ROCKNROLLKID
Joined: 23 Sep 2013 |
Posts: 0 |
Location: **UNKNOWN** |
|
 |
Posted: Mon Jan 27, 2014 10:02 pm |
|
 |
 |
 |
 |
Clam Sentinel is detecting a badsignature in my Left 4 Dead 2 game and when it quarantines it, my mic will not work at all. It is a tmp file located in AppData/Local/Temp. It is not the same file everytime it gets quarantine so I don't know what good sending the file to ClamAV would do. The quarantine file currently being blocked is ~114F.tmp.badsignature. I assume since it says badsignature that it is coming from ClamAV database.
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Tue Jan 28, 2014 1:36 am |
|
 |
 |
 |
 |
Clam AV can not do anything about a Clam Sentinel false positive. To fix it, you will have to whitelist the file in Clam Sentinel's Advanced Settings as a Path or File Not Scanned. Stop Clam Sentinel, get the exact original location of the quarantined file with filename and extension from the Sentinel quarantine log and paste it as a Path or File Not Scanned. Then Start Clam Sentinel, and restore the file from quarantine via the Sentinel Recover option under the Quarantine menu. You could whitelist just the filename and extension, but if you ever have a malware file with that same name, it will be ignored--that's why I use the entire location with the filename and extension. You can use wildcards (* or ????) in whitelisting so you can whitelist all versions of an executable file, but try to get a unique whitelisted entry if possible (like C:\folder\*114F.tmp)--I think that will work.
When scanning a file, Clam Sentinel first uses its own real-time heuristic scanner, and then it scans with ClamWin if the real-time scanner does not detect anything. The Clam Sentinel real-time detections have very generic names, of course, and detection is not dependent upon either Clam AV or ClamWin.
Regards,
|
|