ClamWin Developers:

Why not suppress warnings about detections on Microsoft files with valid digiatal signatures? It has been almost a month now since I sent several Nimbda false positive detections on Win system32 files with no corrections yet by Clam AV. I have sent the files about 3 different times, and I have scanned them on Virus Total hoping Clam would get the false positive report that way. No results!

Therefore, I suggest that you eith suppress these ClamWin scan warnings or remove the admonition to report them to Clam AV--it is enough that Clam Win users are protected from these false positives. It will not do much good to report them to Clam AV.

Additionally, why not extent this detection to all files with valid digital signatures? Nearly all such files will be clean.

Regards,

+1, although, I thought ClamWin was designed to have immunity against false positives on valid digital signatures files?

ClamWin has immunity from quarantining files with valid Microsoft digital sigs but ClamWin users still get a scan message telling you the file was falsely detected (that is okay), along with a request to send the file to Clam AV so they can correct their signature. Sending the file to Clam AV is not okay because Clam Av either fails to act to correct their signature or takes too long to do so. Because of this reality, ClamWin needs to either suppress these scan notices or eliminate the request to submit the file to Clam AV.

I do not think there is any protection for any falsely-detected files except those of Microsoft. The existing FP Microsoft detection code can/should be expanded to include false positive detection on any valid digital signature. Additionally, for a ClamWin malware heuristic, any file that has an invalid digital sig is suspect; however, some developers do not bother to get a new digital sig for old program files when the digital sig expires, so this would have to be considered. You could look at the date or some other file characteristics, but that would require some new ClamWin code that doesn't come from Clam AV...

Regards,