ClamWin Free Antivirus :: View topic - ClamAV Trojan.Mybot-11441 false alarm?

Posted: Sat Oct 11, 2008 5:29 pm

Hi,

Winpatrol.exe version 15.9.2008.1 is being detected as Trojan.Mybot-11441 by clamwin 0.94 with latest pattern file. I believe it is a false alarm.

virustotal shows thw following 3 out of 36 as detections:

ClamAV 0.93.1 2008.10.10 Trojan.Mybot-11441
Panda 9.0.0.4 2008.10.10 Suspicious file
Sunbelt 3.1.1708.1 2008.10.10 VIPRE.Suspicious

The remaining 33 scanners find nothing.

Kind regards,

Brad Skiff

my clamwin log follows:

Recursive clamscan of drive C: follows below
Thu 10/09/2008
12:01 AM

-------------------------------------------------------------------------------

*** Scanning Programs in Computer Memory ***
*** Memory Scan: using ToolHelp ***

*** Scanned 28 processes - 378 modules ***
*** Computer Memory Scan Completed ***

C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe: Trojan.Mybot-11441 FOUND
C:\Windows\System32\wbem\Logs\WMITracing.log: Permission denied

----------- SCAN SUMMARY -----------
Known viruses: 439772
Engine version: 0.94
Scanned directories: 13591
Scanned files: 87946
Infected files: 1
Data scanned: 12636.64 MB
Time: 6899.646 sec (114 m 59 s)

Posted: Sat Oct 11, 2008 5:50 pm

Hello,

GuitarBob has already alerted Clam staff about this issue (see below).

GuitarBob wrote:

I reported that false positive (FP) to the Clam people a couple of days ago. I also use WinPatrol, and I just can't stand to have one of my favorite programs with a FP, so I jump on it pretty fast.

For future reference, the FP can be reported to Clam at http://cgi.clamav.net/sendvirus.cgi on the web. You have to upload a copy of the file with the FP, and fill out the same form they use for virus submissions, but select the FP block and provide an explanation.

Guess they will fix the FP rapidly.
Regards,

Posted: Sat Oct 11, 2008 5:59 pm

Thanks for the info and FP reporting link Antonio.

Brad =)

Posted: Sat Oct 11, 2008 6:38 pm

There have been several notices of the false positive of this particular version of Mybot sent to Clam. Hopefully it will be addressed soon. I see it every day when I scan my computer.

Regards,

Posted: Mon Oct 13, 2008 6:27 pm

The Trojan.Mybot false positive has been fixed and will take effect in the next Clam/ClamWin signature update after 1:30 PM USA central time today, Monday October 13.

Regards,