How to find and eliminate a Trojan on a server? Can a message about a virus be a 1C error?

Question

1C-Enterprise

When connecting 1C to the bank, I installed the necessary modules twice, that is, the operation was interrupted.
They called from the bank, reported a violation of the 1C module, they said that a Trojan had done it.
I removed the digital signature, rebooted the server, ran the server with the doctor web, no positives.
If I found and deleted this one thing, but how to look for a Trojan in case of silence of the antivirus? There is an exact time of the incident in a message from the bank.
Maybe someone came across this, it could be a false positive due to incorrect operation of 1s?

Answer 1

they said it was done by a trojan.

If they didn’t give reasons, then most likely they just threw the problem off themselves onto you, like: “The problem is on your side, sort it out. Probably your antivirus is blocking something. We others don’t have problems, which means you it's a virus."

Answer 2

A very incomplete description, to be honest. Neither the version of the 1C configuration, nor the bank to which you are connecting, nor the modules that you installed are indicated (in fact, for most banks in 1C, you don’t need to install any modules, it works out of the box).
It is very likely that the message about the Trojan is due to incorrect 1C settings. For example, it knocks on the wrong protocol or transmits incorrect data.
If you need help, knock on the TG, because publicly such issues should not be discussed. I can help, but not for free.

Answer 3

To her words, turn off the avg antivirus, it climbs into traffic