After update tonight the database I scanned the memory, as I usually do, and detected the msvcm80.dll, msvcp80.dll and msvcr80.dll as infected files.

I tested with all files on different paths folders (even on XP, system I don't use) and keeps saying that these files are infected. I think that this is a mistake.

Indeed I downloaded from Microsoft the original 2005 distributables and keeps saying they are infected (msvcx80.dlls inside).

As I said, I think this is a mistake.


The most disturbing log

What does either Jotti or VirusTotal say about those files? You should verify the files with either one. Clam AV provides the scanning engine and signature database used by ClamWin. If there is little agreement on an infection, send the file to Clam AV at http://www.clamav.net/sendvirus/ on the web. When you get to the submission form, check the false positive designation and tell them the Jotti/VirusTotal results. Clam will verify the file and correct the false positive.

Regards,

I forgot to mention I already used the kaspersky website tool without virus for them.

With VirusTotal Clamav/Clamwin is the only one
VirusTotal for msvcm80.dll
VirusTotal for msvcp80.dll
VirusTotal for msvrc80.dll

Jotti for msvcm80.dll
Jotti for msvcp80.dll
Jotti for msvcr80.dll

EDIT: corrected links for Jotti.


EDIT2: report as false positive sent with this post as reference.

FYI have the same issue this morning on a Win32 Server 2003 (latest MS patch state from Feb patch day) after the latest Virus Database Update, affecting files from WinSxS, VMWare and BOINC. I also got the same results from Virus Total.

Would be great if you post your results here since I also believe these are false positives.

Thx and best regards.

This false positive has been reported to Clam AV for processing.

Regards,

At this time, virus DB updated and false positive fixed

Thank you.