ClamWin Free Antivirus :: View topic - Fales (?) virus reports on registry files

Posted: Sun May 14, 2006 5:40 pm

Im using 0.88.2.3 clamwin and I got a message stating that I have two viruses in two files. But when I look into the files they look very empty.

Here is the clamwin log:

Code:

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots\RegGBP2b-Global.reg: Trojan.WinREG.StartPage-3 FOUND
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots\RegUBP2b-Administrat?¶r.reg: Trojan.WinREG.StartPage-3 FOUND
-- summary --
Known viruses: 55049
Engine version: 0.88.2
Scanned directories: 6406
Scanned files: 41617
Infected files: 2

But then when I check the files the look like this:
RegUBP2b-Administrat?¶r.reg

Code:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"
// the value ""Start Page_bak"" does not exist
// the value ""Default_Page_URL"" does not exist
// the value ""Default_Search_URL"" does not exist
// the value ""First Home Page"" does not exist
// the value ""SearchAssistant"" does not exist
// the value ""HomeOldSP"" does not exist

RegGBP2b-Global.reg

Code:

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
// the value ""Start Page_bak"" does not exist
// the value ""First Home Page"" does not exist
// the value ""SearchAssistant"" does not exist
// the value ""HomeOldSP"" does not exist

I guess the "RegGBP2b-Global.reg" file could have some bad things in it, but just by looking at it looks ok. Does anyone have an explaination for this?

Posted: Sun May 14, 2006 11:39 pm

I guess it is a false positive as it should not treat any start page registry as a trojan.

Posted: Mon May 15, 2006 6:42 am

Ok, I will report it then as a bug

Posted: Mon May 15, 2006 8:25 am

I've already submitted a false positive request

Posted: Thu May 18, 2006 1:44 am

I am getting the same message:

C:/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Snapshots/RegGBP2b-Global.reg: Trojan.WinREG.StartPage-3 FOUND
C:/Documents and Settings/All Users/Application Data/Spybot - Search & Destroy/Snapshots/RegUBP2b-Administrator.reg: Trojan.WinREG.StartPage-3 FOUND

I am using ClamWIN Version 0.88.2.3

As per my settings, these 2 files were move to the Quarantine folder.
To be safe I deleted these 2 files in the Quarantine folder.

Will that cause me any problems? (If these are false positive.)

Posted: Thu May 18, 2006 6:37 am

thses are false postive and should have been resolved by yesterday's database update. I don't think you need to worry about the quarantined files either