The installer contains a trojan

Modified on Thu, 20 Oct 2016 at 09:49 AM

Symptoms


Your antivirus warns you that one of the files included in the installer contains a virus or a trojan and quarantines it.


Cause


This is caused by overzealous antivirus software that tends to find threats everywhere. Many of the Tick Data Suite files have software protections that might confuse the antivirus software. Some AV toolkits (e.g. NOD32) err on the side of caution, even though the files are code signed.

There is, of course, no virus or trojan. The Tick Data Suite has been commercialized since early 2012 and over time it has gained a certain reputation - you can rest assured that all the measures are taken to prevent jeopardizing that. That means putting all the possible safeguards in place on everything from the source code to the web server and ensuring that no attack software makes its way in.

Resolution


All the files in the installer package are code signed. You can right click them, open the Properties dialog and inspect the Digital Signature tab. Make sure you select each code signature and click the Details button which should inform you that the signature is ok. In the details dialog, you can also verify the timestamping signature. If a code signature is not ok, you may indeed be dealing with a malicious software that modified the file but that is most likely on your computer.


If you need further assurances, I suggest uploading the suspicious file to Virus Total and having it scanned. If you get 3-5 engines that issue a warning and 50+ engines that say it's fine, it's safe to trust the majority.


After you went through the above and you've determined to your satisfaction that the file contains no actual threat, simply whitelist it in your antivirus software. If you're unsure how, check the documentation or try to Google whitelisting with your particular AV toolkit.