Trojan Problem (MT4)

[marquez]

Hi all,

I have a problem. I have installed a fresh MT4 from the official source. The installation worked without any problems, and I ever start it with the /portable option.

Now I have the problem, that everytime when I start the MT4, my Avira Antivir detects a Trojan. Please refer link: http://prntscr.com/bcpabv

I can remove it with Avira, but every time i restart MT4, Avira gets the same result. Where do MT4 gets the Files for Webinstall folder ? I have no Idea to fix this, and couldn´t find a Solution.

The strange thing is, on my other Computers this problems are not, just on this one where the screenshot comes from.

My Computerscan is completely clean (Avira with newest scan from today, 05.june.2016), so I would thank you for every tipp.

reqards,
marquez.

[Sergey Golubev]

This is false alarm, and it was discussed many times related to Avira:

• Look at this post, and
• This reply from MQ: "The installer has no virus - this is another false alarm on a polymorphic engine protection. Open the properties of any of our executable file to view digital signatures - they are signed (and unchanged)".

[Carl Schreiber]

marquez:

Hi all,

I have a problem. I have installed a fresh MT4 from the official source. The installation worked without any problems, and I ever start it with the /portable option.

Now I have the problem, that everytime when I start the MT4, my Avira Antivir detects a Trojan. Please refer link: http://prntscr.com/bcpabv

I can remove it with Avira, but every time i restart MT4, Avira gets the same result. Where do MT4 gets the Files for Webinstall folder ? I have no Idea to fix this, and couldn´t find a Solution.

The strange thing is, on my other Computers this problems are not, just on this one where the screenshot comes from.

My Computerscan is completely clean (Avira with newest scan from today, 05.june.2016), so I would thank you for every tipp.

reqards,
marquez.

Send the file to Avira (Avira Dateiprüfung <virus(at)avira.com>) with the reference that it might be a false positive.

Alternatively, there is a web-site for this - google knows where.

Next time it will know it!

For the moment let Avira check the file, let find the problem and the you should get a little tab, right mouse click and "ignore" - that should do it for the moment.

[Rizal Dwi Satria]

Sergey Golubev:

This is false alarm, and it was discussed many times related to Avira:

• Look at this post, and
• This reply from MQ: "The installer has no virus - this is another false alarm on a polymorphic engine protection. Open the properties of any of our executable file to view digital signatures - they are signed (and unchanged)".

check your exe at virustotal.com

[marquez]

thank you all for your replies.

The result of Virustotal shows more positive hits:
http://prntscr.com/bd25fd

But i am also wondering, why this causes only at Path: C:\Users\MYUSER\AppData\Roaming\MetaQuotes\WebInstall\mt4clw

Not the main installation Folder where the normal Files are terminal.exe or metaeditor.exe in the installed path !

And even deleting the Webinstall folder recreates it every time.


I am weird :)

[Marco vd Heijden]

marquez:

thank you all for your replies.

The result of Virustotal shows more positive hits:
http://prntscr.com/bd25fd

But i am also wondering, why this causes only at Path: C:\Users\MYUSER\AppData\Roaming\MetaQuotes\WebInstall\mt4clw

Not the main installation Folder where the normal Files are terminal.exe or metaeditor.exe in the installed path !

And even deleting the Webinstall folder recreates it every time.


I am weird :)

How about using the search function ?

https://www.mql5.com/en/forum/1029