GuitarBob wrote: |
Those generic signatures are tough to do because they have to cover a wide range of related malware, and sometimes a "good" file can also be tagged as bad. Since you have verified that it is more than likely a false positive, go to the Clam AV (Clam furnishes the scanning engine/signature database for ClamWin) submission site and report it, starting at https://www.clamav.net/sendvirus/ on the web. When you get to the upload page, before you upload it, be sure to tell them it is a false positive, give the name of the virus that is falsely detected, and tell why you think it is a false positive. They will adjust the signature within a day or two. I believe they can take care of uploads up to about 25 MB or so in size now.
Regards, |
What I got back from them was:
ClamAV Virus Database
Result:
This virus is already recognized by ClamAV 0.95.2/9645/Mon Aug 3 00:11:36 2009 (timezone: ) as Trojan.Swizzor.Gen . Be careful when submitting samples and remember to run freshclam!
Check the FAQ now
Please correct the above errors and retry. Thank you for helping the ClamAV project.
I did identify it as a false positive, but perhaps not in the way they recognize. Clues?
Thanks,
Allen