Trojan infecting Oanda's MT4? | Forex Factory

Options

Permalinks
Print Thread

Similar Threads

Trojan in setup.exe (MT4)? 5 replies

AAAFx installing Trojan.PassordSteale r on your pc? 10 replies

Trojan Horse in MT 5 replies

Metatrader trojan ? 4 replies

Trojan infecting Oanda's MT4?

  • #1
  • First Post: Jan 30, 2015 6:35am Jan 30, 2015 6:35am
My subscription version of Malwarebytes reported and quarantined two files this morning infected with Trojan.Agent.ED. They were...

  1. C:\Program Files (x86)\OANDA - MetaTrader\terminal.exe
  2. C:\Users\[..your user account...]\AppData\Roaming\WebInstall\mt4dw.png

Has anybody else had a similar problem on their systems? Is this a false positive or have malicious files been unleashed upon us?

  • #2
  • Jan 30, 2015 6:54am Jan 30, 2015 6:54am
Quoting ByteDoc
My subscription version of Malwarebytes reported and quarantined two files this morning infected with Trojan.Agent.ED. They were... C:\Program Files (x86)\OANDA - MetaTrader\terminal.exe C:\Users\[..your user account...]\AppData\Roaming\WebInstall\mt4dw.png Has anybody else had a similar problem on their systems? Is this a false positive or have malicious files been unleashed upon us?
No. My MT4 it's ok.
  • #3
  • Jan 30, 2015 7:51am Jan 30, 2015 7:51am
Quoting ByteDoc
My subscription version of Malwarebytes reported and quarantined two files this morning infected with Trojan.Agent.ED. They were... C:\Program Files (x86)\OANDA - MetaTrader\terminal.exe C:\Users\[..your user account...]\AppData\Roaming\WebInstall\mt4dw.png Has anybody else had a similar problem on their systems? Is this a false positive or have malicious files been unleashed upon us?
I just made the account to reply to you, so don't mind the account created date
I have the same issue with my two MT4 clients (from different brokers), from what I can see it's a MalwareBytes issue. When I Googled to see if there were other people that ever had the problem I found nothing, so it's safe to assume that it's a false positive. I have two firewalls and I wasn't using any of the clients (they weren't running) when they got flagged, so it must be a mistake from MalwareBytes. (99.9% certain). I just added the folders to the exclude list, especially since my firewalls didn't do anything to quarantine/block terminal.exe.
  • #4
  • Jan 30, 2015 7:53am Jan 30, 2015 7:53am
Good day, I was hit by this virus. Knocked out three different platforms. My Malwarebytes Anti Malware software, removed the Virus. But not before it did the damage. Not sure what to do, start over I guess. ?
  • #5
  • Jan 30, 2015 8:14am Jan 30, 2015 8:14am
Got the same issue on my MT4 a use for charting.

It seems to be a 'false positive" from MB.

Without it MT4 does not work so it is either a false or the Russians behind Metaquotes are up to something
So, you think you have rights? LOL
  • #6
  • Jan 30, 2015 9:41am Jan 30, 2015 9:41am
I have the same problem today on multiple MT4 platforms.
  • #7
  • Jan 30, 2015 6:54pm Jan 30, 2015 6:54pm
Yah, I am concerned to the point where I will leave the MT4 executable in quarantine and won't trade on Oanda until the matter is addressed more publicly. I'm not a novice in the IT realm, and finding trojans embedded in trading platforms or other '.*' files is a matter of grave concern to me. This only happened after I accepted the latest updates from Oanda earlier this week -- on a Windows 7 workstation and a Windows 8 notebook. Do your own personal research on trojans and what they can do to your machines. This one has no business being there...
  • #8
  • Jan 30, 2015 7:20pm Jan 30, 2015 7:20pm
Same issue with Go Markets. Using Malwarebytes as well and could not launch MT4 as it had removed two files including the exe one. Reinstalled MT4 and everything seems OK but no IT expert. Received no advice from Go Markets so probably a Malwarebytes issue as stated by others. Still, left me a bit unnerved.
Audentes Fortuna Juvat
  • #9
  • Jan 30, 2015 7:25pm Jan 30, 2015 7:25pm
as far as i understand its some kind of old type of virus program so MQ's can update any MT4 installation
without full consent, adding more of their nonsense etc
whats most frightening is the speed it can update old saved MT4s on separate drives
who knows whats really in there or what could be in the future,

take appropriate actions (whatever that means)
  • #10
  • Jan 30, 2015 9:49pm Jan 30, 2015 9:49pm
False news!
https://forums.malwarebytes.org/inde...ecutable-file/
  • #11
  • Jan 31, 2015 9:03am Jan 31, 2015 9:03am
Not to leave anybody hanging, but here is a thread that provides a resolution --> https://forums.malwarebytes.org/inde...ecutable-file/. The long and short of it is, "...file it detected was a clean file and not malware." That reply from Malwarebytes staff.
  • #12
  • Last Post: Jan 31, 2015 2:08pm Jan 31, 2015 2:08pm
Quoting ByteDoc
Not to leave anybody hanging, but here is a thread that provides a resolution --> https://forums.malwarebytes.org/inde...ecutable-file/. The long and short of it is, "...file it detected was a clean file and not malware." That reply from Malwarebytes staff.
Thanks. That closes the loop.
Audentes Fortuna Juvat
0 traders viewing now