GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Tue Jul 07, 2009 4:41 pm |
|
 |
 |
 |
 |
f by "damaged files," you mean files infected by viruses, when it finds them, ClamWin will act according to the configuration in its General Preferences, Infected File section. The default configuration is Report Only. You can change it to Remove or to Quarantine. I prefer to leave mine set on Report Only. Let me tell you why.
Sometimes you can get a False Positive, which occurs when ClamWin thinks a file is infected with a virus but it isn't really--the file just has a signature that is similar to the signature of a certain virus. If there is a false positive on an important Windows system file, if you remove it or quarantine, it, you will lose access to the file--and perhaps to your Windows operating system (it happened to me, and it took me a couple of days to find out what happened and fix things).
So I normally keep my infected file preference set to Report only. When ClamWin reports an infection, I upload the infected file (ClamWin's scan report will tell you where the file is on your computer) to Jotti at https://virusscan.jotti.org/en on the web or to VirusTotal at https://www.virustotal.com/ on the web. Either service will scan the file for free with multiple antivirus programs (including Clam AV, which furnishes the engine/signatures for ClamWin). If more than a few AVs on either service find the file is infected (I like to see at least 5), it is probably not a false positive, and you can either manually delete the infected file on your computer or temporarily set ClamWin's infected file preference to remove or quarantine and then run another scan on the file. If the file is a system file, however, don't delete it --you may be able to use Windows System Restore to replace the system file with the correct Windows file, or you might could use Windows System Checker to replace it. If the file is a non-Windows system file and you change the infected file preference and re-scan, be sure to change it back to Report Only when finished. If the file was as non-system file that was important to you, you shoud restore it from backup. I don't normally use Quarantine--I just remove it entirely from my machine.
If the file was a false positive, you should report it to Clam AV and upload it to them so they can fix it (within a couple of days). The Clam submission process starts at https://www.clamav.net/sendvirus/ on the web. When you get to the upload page, be sure to check the false positive block, tell them the exact name of the false virus detected, and write in the comments section why you think it is a false positive (for instance, "only Clam and 2 other AVs on Jotti find an infection").
I hope this explanation helps you. Let me know if it is too long-winded to understand.
Regards,
|