EDIT: The ClamWin people have fixed it, so you can disregard this topic now
This app looked like a good idea, however I receive many false positives while scanning.
For example:
F:/PortableClamWin/PortableClamWin.exe: Trojan.Clicker.VB-20 FOUND
F:/PortableFileZilla/PortableFileZilla.exe: Trojan.Clicker.VB-20 FOUND
F:/PortableThunderbird/PortableThunderbird.exe: Trojan.Clicker.VB-20 FOUND
I saw on the PCW page that there is a known issue for a false positive, but if this is a regular thing I'm not sure I can trust it. Still going to keep it around though.
John - I know there's nothing you can necessarily do about this, just wanted to bring it to someone's attention
Thanks for the great work!
And no, I dont think you can fix it.
----
R McCue
"If you're not part of the solution, you're part of the precipitate."
What is it about UPX-compressed executables that makes virus scanners think they're malicious?
It's just NSIS. It detected ALL of the launchers as trojans. See ClamWin Known Issues.
Sometimes, the impossible can become possible, if you're awesome!
What compression method do you use?
----
R McCue
"If you're not part of the solution, you're part of the precipitate."
They are uncompressed.
Sometimes, the impossible can become possible, if you're awesome!
I use LZMA and use !packhdr with UPX.
----
R McCue
"If you're not part of the solution, you're part of the precipitate."
Compression on a 50k EXE doesn't really buy you anything.
Sometimes, the impossible can become possible, if you're awesome!
I know, but it doesn't seem to like UPX-compressed things either. Getting false positives with UPXed EXEs is also a known issue, after all.
Those would be brand new false positives as of today. Please be sure to report them as false to the ClamAV folks.
http://clamav.catt.com/cgi-bin/sendvirus.cgi
Sometimes, the impossible can become possible, if you're awesome!
Will do. Thanks.