ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
[Win.Trojan.Ramnit-7001] FALSE POSITIVE FOUND ?
davehatpec


Joined: 01 Feb 2017
Posts: 0
Reply with quote
The following files are Digitally Signed by Microsoft Corporation and may have been incorrectly detected as viruses:
C:\Drivers\sp54816\Graphics\igdumdx32.dll: [Win.Trojan.Ramnit-7001] FALSE POSITIVE FOUND
C:\Drivers\sp54817\Graphics\igdumdx32.dll: [Win.Trojan.Ramnit-7001] FALSE POSITIVE FOUND
C:\Windows\System32\DriverStore\FileRepository\kit38940.inf_amd64_neutral_9f2b25b000685d2d\igdumdx32.dll: [Win.Trojan.Ramnit-7001] FALSE POSITIVE FOUND
C:\Windows\SysWOW64\igdumdx32.dll: [Win.Trojan.Ramnit-7001] FALSE POSITIVE FOUND
Please do not be alarmed and help us by submitting the files identified above as FALSE POSITIVE at https://www.clamav.net/sendvirus/

I already submitted to the above URL but it only lets me upload one file.

Do I have a Trojan or not?
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 9
Location: USA
Reply with quote
No - as the ClamWin post-scan message says, they are all false positive (wrong) detections of one virus. Several years ago, the scan engine from Clam AV was having lots of false detections, but they would not do anything about it, so the ClamWin developers added some protection against false detections on important files. When there is such a false detection, ClamWin gives you the message you got.

As the message says, you can help Clam AV correct their wrong signature if you upload the falsely detected file to Clam AV. If you have more than one false detection, you can zip them. However, if several/all of the files have the same wrong virus detection (as in your case), just submit one file.

It may take Clam AV some time to prepare a corrected signature. It may help if you scan the file(s) on Virus Total (VG) because VT will send false positively detected files to the AVs involved. Sometime Clam AV will not prepare a correction. In that case, see whitelisting below.

You can whitelist the file so that ClamWin will not bother scanning it any more. Open ClamWin, choose Tools, Preferences, Filters, Exclude Matching Filenames. Select the square block, copy the location, filename and extension in the place provided and OK it. Example: c:\program folder name\program.extension.

Since some false positive files are not really quarantined by ClamWin--all it does is just give the false positive message, some users do not bother to do anything about it.

Thanks for using ClamWin!

Regards,
View user's profileSend private message
[Win.Trojan.Ramnit-7001] FALSE POSITIVE FOUND ?
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic