"Virus" found in TouchGFX Designer 4.10.0

[S.P.]

I have posted this in zendesk, but am then referred to ST Community. I would like to re-post here, so that someone in ST can help to follow up.

====================================

We have a project running on TouchGFX 4.9.3, and we have just tried to migrate it to 4.10.0.

Below shows the step that we have tried....

1) Open the 4.9.3 project with TouchGFX Designer 4.10.0

=> It will be upgraded to 4.10.0's automatically.

2) Delete two pictures in the TouchGFX Designer 4.10.0.

=> The pictures are successfully deleted

3) Delete one more picture in the Designer

=> The whole Designer is automatically shutted down!!!

4) Try to reopen the Designer again

=> Fail. The Designer was deleted automatically and cannot be found.

After investigation, it was automatically deleted by the Anti-Virus software (Trend Micro OfficeScan Agent). It stated that Virus was found in the Designer, and therefore it was deleted automatically.

This issue was not happened in 4.9.3, but 4.10.0.

Please investigate and fix it.

[After Forever]

Most likely it's a false positive. Try to check the file using VirusTotal to see how many AV vendors are detecting a threat there.

https://virustotal.com

[Martin KJELDSEN]

Hi S.P.,

I've tried to figure out what might be triggering this "File Encryption" warning.

TouchGFX Designer does not encrypt files, but copies-, creates-, deletes-, modifies- and generates them. It also calls external processes (e.g. make, gcc, font- and image converter tools). I've heard about this warning sometimes being related to a subprocess.

Is it possible for you to provide me with the full "target" path from that screenshot? Then we might become wiser as to what kind of subprocess is causing this "false positive".

Thanks!

[Tesla DeLorean]

>>Please investigate and fix it.

Third party tool interferes with installation and you want who to fix it?

[S.P.]

Here it is.

After clicked "Details", it goes to "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/search/unauthorized%20file%20encryption", which doesn't help much.

Thanks, Martin

[Martin KJELDSEN]

Hi SP,

I'm talking about these "target" paths, that are obscured in the screenshot. Thanks!

[S.P.]

This are the paths of the pictures that I have deleted in Step (2) .

"C:\touchgfxprojects\myapplication1_4_10_0\assets\images\xxxx.png"

[DMeis.1]

TouchGFX just deleted itself on my computer too. Target is here

[Martin KJELDSEN]

And this is Trend Micro OfficeScan Agent, or what?

[DMeis.1]

Yes this was Trend Micro OfficeScan Agent. I had my company whitelist TouchGFX 4.13.0 so it won't cause any issues for the time being.