(UPDATE: Resolved) AVG Antivirus + MetaTrader = False Positive for Win32/Heur

[EugeneFXI]

Heads up, everybody!

The latest updates to AVG Antivirus (as of June 21st) were causing the software to detect MetaTrader's executables (terminal.exe and MetaLang.exe) as viruses - Win32/Heur.

THIS IS A FALSE POSITIVE

In order to get MetaTrader to work despite the update, you need to exclude it from scanning.

• Open up the AVG Control Center.
• Double-click on Resident Shield.
• Click on the Excludes tab.
• Click the Edit Excludes button
• Click the Add Path button
• Choose your MT4 folder.
• Press OK, OK, OK to close out everything.
• Reboot your computer.

MT4 should now be excluded from the scan.

This is just a temporary solution, since you do want the scanner to take ALL applications under consideration, but until Grisoft fixes this problem, we'll need to do this.

I have contacted them with this information yesterday, when we first started having the problem, so am waiting for response.

[capsmart]

I am using Avast and I had a similar problem about 2 months ago. Since Avast is updating it's database many times a week the problem was corrected after 1-2 days. You just ignore it when it happens.

[EugeneFXI]

I've used Avast for a couple of years before switching to AVG. I found that Avast misses some true positives that AVG picks up on. Plus it comes with a good two-way firewall (well, the Antivirus+Firewall version, at least).

Got an email from them last night telling me the situation was resolved in the last update.

[arhemsi]

Hello Eugene,

I am using avast and whenever I do a complete scan including archive files, I always got the result that it is unable to scan three files. I am unable to delete this three files either.

What could possibly be these three files?

Thanks

[EugeneFXI]

Hi Arhemsi,

What files are those? Could you give me their names?

Is MT4 running when you are doing the scan?

I am inclined to assume that MT4 was indeed running while you were scanning, and it was unable to get a file handle on certain files because they were in use.

Let me know if thats the case!

[arhemsi]

Hi Eugene,

The files are:

C:\Documents and Settings\ACER\...|jar_cache 21292
C:\Documents and Settings\ACER\...|jar_cache 39600
C:\Documents and Settings\ACER\...|41457618(1)

Yes I am sure my mt4 was running when I do the scan.

[EugeneFXI]

Those are temporary work files. They are created and used while MT4 is running.

Try scanning when MT4 is NOT running. You shouldn't be getting these errors then.

[arhemsi]

Hi Eugene,

I have run my avast scan again but this time after making sure my mt4 platform is switch off. Unfortunately, I still get the same result that is avast is unable to scan those same files. I also tried to delete those files, but the pc is unable to do so.

What are those files? Can you help. Eugene.

Thanks

[EugeneFXI]

Arhemsi,

My mistake! I haven't looked at the filenames attentively enough to notice that they might have nothing to do with MT4.

C:\Documents and Settings\ACER\...|jar_cache 21292
C:\Documents and Settings\ACER\...|jar_cache 39600
C:\Documents and Settings\ACER\...|41457618(1)

MT4 doesn't keep files under Documents and Settings. All of its profile data is stored in its own Program Files directory, so that is most likely some other program generating these temporary work files.

I wouldn't worry about it too much. If you are concerned, try doing a boot time scan, so that no programs get loaded at all before the scan starts.