Hi
I have some files that ClamAV suddenly started reporting as a Trojan. The files
are unchanged since about a year ago, but i scan the files weekly regardless.
There was nothing in 1. week of january, but in 2. week of january ClamAV
suddenly reports this trojan:
Trojan.Agent-136369 FOUND
I have rescanned the files using virustotal.com, and i get other "positive
hits" from
Antiy-AVL 2.0.3.7 2010.01.20
Trojan/Win32.Shutdowner.gen
for all the files that ClamAV says are the trojan above. For some files i also
get "hits" from
McAfee-GW-Edition 6.8.5 2010.01.20
Heuristic.BehavesLike.Win32.Trojan.C
1) How do i KNOW FOR SURE, if it is a real positive or just a false
positive?
2) how do i get ClamAV to stop reporting it? And not just my own
installation, but your installation as well.
(naturally 2. only applies if it is a false positive).
I have tried but i can not include a debug scan of one of the files because of
mailing list size limits. I hope you can still help.
JonB
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
