When checking the latest Total Commander ...

the '32+64-bit' download from here: http://www.ghisler.com/900_rc2.php

... with the Virus Total Online Scanner here ...

https://www.virustotal.com/de/file/aa7fbd797006e6656cbb74a42be2eaef0aa3a4e7c45c72488413e2665adcafc5/analysis/1477487998/

... ClamWin gives an Alert. It seems to be a false alert, no? See also this thread from 2014:

http://forums.clamwin.com/viewtopic.php?t=4111

Yes, that is very likely a false positive detection. It is unlikely that the Clam AV engine used by ClamWin would be the only AV to detect a virus. Virus Total will notify Clam AV so they can correct their signature, but to be sure (and maybe hurry it up a little), upload a copy of the falsely detected file to Clam AV at the Clam AV Contact page--be sure to select the False Positive link--not the link to report a virus.

I like to see at least 2 of these AVs detect a file on Virus Total before I believe it: Avira, Bitdefender, Eset, Kaspersky, or Sophos. They are all good AVs with an in-house scan engine and large customer bases. Many AVs now use someone else's engine/signatures.

Regards,

Hi, thanks for your answer

If you mean this page ...

https://www.clamav.net/reports/fp

... i have just sent a report.

Total Commander 9.0 RC3 now also gets false detected by Anity-AVL:

https://www.virustotal.com/de/file/99f208920923abf165f66e41ba7d2324f25b568d721b9a815cde3c2b16cd7482/analysis/

i have also contacted these dudes at http://www.antiy.net/contacts/ .

Regards, Nille

Thanks on behalf of both AVs. Several months ago Virus Total announced that they would send files that were falsely detected to the AVs with the false detection, but it can not hurt for users to also send them. All AVs have a false positive now and then.

Regards,

Hello again, and thanks for your quick reply

I have just re-uploaded the Total Commander 9.0RC3 x32+x64 Installer:

https://www.virustotal.com/de/file/99f208920923abf165f66e41ba7d2324f25b568d721b9a815cde3c2b16cd7482/analysis/1477580250/

Now the Antiy AVS does not complain any more but ClamWin still gives a false positive. Am i maybe doing something wrong?

Regards, Nille

For the records, it is the combined installer from here:

https://www.ghisler.com/900_rc3.php

Oh, i just reread your post, i misunderstood it, in the sense that it is already fixed. Ok, i wait.

It may take Clam AV some time before they fix their false positive signature. Clam AV is a free, open source antivirus that is owned by Cisco. No one works on it full time, and not many people are assigned to it. Cisco people work on it when they are not working on Cisco duties.

You have done everything you can.

ClamWin has some protection from false positives on important Microsoft files. When such files are falsely detected, ClamWin will not quarantine them--you will just see a message about the false positive. This is something that Clam AV does not have.

Regards,