leatha52
Joined: 07 May 2009 |
Posts: 0 |
|
|
 |
Posted: Thu May 07, 2009 5:40 am |
|
 |
 |
 |
 |
Clamwin quarantined adware infected files. These files were system files such as web search rundll et. What do I do these files are needed? Thank you
|
|
Antonio S.
Joined: 20 Apr 2008 |
Posts: 0 |
Location: Italy |
|
 |
Posted: Thu May 07, 2009 8:30 am |
|
 |
 |
 |
 |
Hello,
If you are sure the files are safe (if not, submit them to www.virustotal,.com and check what comes out; maybe it's a false positive case) you can navigate to Clamwin's quarantine folder and copy back the file to their original position. You will have to remove the infected. prefix from filename to make them work as usual.
If files are safe notify Clam about false positive using the form @ cgi.clamav.net/sendvirus.cgi. so they can fix the issue in a few days.
In the meantime you can set Clamwin Preferences to report only option so files won't be moved to Quarantine once scan is relaunched (I guess this is the best option to avoid problems; more or less all av's catch false positives and I personally prefer just to be notified when a scan is finding something than letting it just move the file automatically).
Regards,
Antonio
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Mon Aug 31, 2009 5:17 pm |
|
 |
 |
 |
 |
You can temporarily exclude a file from ClamWin scans via Configuration, Filters--IF you are sure it is a false positive. Configure it like C:\directoryname\subdirectoryname\filename.extension. Be sure to upload the file to Clam, however, so the false positive will be corrected. Give it 4/5 days and delete it and then scan it with ClamWin to see if the correction has been made--restore it if not. False positive corrections are usually made within a couple of days.
Regards,
|
|