ClamWin Free Antivirus :: View topic

Posted: Mon Jun 15, 2009 12:11 pm

Hi

I seemed to get a false positive on the following file on my machine: C:\WINDOWS\Installer\2417fcd7.msp. ClamWin 0.95.2 with database main 51; daily 9467 found W32.Virut.Gen.D-163. Submitting the file to other scanners (via https://virusscan.jotti.org) did not return a positive result for anything except ClamWin.

Has anyone else observed the same thing?

Ta

Posted: Mon Jun 15, 2009 2:27 pm

It's good that you check the file out. Now upload it to Clam AV (which provides the scan engine and databases for ClamWin). Their submission process begins at https://www.clamav.net/sendvirus/ on the web. When you get to the upload page, be sure to indicate it is a false positive, tell them the name of the falsely-detected virus, and tell in the comments section why it is a false positive (in your case, no other AVs spotted it). They will adjust their signature within a couple of days, and ClamWin will benefit as well.

Regards,

Posted: Mon Jun 15, 2009 4:42 pm

it might be too big to upload to clamav. I will PM you the ftp server details to uplaod to.

Thanks,
Alch

Posted: Tue Jun 16, 2009 3:29 pm

Hi Chaps

Many thanks. I've submitted as suggested.

Cheers

Posted: Tue Jun 16, 2009 4:52 pm

Thank you.

I'll forward that to clamav team and it should be removed soon.

Posted: Mon Jul 06, 2009 6:55 am

Thank you for your discussion. The same problem happened to me. It is very helpful to me.

Posted: Mon Jul 06, 2009 2:33 pm

Clam says their submission form can hand false positives up to 26 MB.

Regards,