I wanted to report a false positive. This is from a computer with nothing but Windows and HP OEM software installed, so the chances of a virus is pretty low.

It tags " C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe " as a worm (Chir 1335.) I ran the file passed virustotal, clamwin is the ONLY scanner to deem the file a positive match for a worm out of 50+ other scanners.

Results are here: https://www.virustotal.com/en/file/1f6082c0e3a8593e1bb60d4b8c30d48e41d433a6cf67146a5ced13467a890892/analysis/1421081530/

HP OEM bloatware can be pretty invasive, so it's not a huge surprise to me that perhaps heuristics picked it up as malware. I don't know much about ClamWin or it's capabilities so that's just a guess as to why the false positive exists.

Just wanted to inform the community to improve the ClamWin software.

Thanks for the heads up. Make sure you submit both the virustotal report and the false positive file to ClamAV false positive submissions here: https://www.clamav.net/report/report-fp.html It may take sometime for them to release a patch for it, however.

ClamWin uses the scanning engine and virus signatures provided by the Clam AV Project. All signature corrections for false detections and undetected viruses should be reported to Clam AV. Clam AV gives a lot of attention to Virus Total, so it's always a good idea to scan false positive (and undetected virus) files with Virus Total in addition to reporting them to Clam AV.

Regards,