After my scan this morning ClamWin quarantined your own update files????????

This app has been my favorite for a long time for it's stability, what happened?

ClamWin's signatures come from the Clam AV people. You should report all false positives (and undetected viruses) to Clam AV, starting at https://www.clamav.net/lang/en/sendvirus/ on the web. In the case of a false positive, on the upload form change the description from "virus" to "false positive." It also helps to tell the exact name of the falsely-detected virus in the Comments section of the form.

This particular signature has probably been dropped by now. If it is still a false detection, please submit it.

Regards,

@ mxracer

Most ClamWin users should have the scanner set to Report Only, not Quarantine.

When ClamWin identifies a virus, I always upload it to jotti.org to see what other scanners do. One of those scanners is a ClamAV scanner which in many cases does not flag the file as a virus. This used to be much more common, but it happened again today with MAPI from an XP install CD backup.

Is there some reason that ClamAV on jotti should not detect a virus when ClamWin does?

The detection should be the same since ClamWin uses the Clam AV signature database. One difference, could be if one of the scanners (either your local scanner or the online service) has a more recently-updated signature database. You may (like me) update your local ClamWin scanner hourly. I do not know how often Jotti updates, but I do not think it is hourly. So that could explain a difference on occasion.

Another difference (very infrequent) is because ClamWin is a Windows port of the Clam AV code, and there could be a slight difference in the ported code that could change the detection. This happened late last year when ClamWin code was not updated to take advantage of some new Clam AV detection capability and registered lots of false positives that knocked out network users.

Regards,