Norman Anti-Virus reporting trojan in Vendor.DLL

[pkuskopf]

I've just installed NT 6.5.1000.7 on a PC with Norman Anti-Virus. NT ran OK for a while, but half an hour later, Norman reported the presence of Win32/OnlineGames.YYL trojan in the Ninja Vendor.DLL and moved it to quarantine.

Is this a false alarm? I have un-installed, run a Windows Update, ensured that my anti-virus defns are up to date, re-installed NT, but now NT continually refuses to start because Norman continually quarantines Ninjatrader.Vendor.DLL.

I have attempted to Download the previous vesrion of NT from the website but am receiving message "This installation package could not be opened. Contact the application vendor to verify that this is a valid Windows installer package"

So now I have no working version of NT on that PC.

(I have version 1000.6 running happily with a different anti-virus engine on a separate PC).

Peter

[NinjaTrader_Jason]

Hi Peter,

I suggest to uninstall/re-install using the instructions below and check if the issue remains. Note, you will lose all saved settings and data.

Uninstall NinjaTrader 6.5 from the Windows Control Panel under Add/Remove Programs. Delete the NinjaTrader6.5 folder located under the Start Menu--> My Documents--> NinjaTrader 6.5.

Clear your browser cache.

Re-install NinjaTrader and check if the issue persists.

[pkuskopf]

Jason,

These suggestions have worked OK to get the previous version re-installed (6.5.1000.6), but Norman is still objecting the the Vendor DLL no matter how many times I install - both the stand-alone scanner and the On-access scanner.

For the time being, I'm alive with version ...6 so that's OK.

Peter

[NinjaTrader_Dierk]

Hi,

We did
- a fresh 6.5.1000.7 install on 3 different test machines
- scanned the <program files>/NinjaTrader6.5 installation folder with 2 different virus scanners (McAfee and Avira AntiVir, both latest version)

-> no problem on any of the scanned files

Thus, we would claim that the 6.5.1000.7 installer on our server is not infected. We are aware about situations where virus scanners could trigger "false reports" (and report infections, where actually no file is infected).

However, we strongly recommend you scan your PC with latest revision of your virus scanner to make sure it's not infected by a different source. Trying an alternate virus scanner is a viable option too.

[pkuskopf]

Many thanks for thoroughly checking this. I'll check with the Anti-virus supplier with regard to this false positive.

Peter

[crowman]

I have the same problem. I also have Norman. It just wont let me load up again even though I deleted the other one

[NinjaTrader_Dierk]

a) Please scan your PC for potential viruses and trojan.
b) Please contact the vendor of the virus scanner for resolution. According our checks, NT installer (and files contained) does NOT have any viruses/trojans.

[Rico.]

Same problem here.. Norman Antivirus detects W32/Onlinegames.YYL in Ninjatrader.Vendor.dll and prevents running Ninjatrader..
Is there solution other than changing antivirus software?

[NinjaTrader_Dierk]

Unfortunately we are not aware of any other resolution.

Also:
a) Could you please post a link to the vendor of the antivirus software so we could try to contact him? Thanks
b) May be updating to the latest revision of this anti virus software would make a difference.

[Rico.]

False (probably) detection actually started with latest antivirus update.. Quick solution is to exclude Ninjatrader directories from antivirus scanning.

Norman antivurus - Configuration editor - Common settings -Exclude list = Add C:\Program Files\NinjaTrader 6.5 and C:\Documents and Settings\"Username"\My Documents\NinjaTrader 6.5

This will resolve Ninja not starting.. but we still don't know why this happened..

[NinjaTrader_Dierk]

Thanks for letting us know.

[pkuskopf]

I have notified Norman of the problem, but no response as yet. Maybe they will re-issue fingerprint database without notifying me, but it would be helpful if NinjaTrader could follow up with them.

Home website is norman dot com. On first access, you may reach the Norwegian language page, but there's an English language button somewhere.

There is a US office at:

Norman in the United States

Norman Data Defense Systems, Inc.
9302 Lee Highway, Suite 950A
Fairfax, Virginia 22031
USA

Tel. 1.703.267.6109
Fax 1.703.934.6368

Toll Free US 888.GO.NORMAN (888.466.6762)

Email: [email protected]

Support email: [email protected]

[NinjaTrader_Dierk]

Thanks, I fired Norman a support mail too.