ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
False Alert for Total Commander
nille


Joined: 26 Oct 2016
Posts: 5
Reply with quote
When checking the latest Total Commander ...

the '32+64-bit' download from here: http://www.ghisler.com/900_rc2.php

... with the Virus Total Online Scanner here ...

https://www.virustotal.com/de/file/aa7fbd797006e6656cbb74a42be2eaef0aa3a4e7c45c72488413e2665adcafc5/analysis/1477487998/

... ClamWin gives an Alert. It seems to be a false alert, no? See also this thread from 2014:

http://forums.clamwin.com/viewtopic.php?t=4111
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4255
Location: USA
Reply with quote
Yes, that is very likely a false positive detection. It is unlikely that the Clam AV engine used by ClamWin would be the only AV to detect a virus. Virus Total will notify Clam AV so they can correct their signature, but to be sure (and maybe hurry it up a little), upload a copy of the falsely detected file to Clam AV at the Clam AV Contact page--be sure to select the False Positive link--not the link to report a virus.

I like to see at least 2 of these AVs detect a file on Virus Total before I believe it: Avira, Bitdefender, Eset, Kaspersky, or Sophos. They are all good AVs with an in-house scan engine and large customer bases. Many AVs now use someone else's engine/signatures.

Regards,
View user's profileSend private message
nille


Joined: 26 Oct 2016
Posts: 5
Reply with quote
Hi, thanks for your answer

If you mean this page ...

https://www.clamav.net/reports/fp

... i have just sent a report.

Total Commander 9.0 RC3 now also gets false detected by Anity-AVL:

https://www.virustotal.com/de/file/99f208920923abf165f66e41ba7d2324f25b568d721b9a815cde3c2b16cd7482/analysis/

i have also contacted these dudes at http://www.antiy.net/contacts/ .

Regards, Nille
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4255
Location: USA
Reply with quote
Thanks on behalf of both AVs. Several months ago Virus Total announced that they would send files that were falsely detected to the AVs with the false detection, but it can not hurt for users to also send them. All AVs have a false positive now and then.

Regards,
View user's profileSend private message
nille


Joined: 26 Oct 2016
Posts: 5
Reply with quote
Hello again, and thanks for your quick reply

I have just re-uploaded the Total Commander 9.0RC3 x32+x64 Installer:

https://www.virustotal.com/de/file/99f208920923abf165f66e41ba7d2324f25b568d721b9a815cde3c2b16cd7482/analysis/1477580250/

Now the Antiy AVS does not complain any more but ClamWin still gives a false positive. Am i maybe doing something wrong?

Regards, Nille
View user's profileSend private message
nille


Joined: 26 Oct 2016
Posts: 5
Reply with quote
For the records, it is the combined installer from here:

https://www.ghisler.com/900_rc3.php
View user's profileSend private message
nille


Joined: 26 Oct 2016
Posts: 5
Reply with quote
Oh, i just reread your post, i misunderstood it, in the sense that it is already fixed. Ok, i wait.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4255
Location: USA
Reply with quote
It may take Clam AV some time before they fix their false positive signature. Clam AV is a free, open source antivirus that is owned by Cisco. No one works on it full time, and not many people are assigned to it. Cisco people work on it when they are not working on Cisco duties.

You have done everything you can.

ClamWin has some protection from false positives on important Microsoft files. When such files are falsely detected, ClamWin will not quarantine them--you will just see a message about the false positive. This is something that Clam AV does not have.

Regards,
View user's profileSend private message
False Alert for Total Commander
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic