How do you attach raw message containg virus? My scanlog shows what I think are two false positives, but I don't know how to attach or what file to send.

Thanks in advance

Mike

scan those at https://virustotal.com and see what other av programs detect

https://upload2.postimage.org/120257/photo_hosting.html
https://upload2.postimage.org/120414/photo_hosting.html

Here are the results from https://virustotal.com/ .

As you can see ClamAV and Panda are the only scan that are positive, so I assume these are false positives.

Mike

yes it is very lilkely. You may submit those here:
https://www.clamav.net/sendvirus.html

jeez, I've just spent 100 minutes tracking down what to do with a possible false-positive detected by ClamWin, only to be frustrated....

First I searched this forum to find out the procedure (fine), next scanned the suspect with two online scanners (its actually https://www.virustotal.com/en/indexx.html for VirusTotal) and Jotti, gathered the results and prepared to send it off to ClamAv, only to get through the upload and then receive an error message:



So, I'm still not sure if this is a false- or true-positive, and probably never will. Would have been nice for them to indicate this before I wasted all that time.

In any case, here are the results of the two online scans, FWIW:

Jotti scan:


VirusTotal scan:

<sigh>

You're right, the FAQ should indicate the upload file size limit.

I've added it to the TODO for the website (don't have access to the website itsself currently, at least not the international one).

By the way, is this file something you downloaded somewhere ? Maybe you can add the link here, so people can download and check for themselves.

budtse

Thanks for addressing the file upload size issue.

Additional info: I unpacked the file, which was compressed with UPX, and it no longer scanned positive, FWIW.

Its an installer for the open-source ffmpeg package, posted at doom9 forums I believe. At least in principle, one could do a search there and find it. I'm sure its a false positive, although I haven't actually installed it yet.