ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
False positive???
jb


Joined: 16 Jan 2010
Posts: 0
Reply with quote
I believe the following is not correct...

Scanning aborted...

C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.XobniRdo\8078d92cd70d5ed0fdd9a6e1eb397660\Interop.XobniRdo.ni.dll: W32.Virut.Gen.D-150 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 698595
Engine version: 0.95.3
Scanned directories: 29682
Scanned files: 228990
Infected files: 1

Not moved: 1
Data scanned: 60836.69 MB
--------------------------------------
Cancelled
--------------------------------------
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 9
Location: USA
Reply with quote
The Virut Generic signatures sometimes give a false positive on some Microsoft files, so this could well be a false positive. To verify it, you can upload a copy of the file to Jotti at https://virusscan.jotti.org/en or to VirusTotal at https://www.virustotal.com/ on the web. Either service will scan the file for you with multiple AV programs (including Clam AV, which furnishes the scan engine/database for ClamWin). If more than two or three AVs find an infection, it is probably a real infection and not a false positive. I would believe an infection if the detecting AVs include a couple of these: Kaspersky, McAfee, Microsoft, Nod32, Symantec, or Trend Micro. You should upload false positive files to Clam AV at https://www.clamav.net/sendvirus/ on the web. When you get to the upload page, be sure to tell them the name of the virus that is falsely identified and the results of your Jotti/VirusTotal scan.

An alternative to verifying a false positive is to upload the file to Threat Expert at https://www.threatexpert.com/submit.aspx on the web. They will "run" the file and give you an email report, which includes a threat estimate.

If you look at the date of your file in Windows Explorer, you can see when the file is dated. If the date is not recent, it is probably a false positive detection.

Regards,
View user's profileSend private message
False positive???
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic