Hello everyone,

I am a newbie with ClamWin so I first want to say thank you for making this software available for FREE!

I scanned my computer and came up with the virus below.

C:\Program Files\Microsoft Office\Office\PPTTOOLS.PPA: Exploit.MSWord.CVE_2006_6561-1

I went to the following site to scan it online and with the 32 virus scanners only Clam recognized the virus.
https://www.virustotal.com/en/indexf.html

So I have two questions:
1. Is this a real virus?
2. If it is a virus, how do I get rid of it?

I searched to net for info regarding this and could not find anything useful. Any help would be appreciated.

Thanks,
Kurt

P.S. Below is the scan results from VirusTotal website.


File PPTTOOLS.PPA received on 09.01.2007 17:03:02 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 1/32 (3.13%)

Antivirus Version Last Update Result
AhnLab-V3 2007.9.1.0 2007.09.01 -
AntiVir 7.4.1.66 2007.08.31 -
Authentium 4.93.8 2007.09.01 -
Avast 4.7.1029.0 2007.09.01 -
AVG 7.5.0.484 2007.08.31 -
BitDefender 7.2 2007.09.01 -
CAT-QuickHeal 9.00 2007.09.01 -
ClamAV 0.91.2 2007.09.01 Exploit.MSWord.CVE_2006_6561-1
DrWeb 4.33 2007.09.01 -
eSafe 7.0.15.0 2007.08.29 -
eTrust-Vet 31.1.5100 2007.08.31 -
Ewido 4.0 2007.09.01 -
FileAdvisor 1 2007.09.01 -
Fortinet 3.11.0.0 2007.09.01 -
F-Prot 4.3.2.48 2007.08.31 -
F-Secure 6.70.13030.0 2007.08.31 -
Ikarus T3.1.1.12 2007.09.01 -
Kaspersky 4.0.2.24 2007.09.01 -
McAfee 5110 2007.08.31 -
Microsoft 1.2803 2007.09.01 -
NOD32v2 2495 2007.09.01 -
Norman 5.80.02 2007.08.31 -
Panda 9.0.0.4 2007.09.01 -
Prevx1 V2 2007.09.01 -
Rising 19.38.52.00 2007.09.01 -
Sophos 4.21.0 2007.09.01 -
Sunbelt 2.2.907.0 2007.08.31 -
Symantec 10 2007.09.01 -
TheHacker 6.1.9.175 2007.08.31 -
VBA32 3.12.2.3 2007.09.01 -
VirusBuster 4.3.26:9 2007.09.01 -
Webwasher-Gateway 6.0.1 2007.08.31 -
Additional information
File size: 1544704 bytes
MD5: 678a50fdc2f312e1e70082e465af8cc7
SHA1: b6efaa120385534021ab864cd84f54aeb74aed54

it appears to be a false positive if only clam recognised it as a virus.

please submit it to the ClamAV database team here:
https://clamav.net/sendvirus.cgi