ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
False Positive?
starbound


Joined: 23 Dec 2008
Posts: 99
Reply with quote
Clam Sentinel gave me an alert for this when I opened up a twitter for mobile page on the computer, it put it into the quarantine alongside a text document, is this normal and has anyone that uses Opera found this also? I take it that Clam Sentinel sticks the word suspicious at the end?

OPERAMAPI.DLL.suspicious
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4376
Location: USA
Reply with quote
It's normal. The text document is a locator in case you want to exclude the file from scans (stop Sentinel, whitelist the file via Sentinel Recover in quarantine menu, and start it again.

Clam Sentinel is not for everyone. Read the Clam Sentinel Simple Guide for operating information. Clam Sentinel will give more false positives than other AVs, but most of them are not free, open source, and do not have access to information like this. It is more "hands on" than most users like.

Regards,
View user's profileSend private message
starbound


Joined: 23 Dec 2008
Posts: 99
Reply with quote
GuitarBob wrote:
Clam Sentinel is not for everyone.

Regards,


I have since removed both programs as it was severely slowing my internet connection down while browsing webpages.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4376
Location: USA
Reply with quote
Good. Look into a combination of Microsoft Security Essentials/Windows Defender with Malwarebytes free antimalware. This should provide good protection for you.

Regards,
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 562
Location: **UNKNOWN**
Reply with quote
ClamWin and Clam Sentinel should not be slowing your internet down. ClamWin has no on-access scanning, and Clam Sentinel only scans files that are added or modified. I would assume maybe you picked up something nasty, that is why Sentinel was flagging some files on your system. I would try Malwarebytes free and see if it picks anything up on your system. Maybe sure you know what the infectious files are before removing, so you didn't accidentally remove anything important that was flagged as infected (false positive).
View user's profileSend private message
starbound


Joined: 23 Dec 2008
Posts: 99
Reply with quote
ROCKNROLLKID wrote:
ClamWin and Clam Sentinel should not be slowing your internet down. ClamWin has no on-access scanning, and Clam Sentinel only scans files that are added or modified. I would assume maybe you picked up something nasty, that is why Sentinel was flagging some files on your system. I would try Malwarebytes free and see if it picks anything up on your system. Maybe sure you know what the infectious files are before removing, so you didn't accidentally remove anything important that was flagged as infected (false positive).


Strange how when I hovered over the system tray icon for sentinel it would say that it was scanning when I was on the internet.

Since I deleted I don't have the slow issue.
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 562
Location: **UNKNOWN**
Reply with quote
What internet browser do you use?
View user's profileSend private message
starbound


Joined: 23 Dec 2008
Posts: 99
Reply with quote
ROCKNROLLKID wrote:
What internet browser do you use?


I have to use Opera 12.02 build 1578, only because it's for dare I say it Win 98.
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 562
Location: **UNKNOWN**
Reply with quote
Ah ok. I didn't know you were on Windows 98. It could be Sentinel doesn't not have much support for Windows 98 anymore. Hard to find any AV with win98 support anymore. You can try Avast 4.8. I think it is still getting virus signatures, but I am not sure.
View user's profileSend private message
starbound


Joined: 23 Dec 2008
Posts: 99
Reply with quote
ROCKNROLLKID wrote:
Ah ok. I didn't know you were on Windows 98. It could be Sentinel doesn't not have much support for Windows 98 anymore. Hard to find any AV with win98 support anymore. You can try Avast 4.8. I think it is still getting virus signatures, but I am not sure.


Nope, it's stopped working for me anyway hence why I thought to try this.
View user's profileSend private message
Franvgls


Joined: 14 Oct 2015
Posts: 1
Location: Spain
Reply with quote
I had what I think is a false positive of Win.Trojan.Ramnit-5587 apparently in one of the toshiba .dll files in my computer. Have checked with total antivirus and it was found only with Clam antivirus, that I've been using for years, without many problems.
I've also found an answer prompting to report the false positive to be solved, but haven't found where should I notify the false positive.
Regards,
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4376
Location: USA
Reply with quote
Virus Total will report the false positive to Clam AV so they can change their signature. You can report both false positives and new viruses to Clam AV at http://www.clamav.net/contact on the web.

Regards,
View user's profileSend private message
Scendera


Joined: 16 May 2010
Posts: 9
Reply with quote
Franvgls wrote:
I had what I think is a false positive of Win.Trojan.Ramnit-5587 apparently in one of the toshiba .dll files in my computer.


Seems to have gone hog wild with false positives on Ramnit variants lately...today it's decided v8.dll from my Steam install is one. VT disagrees.

https://www.virustotal.com/en/file/a39d545b5f06fb14ce4eae976fc87b24b985dfa31c4b0dbe696286700350921d/analysis/1445195277/
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 562
Location: **UNKNOWN**
Reply with quote
Same on mine. They should have a fix for it, eventually.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4376
Location: USA
Reply with quote
It appears that Clam has a fairly new sigmaker. Just keep sending those FPs to Virus Total

Regards,
View user's profileSend private message
False Positive?
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic