# Kryptik.IA trojan

**URL:** <https://forum.inductiveautomation.com/t/kryptik-ia-trojan/15009>\
**Category:** Ignition\
**Created:** [August 8, 2017, 11:24am UTC](https://forum.inductiveautomation.com/t/kryptik-ia-trojan/15009 "2017-08-08T11:24:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cezipper](https://avatars.discourse-cdn.com/v4/letter/c/58956e/32.png) [@cezipper](https://forum.inductiveautomation.com/u/cezipper)\
**Post date:** [August 8, 2017, 11:24am UTC](https://forum.inductiveautomation.com/t/kryptik-ia-trojan/15009/1 "2017-08-08T11:24:03Z")

</div>

ESET Endpoint Antivirus has identified a “Kryptik.IA” trojan in many of the inductive automation software files on my machine and throughout my company’s computers. Any idea what this is. Example infected files include:

C:\Program Files\Inductive Automation\Ignition\data\jar-cache\recipeinstaller\_\_682368977\_\_recipeinstaller.jar   
C:\Program Files\Inductive Automation\Ignition\user-lib\modules\Recipe-Installer-module.modl   
C:\Program Files\Inductive Automation\Ignition\user-lib\modules\Recipe-module.modl   
C:\Users\charlesz\Downloads\Flexi\_Soft\_Designer\_de\_en\_fr\_es\_ja\_cs\_tr\_de\_DC0001235\IGNITION\InstallFIles\Recipe-Installer-module.modl  
C:\Users\charlesz\Downloads\InductiveAutomation\MES\V1\_9\_3\Recipe-Installer-module.modl   
C:\Users\charlesz\Downloads\InductiveAutomation\MES\V2\_9\_1\Recipe-module.modl   
C:\Users\charlesz\Downloads\InductiveAutomation\v1\_9\_0\Recipe-Installer-module.modl

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [August 8, 2017, 12:54pm UTC](https://forum.inductiveautomation.com/t/kryptik-ia-trojan/15009/2 "2017-08-08T12:54:45Z")

</div>

It’s probably a false positive. Seems to be taking issue with the contents of the Recipe module and installer for some reason. I’ll point one of the Sepasoft guys to this thread and he can look into it further with you.

---

<div class="post-metadata">

**Author:** ![PeteLow](https://avatars.discourse-cdn.com/v4/letter/p/df705f/32.png) [@PeteLow](https://forum.inductiveautomation.com/u/PeteLow)\
**Post date:** [August 8, 2017, 3:24pm UTC](https://forum.inductiveautomation.com/t/kryptik-ia-trojan/15009/3 "2017-08-08T15:24:21Z")

</div>

Hi,  
We are not seeing any detection here with the AV software we use. I directly scanned the installer and then unzipped the .modl file and scanned each file but did not get any detection. The AV we use is checking for Kryptik.IA in Win32 and java.

When you say many, are there other files where this is detected? Is it all the installers?

Pete Low  
Tech Support  
Sepasoft