If I empty my browser cache, and scan my cache folder with Clamwin, I find no "hits".

I then go to the clamwin main page (www.clamwin.com). I don't do anything, just load the page in firefox.

I then re-scan the cache folder and get a "hit" for html.phishing.auction-272.

Is this a false positive?

The file itself is 1.2mb.

(using current definitions and engine, on XP Home with Firefox 2.x)

It's hard to say if it is a false positive without looking at the file to see where the signature resides and what the rest of the url looks like. Here is a URL that defines what the actual phishing attempt for that signature: https://phishery.internetdefence.net/data/18561

If you send the file to me, I can verify if it is an FP or not. Send me a private message on the forum if you want to contact me.

You may be able to wipe the file off your computer if you run the free Ad-Aware program from Lavasoft or the free Windows Defender program from Microsoft. You could also upload the file to Virustotal for a free scan. If it's malware, at least one of the ten or so scanners they use should spot it.

Regards,

It's fairly easy to delete the file from the browser cache, although I am grateful for your suggestions.

I was more perplexed as to: is this a "real" harmful entity, and why am I getting it from the Clamwin web site?