2

I have installed the latest QGIS, version 2.12.3. However, when I open it, Symantec says that it has discovered the trojan SONAR.TCP!gen4. See http://securityresponse.symantec.com/security_response/writeup.jsp?docid=2016-010506-2603-99&vid=4294923110.

Is there a trojan in this version of QGIS, or is it a mistake on the part of Symantec?

Improve this question
6
  • Does it give you the file it thinks has it. Some scanners give false alarms.
    – Nathan W
    Commented Jan 20, 2016 at 23:17
  • Yes, it is qgis-bin.exe in the bin folder.
    – Jim
    Commented Jan 20, 2016 at 23:32
  • 1
    Can you try another virus software? Some offer online file checking. It might well be a false alarm.
    – AndreJ
    Commented Jan 21, 2016 at 6:38
  • 2
    Where did you download QGIS from?
    – bennos
    Commented Jan 21, 2016 at 8:10
  • 1
    most likely this is a false positive as @Nathan-W alread told you.Uploading the qgis-bin.exe from the 64-bit windows-version standalone to virustotal shows one scanner (BkAV)with an alert and 51 scanners (including Symatec) say that they have not found an virus/trojan: virustotal.com/de/file/… You should forward your qgis-bin.exe to Symatec for inspection. most likely the will have to update their scanner-data-base
    – Kurt
    Commented Jan 21, 2016 at 10:12

1 Answer 1

Reset to default
2

Most likely this is a false positive as @NathanW and @AndreJ alread told you.

Uploading the qgis-bin.exe (*) from the 64-bit windows-version standalone to virustotal.com shows one scanner (BkAV) with an alert and 51 scanners (including Symatec) say that they have not found a virus/trojan: https://www.virustotal.com/de/file/f5a7b3753590ad999a9e20c80802dcbbc2a1474966651966e877f642ac996aa5/analysis/

You should forward your qgis-bin.exe to Symatec for inspection. most likely the will have to update their scanner-data-base.

quote from virustotal.com "VirusTotal antivirus solutions sometimes are not exactly the same as the public commercial versions. Very often, antivirus companies parametrize their engines specifically for VirusTotal (stronger heuristics, cloud interaction, inclusion of beta signatures, etc.). Therefore, sometimes the antivirus solution in VirusTotal will not behave exactly the same as the equivalent public commercial version of the given product."

(*) Maximal file-size for upload is 128 MB, so you cant upload the complete qgis-installer to virustotal.

Improve this answer
2
  • I only uploaded the qgis-bin.exe for 32 bit to virustotal. It only gave one alert as above for BkAV. So now I am waiting on Symantec for their response.
    – Jim
    Commented Jan 21, 2016 at 17:14
  • Has anyone found a solution to this problem? I just installed the latest QGIS, 2.14 "Essen". I started it up and Symantec promptly deleted it. Surely I'm not the only one with this problem.
    – Jim
    Commented Mar 2, 2016 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.