Still an issue? Or valid trojan?

? Multiple systems have this, even after fresh installs?

Trojaned version of file '/usr/bin/diff' detected. Signature used: 'bash|^/bin/sh|file.h|proc.h|/dev/[^n]|^/bin/.*sh' (Generic).