirus support. Note that this was automaticly done by mq, however, this may take time to happen.

 
thank you very much for your answers 
New comment