topic Re: AVG detected Trojan horse in Revit_2017.2.1.exe in Installation & Licensing Forum

AVG detected Trojan horse in Revit_2017.2.1.exe

mchristop — Fri, 23 Jun 2017 14:13:12 GMT

Today our AVG CloudCare Antivirus decided that it didn’t like two Revit updates (Revit_2017.2.1.exe and Revit_2018.0.2.exe) that have been installed for a while.

The files are:

C:\ProgramData\Package Cache\{5c9a9e68-bc8b-4bf6-9641-0c53896c8c14}\Revit_2017.2.1.exe

C:\ProgramData\Package Cache\{0d7d1f7e-85c7-4bbf-b604-0ab05509198b}\Revit_2018.0.2.exe

Is anyone else having this problem?

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

Alan.johnson1970 — Fri, 23 Jun 2017 14:47:58 GMT

As far as I am aware AVG detects something in the updates and registers a false positive.

You can ignore this as there is no Trojan in the update

Your best option its to disable AVG whilst you do your Revit update.

Regards

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

Anonymous — Fri, 23 Jun 2017 14:53:04 GMT

Where did you download that file from? As the actual filename from the Autodesk site is Autodesk_Revit_2017_2_1.exe

At least that is what I have downloading from manage.autodesk.com. 2018 is similar.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

mchristop — Fri, 23 Jun 2017 15:09:50 GMT

I was assuming false positive too, but I have never had 25 people standing in my cube saying they got a virus before. As I mentioned, these updates have been installed for a while now (weeks/Months). The message didn't happen during installation, it is basically happening at login today.

The original files were downloaded from https://manage.autodesk.com/cep/#products-services/updates .

From what i can tell, after you run the updates, it creates the files in the C:\ProgramData\Package Cache location. I am guessing/hoping if you have installed the updates and you check those folders on your computer, you will find the files I referenced.

C:\ProgramData\Package Cache\{5c9a9e68-bc8b-4bf6-9641-0c53896c8c14}\Revit_2017.2.1.exe

C:\ProgramData\Package Cache\{0d7d1f7e-85c7-4bbf-b604-0ab05509198b}\Revit_2018.0.2.exe

Our two options are to remove the files, or ignore (block) them. I am guessing either is fine, until we try to uninstall the software.

Thanks for the input.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

Alan.johnson1970 — Fri, 23 Jun 2017 15:20:12 GMT

Yeah, you will need to delete those two files, disable AVG then re-download the update files and install the update.

Then reactivate your AVG when the install is complete.

Cheers

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

mchristop — Fri, 23 Jun 2017 16:08:51 GMT

I actually just downloaded the updates again from https://manage.autodesk.com/cep/#products-services/updates . AVG doesn't like those install files either.

Perhaps Autodesk would like to work this out with AVG?

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

chrisplyler — Fri, 23 Jun 2017 16:17:55 GMT

I'm assuming those files were the update download, and since it has been installed, the file itself is a useless leftover. So either get rid of it or just let AVG remove it. Shouldn't hurt anything.

Disclaimer: Makes sense to me, but I don't actually know anything about anything, and so should be ignored. Taking my advice is very likely to get you and your family and indeed anybody within a ten mile radius of you killed very, very dead or worse.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

RobDraw — Fri, 23 Jun 2017 17:17:57 GMT

@mchristop wrote:

Perhaps Autodesk would like to work this out with AVG?

It's not an Autodesk problem. You need to contact AVG.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

mchristop — Fri, 23 Jun 2017 17:20:40 GMT

I beg to differ. If Autodesk is putting out updates that can be interpreted as Trojans by antivirus, they better sort it out!

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

RobDraw — Fri, 23 Jun 2017 17:29:11 GMT

That's not how antivirus works. That is why it is sometimes necessary to disable AV. It's a false positive. AVG needs to not see it as a threat.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

Sahay_R — Fri, 23 Jun 2017 17:38:56 GMT

Either that, or use something other than AVG.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

mchristop — Fri, 23 Jun 2017 17:39:33 GMT

I must not have been clear enough. The update had already been installed for weeks/months. There is no reason to disable Antivirus.

Here is a different example that makes sense to me.. Say my domain was blacklisted and a client of mine could not receive my emails. It is not my clients problem to contact the company that blacklisted my domain. It is my problem (the owner of the domain) to contact the company that blacklisted my domain to get off the blacklist.

The way I see it is, Autodesk's reputation is at stake here, not mine. Autodesk's problem, not mine.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

RobDraw — Fri, 23 Jun 2017 17:45:56 GMT

@mchristop wrote:

I must not have been clear enough. The update had already been installed for weeks/months. There is no reason to disable Antivirus.

The way I see it is, Autodesk's reputation is at stake here, not mine. Autodesk's problem, not mine.

You were clear.

Obviously, it is an AVG update that is giving a false positive for safe software. If an anti-virus is giving a FALSE positive on safe software, it is the antivirus that is at fault.

Is Autodesk responsible to monitor every AV for false positives? Not at all. It is the AV that is responsible for eliminating false positives or risk losing their clientele. Why would one use an AV that can potentially halt production?

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

Anonymous — Fri, 23 Jun 2017 17:51:40 GMT

AVG has a long history of reporting Autodesk updates as trojans...especially if it hasn't been updated for a while.

