You are here

clamav reports ClamWinPortable.exe as Trojan.Agent-65355

6 posts / 0 new
Last post
harish
Offline
Last seen: 15 years 3 months ago
Joined: 2008-12-23 00:16
clamav reports ClamWinPortable.exe as Trojan.Agent-65355

Today when I was scanning my USB drive using clamscan command on Ubuntu machine, it reported following

/media/TRAVELDRIVE/ClamWinPortable/ClamWinPortable.exe: Trojan.Agent-65355 FOUND

----------- SCAN SUMMARY -----------
Known viruses: 478662
Engine version: 0.94.1rc1
Scanned directories: 18
Scanned files: 91
Infected files: 1
Data scanned: 51.69 MB
Time: 10.702 sec (0 m 10 s)

Is this false positive?

Harish

p4trick
Offline
Last seen: 15 years 3 months ago
Joined: 2008-12-23 04:20
RE: clamav reports ClamWinPortable.exe as Trojan.Agent-65355

ClaimWin also labeled a Portable Apps installer as a virus for me. It is an original file that couldn't possibly be infected.

***

C:\Documents and Settings\*USER*\My Documents\Downloads\PortableApps.com_Suite_Light_Setup_1.1.exe: Trojan.Agent-65355 FOUND

***

After it alerted me that the installer was a virus, I extracted the contents into a folder on my desktop and did a scan on that just to see what happened and here is what I got:

***

Scan Started Tue Dec 23 03:23:52 2008
-------------------------------------------------------------------------------

C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\AbiWordPortable\AbiWordPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\AbiWordPortable\App\AbiSuite2\AbiWord\plugins\UninstallAbiWordIEPlugins.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\ClamWinPortable\ClamWinPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\CoolPlayer+Portable\CoolPlayer+Portable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\FirefoxPortable\FirefoxPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\KeePassPortable\KeePassPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\Mines-PerfectPortable\Mines-PerfectPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\PidginPortable\PidginPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\SudokuPortable\SudokuPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\SunbirdPortable\SunbirdPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\PortableApps\ThunderbirdPortable\ThunderbirdPortable.exe: Trojan.Agent-65355 FOUND
C:\Documents and Settings\*USER*\Desktop\TEST\StartPortableApps.exe: Trojan.Agent-65355 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 478292
Engine version: 0.94.1
Scanned directories: 328
Scanned files: 1967
Infected files: 12

Data scanned: 159.84 MB
Time: 88.657 sec (1 m 28 s)
--------------------------------------
Completed
--------------------------------------

***

Quite strange, but somebody may want to get in touch with the ClamWin guys, if I were just an end user that didn't know any better that might scare me away from Portable Apps for good.

*EDIT*
I used the full installable version of ClamWin not the portable one to do this scan, although I do not think it would make a difference.

Andy Allen
Offline
Last seen: 15 years 3 months ago
Joined: 2008-12-23 09:15
Clamwinportable reported as trojan

It seems to be a false positive. I uploaded clamwinportable.exe to virustotal.com and only clamav reports it as being infected.
See the permalink http://www.virustotal.com/analisis/f2bbe0a077ae14543a6e9947d15edf03 for details...

Andy

vickersdave
Offline
Last seen: 15 years 3 months ago
Joined: 2008-12-23 14:14
same with me - clamav disinfected portable apps exe files

just redownloaded clamav with latest update - both the portable and the main version find all the portable apps exe files as TROJAN.Agent.65355 , but no other antivirus does.
most annoying since it disinfected all my portable apps!!!!

John T. Haller
John T. Haller's picture
Online
Last seen: 21 min 35 sec ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
False Positive Fixed

I submitted this to the ClamAV team and it has been fixed in the daily definitions update.

Sometimes, the impossible can become possible, if you're awesome!

zeekat
Offline
Last seen: 15 years 2 months ago
Joined: 2008-12-27 07:20
Bitdefender Total Security 2009 finds ClamWin Clean.

I just installed ClamWin on a USB and scanned its folder with Bitdefender.

No viruses found. Will retry after ClamWin updates.

Log in or register to post comments