PaulM47
Joined: 30 Jul 2008 |
Posts: 0 |
|
|
 |
Posted: Mon Aug 11, 2008 4:37 pm |
|
 |
 |
 |
 |
Hi, I've just run the first full scan of my software archives using Clamwin and was surprised to see Nero6.6.1.15a.exe flag up 'Adware.Search-63' and NVE1041.exe flag up 'Trojan.Keygen-8', both of which as far as I'm aware are pucker files from Ahead Software. Neither have previously flagged up any problems under AVG or AVAST scanners. I assume these are 'false positives' and can safely be ignored ?
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Mon Aug 11, 2008 10:07 pm |
|
 |
 |
 |
 |
If these are Potentially Unwanted Applications per Clam, you might want to turn off the PUA option in ClamWin's Advanced configuration. The PUAs are optional, and they just indicate that a file is packed with a packer frequently used by malware or could be a hacker tool of some kind. If you know it's on your computer, that's okay.
If they are not PUA detections, you might upload those files to Jotti and have them scanned there to see what lots of other AVs say about them. If only a couple of others besides Clam find them infected, it's probably a false positive. If several other AVs also spot something, then they probably are evil--or could be used for evil purposes.
Go to the Clam submission page and tell them about any false positives you find. It's located at https://cgi.clamav.net/sendvirus.cgi on the web. They don't usually change their PUA detection signatures, however.
Regards,
|
|