qmx-integration-fms.exe file is flagged as malware (4374911)

The Integration cartridge contains some sample configuration for forwarding alarms from QMX to Foglight. This configuration makes use of a qmx-integration-fms.exe binary located in the integration samples zip file, and that binary is getting flagged by virus scanners.

 

This exe file is used as a sample component for the Integration cartridge. It seems to be flagged because it calls wscript.exe with admin privileges that could in general be used by any application to run external scripts. This does not mean that the file is malware or infected.

The application was written for Foglight 5.2 back around 2008 for the Integration cartridge to feed "Quest Management Extension" alarms into Foglight. More details can be found in the pdf file that is in the same location as where the exe was located below the cartridge.exploded directory on the FMS.

WORKAROUND

This sample configuration can be deleted since QMX is an old product that is no longer offered/supported by Quest. The file in the zip can be removed along with the zip file itself, but would it be restored when reset manually or during an upgrade. If the zip file is removed it gets restored in the next restart. As such, an exception to scanning the file may be appropriate.

STATUS

Issue fixed in version 7.1.1 of the Foglight Cartridge for Integrations and included with the 7.1.3 release of Foglight. The latest versions can be be downloaded here.