callscript.exe or ntspawn.exe is marked or flagged as malware or trojan

Products

• CA Automic Applications Manager (AM)

Issue/Introduction

Anti-virus or similar applications may flag %AW_HOME%\c\callscript.exe or %AW_HOME%\c\ntspawn.exe as a malware or trojan.

These two files are extracted during the installation from the zip files LB_nt.zip and LB_vlawbd01.zip so these two zip files may be flagged as well.

Cause

callscript.exe has not changed in some time and was compiled VS2008. Compiling the same code in VS2022 resolves the issue.

Resolution

Solution:
This is fixed in Applications Manager 9.6.

Workaround:
Add both callscript.exe and ntspawn.exe to the anti-virus' exception list.

To check the file hash for callscript.exe and ntspawn.exe, run a "Get-FileHash" powershell command against the files. Below is an example output seen in cmd prompt window:

C:\AMBUILDS\AMS940WIN\c>powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\AMBUILDS\AMS940WIN\c> Get-FileHash callscript.exe

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          0B44B7328E5F6D8138D04017DBB986CDDD2EE57E87240804726EBA4A4D14FB1E       C:\AMBUILDS\AMS940WIN\c\callscript.exe

Below is a table containing the hash values for both callscript and ntspawn, based on version:

Version	Executable	Algorithm	Hash
9.4.0	callscript.exe	SHA256	0B44B7328E5F6D8138D04017DBB986CDDD2EE57E87240804726EBA4A4D14FB1E
9.4.1	callscript.exe	SHA256	8E74F0640A2C150A0978345E62CB9DC92668FCAD6BA79FCE8B64F4E681F11604
9.4.2	callscript.exe	SHA256	04A7899C9135A15F7FE9390FEE0C2027E1820B29F54F7E4D20E57EF41BBC2081
9.4.3	callscript.exe	SHA256	04A7899C9135A15F7FE9390FEE0C2027E1820B29F54F7E4D20E57EF41BBC2081
9.4.4	callscript.exe	SHA256	04A7899C9135A15F7FE9390FEE0C2027E1820B29F54F7E4D20E57EF41BBC2081
9.5	callscript.exe	SHA256	04A7899C9135A15F7FE9390FEE0C2027E1820B29F54F7E4D20E57EF41BBC2081
9.5.1	callscript.exe	SHA256	04A7899C9135A15F7FE9390FEE0C2027E1820B29F54F7E4D20E57EF41BBC2081
9.5.2	callscript.exe	SHA256	04A7899C9135A15F7FE9390FEE0C2027E1820B29F54F7E4D20E57EF41BBC2081
9.5.3	callscript.exe	SHA256	04A7899C9135A15F7FE9390FEE0C2027E1820B29F54F7E4D20E57EF41BBC2081
9.6	callscript.exe	SHA256	DCCA7302C0045CCAF3B006CED3FCA4EE3EEB86B96B1962EFE7B9450D5AE6D112
9.4.0	ntspawn.exe	SHA256	56F75FDF07FDDA649AECC35A82A69265D201F0AB891BFED80FAF6F8A92FDF3B2
9.4.1	ntspawn.exe	SHA256	56F75FDF07FDDA649AECC35A82A69265D201F0AB891BFED80FAF6F8A92FDF3B2
9.4.2	ntspawn.exe	SHA256	56F75FDF07FDDA649AECC35A82A69265D201F0AB891BFED80FAF6F8A92FDF3B2
9.4.3	ntspawn.exe	SHA256	56F75FDF07FDDA649AECC35A82A69265D201F0AB891BFED80FAF6F8A92FDF3B2
9.4.4	ntspawn.exe	SHA256	86DD6489C4D6FE516FE02150AFF84182F0708135BD76C823CF8E29050AF2C42B
9.5	ntspawn.exe	SHA256	10398EBE6D3184B1D0DB32BB3BE5B44F1B1F671F6B3F109A2F38CB447D66574D
9.5.1	ntspawn.exe	SHA256	229EF262595CA80F40078A341A6569E2C8E0D72B40B66A851901BB5366642EBA
9.5.2	ntspawn.exe	SHA256	1533DE4A0185A71ADF2DEBE6AE36F577D81481B8006D6866B386F18613B4AF52
9.5.3	ntspawn.exe	SHA256	0E590CF52AD39A5759AFE02BE0B31F858E2E633C79040DC011992C24309C0AFF
9.6	ntspawn.exe	SHA256	629AB9CDE6D29E71661FA38F5E37E6C8A309D126F21BFE9B34D4C655D8E6F85C

Additional Information

LB_nt.zip - is specifically used for a Windows OS installation and can be removed if installing on any other OS
LB_vlawbd01.zip - is an unused zip and can be removed. Permanent removal of this zip file in 9.6.1