Hi,

i hope this is the right place for feedback and problem-reports with ClamWin.
Could it be that Clamwin tends to throw false positives if it scans a folder of windows-updates etc?

I had that report while my last test-scan
>> C:\foo\bar\6A\0AFBC6E0997236EF00CFDEDE5FFCBBAFD8BAD86A.cab: W32.Virut.Gen.D-163 FOUND
using latest Clamwin-version.

If i un-archiv this .cab and scan it again with ClamWin there is no hit - so Clamwin seems to have problems with the .cab itself ...

While at least 2 other virus-scanners analyze that .cab-file as clean & ok.

Is there a known procedure if someone is realizing false-positives?
Anything i should add informations-wise?

I am not able to check the .cab file via https://virusscan.jotti.org/en - as it is way to big (15 MB limit vs 38 MB .cab file)


Best regards
fidel

Clam AV provides the scanning engine/signatures used by ClamWin. I think you can submit a false positive of that size to Clam AV, starting at https://www.clamav.net/sendvirus/ on the web. Seems like they told me they could handle files up to around 20 megabytes, although I always seem to have trouble uploading large files. Please contact Alch via private message here if it doesn't work.

Regards,

Hi,

thanks for the reply.
Could it be that this form does not give a response at all after processing the informations?

There was no "Thanks/Done" or similar dialog.


Best Regards
fidel

The Clam AV submit form does give an acknowledgement after a successful upload of a false positive/real virus file. If you didn't get on, I suggest you resubmitt--it will not hurt. If you don't get the acknowledgement again, please send a Alch a Private Message here on the ClamWin forum. I have had trouble uploading large files to Clam--no matter what they say.

Regards,