It's a reason I stopped using it. Scan the files with another scanner, like malwarebytes, and see if it pops up as an issue too.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

mchristop — Fri, 23 Jun 2017 18:22:44 GMT

@RobDraw wrote:
@mchristop wrote:
I must not have been clear enough. The update had already been installed for weeks/months. There is no reason to disable Antivirus.

The way I see it is, Autodesk's reputation is at stake here, not mine. Autodesk's problem, not mine.
You were clear.

Obviously, it is an AVG update that is giving a false positive for safe software. If an anti-virus is giving a FALSE positive on safe software, it is the antivirus that is at fault.

Is Autodesk responsible to monitor every AV for false positives? Not at all. It is the AV that is responsible for eliminating false positives or risk losing their clientele. Why would one use an AV that can potentially halt production?

I don't think it is your job (unless you work for Autodesk) or mine to determine if this is a false positive. How could we really know unless we wrote the code?

Autodesk didn't have to monitor every AV, I brought it to their attention. Now they can prove that they are not placing back doors in their updates.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

RobDraw — Fri, 23 Jun 2017 19:00:15 GMT

@mchristop wrote:

I don't think it is your job (unless you work for Autodesk) or mine to determine if this is a false positive.

Now they can prove that they are not placing back doors in their updates.

There are plenty of people that don't work for Autodesk who have a responsibility to determine if it is a false positive. Some of them posted here and, BTW, you are one of them.

Did you tell everyone to stop using Revit until Autodesk proves it is not an actual Trojan? No, in fact you made a determination that it was a false positive.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

natasha.l — Fri, 23 Jun 2017 19:16:56 GMT

Hello @mchristop,

Thanks for posting to the community. Antivirus software like AVG is designed to block foreign files & etc. limiting user access. You can make exceptions to this to prevent the blockage to your updates & applications. This was found on the AVG support site: How to exclude files, folders or websites | AVG Support.

Best of luck.

Please "Accept As Solution" if a reply has helped resolve the issue or answered your question, to help others in the community.

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

mchristop — Fri, 23 Jun 2017 20:14:44 GMT

Thank you @natasha.l for your response. It is FANTASTIC to see an Autodesk response.

Please have your Autodesk team consider applying for a "Whitelisting service account" with AVG to prevent this from happening in the future.

https://secure.avg.com/submit-sample

The files in question are far too large for me to submit on your behalf.

Thanks also to everyone who took time out of their day to attempt to help me. I am sorry, I was getting a little frustrated there but I do realize you were all trying to help me. I was really looking for an official Autodesk response, and I got one. I am hoping Autodesk will take the time to and be able to get whitelisted so nobody will have to spend any more time with issues like this.

Have a great weekend!

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

RobDraw — Fri, 23 Jun 2017 20:44:10 GMT

@mchristop wrote:

Please have your Autodesk team consider applying for a "Whitelisting service account" with AVG to prevent this from happening in the future.

https://secure.avg.com/submit-sample

So, you get a response from Autodesk, which not only referred you back to the AVG software, but directed you on what to do. Basically providing support for AVG, And you still want them, instead of you, to be proactive about this?

What is this world coming to?

Re: AVG detected Trojan horse in Revit_2017.2.1.exe

mchristop — Mon, 26 Jun 2017 11:47:05 GMT

@RobDraw wrote:
@mchristop wrote:
Please have your Autodesk team consider applying for a "Whitelisting service account" with AVG to prevent this from happening in the future.
https://secure.avg.com/submit-sample
So, you get a response from Autodesk, which not only referred you back to the AVG software, but directed you on what to do. Basically providing support for AVG, And you still want them, instead of you, to be proactive about this?

What is this world coming to?

Yes, WHAT IS THIS WORLD COMING TO?!

I am not sure who changed the Accepted Solution for me, but that is not cool! But sadly typical for Autodesks forum!

I did NOT mark natashal84 's response as a Accepted Solution!

ABSOLUTELY, Autodesk needs to be proactive about this! We pay a LOT of money for Autodesk software. Autodesk needs to fix this problem so it doesn't inconvenience their users. Do you have any idea how much billable time was lost because of this issue?

Her response does not fix the problem. It is a work around. I am fully aware how to create an exception In AVG. I am not about to do this on 50 computers. I was happy to see an Autodesk response. Then I knew that they would see my suggestion of how to fix the problem. How does the saying go? "You can lead a horse to water but you can't make them drink."

Disabling Antivirus is NEVER the solution!

If your antivirus tells you that a file (Or two in this case, both from Autodesk) on your computer is trying to do something that it probably shouldn't do. It is probably not in your best interest to create an exception for those two files just because the creator of those two files say they are ok.

The creator of those files needs to prove that they are ok. Which is what I suggested they do.

My suggestion is the only acceptable solution. My solution would prevent this issue from happening in the first place for these updates and any future updates. And that, my friends is how you SOLVE a problem. You FIX the problem for good.

********** ACCEPTED SOLUTION START **********

Please have your Autodesk team consider applying for a "Whitelisting service account" with AVG to prevent this from happening in the future.

https://secure.avg.com/submit-sample

The files in question are far too large for me to submit on your behalf.

********** ACCEPTED SOLUTION END **********

I can only hope that Autodesk will do the right thing and follow my advice.