Trojan in active e-book - EVIEW.DAT

I was careful about my tests.  First, I installed one of the antivirus programs (the other software that I know about which has been getting similar messages is zone alarm Pro), on a freshly installed and formatted Windows Vista machine.  The antivirus software that I used was Kaspersky.  There are others.

Then I began create e-books on one machine and move them over to the other on a flash drive.

Each time I would try to copy an e-book to the fist a machine that had Kaspersky installed on it, I would get error messages, the e-book would be deleted, and then I would start again.  At first, I thought it might be due to some of the files that I had in my e-book, but I was mistaken.  Eventually I created a new e-book, with only one file in it: the index page.

Still, even with the index page completely blank, I continued to get the message that my e-book was infected with a Trojan.

The next thing I did was to download the setup program for active e-book again, install it on the Vista machine.

The same thing happened again.  This time, however I got more specific error messages (when the antivirus program scanned the e-books, it said that it found the Trojan in a component of the e-book called "FILE01".

Kaspersky antivirus found two files that were infected with his Trojan.  One of them is EVIEW.DAT.  The other is EHELP.EXE.

When I removed these two files from my system that does NOT have Kapersky anti virus on it, and tried to compile an ebook, I got 0 kb files, which of course, are not 'valid win32 applications".

When I restored EVIEW.DAT, the ebooks were fine, but they were recognized as having the trojans - again.

The same thing happened with EHELP.EXE, but an experienced active ebook user doesn't need that.

I think that the behavior of EVIEW.DAT is close to an actual trojan, and antivirus programs and firewall programs are warning as though it were.

I hope there is a solution to this problem available.

So far, Kapersky antivrus and Zone Alarm PRO are two that I know of, but they're both important programs, and we should expect that more and more security softwares will follow suit.

Unless there's a fix, we may all have to stop using active ebook.

The issue was resolved when I compiled under AEB, V. 5.

Sunil, Rajkumar of programming, I hope you have a stable version 5 soon.

Sunil wrote to them and got it done.

As you are probably aware many makers of anti-virus and anti-spyware products use heuristics (rules) and signatures (specific sequences of data) to look for viruses and spyware.  They do this because it is impractical to look for an entire virus/spyware because of time or resource constraints.

Unfortunately from time to time a situation can arise where a heuristic or signature used by a particular anti-virus or anti-spyware product happens to match a legitimate program or product - just by chance.  This is known as a "false positive", and can happen to any program or product. For more info see:
http://www.guide2spyware.com/p1_false_positives.php

The solution when this situation arises is for the maker of the anti-virus or anti-spyware product to modify their product, to use a different rule or heuristic.  The maker of the anti-virus or anti-spyware product of course needs to be informed of the problem to make the fix

The thread in question seems to refer to a situation when this arose with one of the Kaspersky anti-virus products.  As soon as I became aware of it, I contacted them, and I believe they corrected the problem within a few days.  This particular issue has been closed for almost a year.

Version 5 of Activ E-Book Compiler is currently in beta.