guitarpat
Joined: 23 Apr 2012 |
Posts: 0 |
|
|
 |
Posted: Mon Apr 23, 2012 11:40 am |
|
 |
 |
 |
 |
clamwin identifies microsoft works file wksdb.exe as TROJAN.ZBOT - 19898 FOUND
I have run AVG and malwarebytes and no virus is found . I have also submitted to jotti where only clamAV finds it whereas virusscan.org has 2 more AV finding it . Do I have a virus and what to do about it or is it a false positive and can I ignore it ?
New to this so any help appreciated
Thanks
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Mon Apr 23, 2012 10:29 pm |
|
 |
 |
 |
 |
Jotti and Virus Total have some of the same AVs, but Virus Total has about twice as many AVs as Jotti. I prefer to scan with Virus Total. It looks to me like you do not have enough AV detection on your file to make a good decision as to whether it is a virus or false positive.
Here's what I recommend. I have 5 "trigger" AVs that I use to help me make a decision: Avira AntiVir, Bitdefender, Nod32, Kaspersky, and Sophos. I need to see at least 2 of these AVs verify an infection before I believe it. You have to be careful, however, because when a virus is new, not many AVs will see it for a few days. Virus Total has an advanced configuration tab that you can use to get more detailed information about a file. After uploading a file, choose that tab and go down the page to find out when Virus Total first saw the file. If it is more than three days old, my "trigger" AVs should detect it by then if it is a virus. If it is less than three days old, and at least 2 triggers do not yet detect it, you can not make a good decision until day three.
If a file turns out to be a false positive detection, upload it to Clam AV so they can correct the signature, starting at https://www.clamav.net/lang/en/sendvirus/ on the web. Clam AV furnishes the detection engine and virus signatures for ClamWin.
Regards,
|
|