Trojan in my Application?

Ex-RoNiN · 22 Jun 2008 at 15:32

I built an application with .NET 2003 some time ago, and today as I was scanning my PC with a-squared Free, it detected the following Trojan in my setup.exe (Used Visual Studio builder to create it):

Trojan-Dropper.Win32.Joiner.dp

How is this possible? The only file it is found is in that setup.exe....is there some code that gets detected as a trojan (the software is legit, it does stuff to XML files only

) and can I safely ignore this? It was built on another machine which was protected by Enterprise security and I just backed it up on my local machine.

Speaking of local machine, it has a Trojan in one of the Visual Studio library files, which was caught months ago by AVG - but I did not use this machine to build or even read the project in the setup.exe....so yeah, can I ignore this?

swinnie · 22 Jun 2008 at 15:57

It could have embedded itself into the file, AFTER the file was compiled, so it could be a virus that has entered your current machine.

JIM_BOB7813 · 22 Jun 2008 at 16:01

Could be false positive, upload it to some online scanners and see if they all say the same.
IIRC there is a website that will do multiple scans on a file, but i can't remember it's name, try these though
http://www.kaspersky.com/scanforvirus
http://onlinescan.avast.com/

edit: this is it: http://virusscan.jotti.org/

Una · 22 Jun 2008 at 16:01

Anti-virus software often gets false positives. Most work on a signature based approach, so if something in your code looks vaguely suspicious it can often get it wrong.

However as swinnie says binaries can get infected by viruses (well any file really)..

Try submit it to http://www.cwsandbox.org/?page=submit and see what the analysis there gives.

Ex-RoNiN · 22 Jun 2008 at 16:15

Thanks guys, just ran the file through all of the above online scanners, and it came back as clean, including the online version of a-squared :rolleyes:

Thanks very much

Eriedor · 22 Jun 2008 at 18:12

If you had the source you could recompile it and scan that and see if that too gets flagged.

BigglesPiP · 22 Jun 2008 at 23:51

I compiled a virus once, was trying to make software to log the mouse location and disable the screen-saver on one corner.

NOD32 didn't like my code, lol.

I've also had a program returned to me by a beta tester infected with one of these viruses which plants itself in EXEs.

Inquisitor · 24 Jun 2008 at 00:22

I've also got false positives when compiling/packaging my applications with VS and Inno Setup, so I expect this probably is too