ClamWin Free Antivirus :: View topic

Posted: Fri Feb 12, 2010 1:58 am

After update tonight the database I scanned the memory, as I usually do, and detected the msvcm80.dll, msvcp80.dll and msvcr80.dll as infected files.

I tested with all files on different paths folders (even on XP, system I don't use) and keeps saying that these files are infected. I think that this is a mistake.

Indeed I downloaded from Microsoft the original 2005 distributables and keeps saying they are infected (msvcx80.dlls inside).

As I said, I think this is a mistake.

The most disturbing log

Quote:

Scan Started Fri Feb 12 02:37:33 2010
-------------------------------------------------------------------------------

x:\Archivos de programa\ClamWin\bin\msvcp80.dll: Trojan.FakeAV-281 FOUND
x:\Archivos de programa\ClamWin\bin\msvcm80.dll: Trojan.IRC-3 FOUND
x:\Archivos de programa\ClamWin\bin\msvcr80.dll: Trojan.FakeAV-282 FOUND

----------- SCAN SUMMARY -----------
Known viruses: 712437
Engine version: 0.95.3
Scanned directories: 0
Scanned files: 3
Infected files: 3
Data scanned: 1.11 MB
Data read: 1.58 MB (ratio 0.70:1)
Time: 13.859 sec (0 m 13 s)

Posted: Fri Feb 12, 2010 2:44 am

What does either Jotti or VirusTotal say about those files? You should verify the files with either one. Clam AV provides the scanning engine and signature database used by ClamWin. If there is little agreement on an infection, send the file to Clam AV at https://www.clamav.net/sendvirus/ on the web. When you get to the submission form, check the false positive designation and tell them the Jotti/VirusTotal results. Clam will verify the file and correct the false positive.

Regards,

Posted: Fri Feb 12, 2010 2:58 am

GuitarBob wrote:

What does either Jotti or VirusTotal say about those files? You should verify the files with either one. Clam AV provides the scanning engine and signature database used by ClamWin. If there is little agreement on an infection, send the file to Clam AV at https://www.clamav.net/sendvirus/ on the web. When you get to the submission form, check the false positive designation and tell them the Jotti/VirusTotal results. Clam will verify the file and correct the false positive.

Regards,

I forgot to mention I already used the kaspersky website tool without virus for them.

With VirusTotal Clamav/Clamwin is the only one
https://www.virustotal.com/analisis/c4c8c2d251b90d77d1ac75cbd39c3f0b18fc170d5a95d1c13a0266f7260b479d-1265940284 VirusTotal for msvcm80.dll
https://www.virustotal.com/analisis/2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08-1265938276 VirusTotal for msvcp80.dll
https://www.virustotal.com/analisis/02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9-1265938296 VirusTotal for msvrc80.dll

https://virusscan.jotti.org/es/scanresult/7d6cc9ae6a80527ac01eb499fc3224d3b82738fb/88f07e4c84f3731d7080a601b5e5f290dc2e391e Jotti for msvcm80.dll
https://virusscan.jotti.org/es/scanresult/7d01101544d05f72af616a169b66c8f527fb87e7/d0d8f46175577e3e1d86e11b57c83e529246b1a3 Jotti for msvcp80.dll
https://virusscan.jotti.org/es/scanresult/e7f0f10c98ca227894dc393a0587d8b42bb6a294/67bd31c1b19cf3a2a9083f458fa73717abf40193 Jotti for msvcr80.dll

EDIT: corrected links for Jotti.

EDIT2: report as false positive sent with this post as reference.

Posted: Fri Feb 12, 2010 8:50 am

FYI have the same issue this morning on a Win32 Server 2003 (latest MS patch state from Feb patch day) after the latest Virus Database Update, affecting files from WinSxS, VMWare and BOINC. I also got the same results from Virus Total.

Would be great if you post your results here since I also believe these are false positives.

Thx and best regards.

Posted: Fri Feb 12, 2010 2:03 pm

This false positive has been reported to Clam AV for processing.

Regards,

Posted: Fri Feb 12, 2010 2:33 pm

At this time, virus DB updated and false positive fixed Smile

Thank you.