ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Possible False Positive (Not sure who to contact to report)
kernaljake


Joined: 11 Aug 2013
Posts: 2
Reply with quote
Hi,

I recently used ClamAV in a GNU/Linux distribution to scan my entire system, including a Windows partition. It found two infected files on the Windows partition, one in Program Files and one in Program Files x86, so I believe they were just different versions of the same file. When I scanned the hard drive in Windows using Trend Micro Titanium and Microsoft Security Essentials, it found no infections what so ever. I also do not believe that my system is actually infected. I am aware of the file submission forum on the ClamAv homepage, however, I do not know if I still have access to the "infected" files to submit them. I do, however, have the scan log file that I can submit if it will help.

I believe this may have been a false positive. Any help on reporting this will be very much appreciated.

- kernaljake
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4376
Location: USA
Reply with quote
All false positives (Linux and Windows) should be reported to Clam AV starting at http://www.clamav.net/lang/en/sendvirus/ on the web. This page has one link for false positives and another link for undetected viruses, so be sure to choose the correct link. You can verify detections or false positives by scanning them with either the Jotti or Virus Total online scanning services. I like to see at least 2 of these AVs detect a file as infected before I believe it: Avira AntiVir, Bitdefender, NOD32, Kaspersky, and Sophos.

Clam AV can not do anything with a scan report--they need to work with actual files. If you had Clam set to quarantine on your machine, any detected file should be in the quarantine folder.

Regards,
View user's profileSend private message
kernaljake


Joined: 11 Aug 2013
Posts: 2
Reply with quote
Hi guitarbob and thank you for your reply! I submitted the file in question via the false positive submission form. I am not sure if Clamav is setup to quarantine files on my system.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4376
Location: USA
Reply with quote
I can't help much with Clam AV, since I use ClamWin, which has a graphical user interface to do the user configuration. My ClamWin configuration file has these options related to quarantine:

quarantinedir = C:\ProgramData\.clamwin\quarantine
maxlogsize = 1
moveinfected = 1

I have my copy of ClamWin configured to move detected/infected files to the quarantine folder. Clam AV probably has similar options if you can find the configuration file.

Regards,
View user's profileSend private message
Possible False Positive (Not sure who to contact to report)
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic