hi,
first thanks for your work. i m writing this message cause this is the first time (today) updating virus database leads to message from avast of this type :
"trojan found
file name :\Documents and Settings\All Users\.clamwin\db\clamav-3b97f371ab1378baa29aae6c9670ee2a.000009a0.clamtmp
malware name : JS:ScriptSH-inf [Trj]"
may i consider avast is wrong or is there really a problem ?
thanks
smahe

I just started to get the same from Avast.

File name: C:\ProgramData\.clamwin\db\clamav-6f2edcd2f3fedd2eacfb930310a5ad4a.00001048.clamtmp
Malware name: JS:ScriptSH-inf [Trj]
Malware type: Trojan Horse
VPS Version: 090512-0, 12/05/2009

It happens every time I try and update ClamWin's virus datagbase although the file name seems to change as the last time
it was C:\ProgramData\.clamwin\db\clamav-4ea86a2c0ced038f99dbec4d3bc69856.000011e4.clamtmp

ClamWin's Downloading Update Report is:
ClamAV update process started at Tue May 12 11:39:58 2009
main.cld is up to date (version: 50, sigs: 500667, f-level: 38, builder: sven)
Downloading daily-9352.cdiff [100%]
Downloading daily-9353.cdiff [100%]
Downloading daily-9354.cdiff [100%]
ERROR: Can't parse new database C:\ProgramData\.clamwin\db/clamav-4ea86a2c0ced038f99dbec4d3bc69856.000011e4.clamtmp
LibClamAV Error: cl_cvdhead: Can't open file C:\ProgramData\.clamwin\db/clamav-4ea86a2c0ced038f99dbec4d3bc69856.000011e4.clamtmp

--------------------------------------
Completed
--------------------------------------

fwiw, I'm running the latest version of ClamWin Free Antivirus (0.95.1).

After some Googling for "ScriptSH-inf [Trj]" (which I should really do earlier) I'm finding others have seen the same virus and initially it seems to be a problem with Avast and maybe a false positive. More reading necessary.

I don't think this is a virus. It looks like a MD5 file hash and not a real virus. You might try to delete the file and then see if you could exclude that ClamWin folder from Avast's scanning.

Regards,

ok i've just seen your replies
thanks for your searches and knowledges

I didn't this to be a virus either so I told avast to "DO NOTHING" and it appeared to allow the update and I have sent a false positive report to AVAST. we shall see what happens.

As per budzed above;

ERROR: Can't parse new database C:\Documents and Settings\All Users\.clamwin\db/clamav-6fc0bc0b1b1f1c06bc519dd0c8c6642b.00000e0c.clamtmp
LibClamAV Error: cl_cvdhead: Can't open file C:\Documents and Settings\All Users\.clamwin\db/clamav-6fc0bc0b1b1f1c06bc519dd0c8c6642b.00000e0c.clamtmp

but in my case, AVAST! does not seem to "accept" my opinion that it is a false positive...what is odd, in my not computer saive mind, is that if I am in Hotmail (I seldom am) the warnings sound about every minute whereas in other web locations (gmail, google, youtube, etc etc) or in other apps (OoO etc) the warnings only sound about once a day, when Clamwin wants to update.

This originally started for me about May 12/09 as well but I had assumed until it started happening again today that it was my not using the most up-to-date version of Clamwin but it, the "alerts", have been happening more frequently since updating (May 14/09)

Scanned the directory .clamwin (all the files) with the latest version of a-squared free, spybot, avast from my Linux server, and clamav from my Linux server and no errors or malware were reported.