[clamav-users] Win.Worm.Chir-553 False Positive

Al Varnell alvarnell at mac.com
Tue Jul 15 20:27:20 EDT 2014

I’ve now discovered another FP, this time for Win.Worm.Chir-551 and I’ve uploaded it to you.  Again, it’s from the same OS X provided Python framework. I get similar results in checking Python 2.7.

File Name: wininst-9.0.exe
MD5: 8aa98031128ef0c81d34207e3c60d003

VirusTotal comment:

Signature: 425c19aef183b3d3db4a00e05cf46e73


-Original Message-

I’ve just uploaded a component of every version OS X since at least 2010 that is included with Python and will undoubtedly be found by a lot of folks very soon.

File Name: wininst-8.0.exe
MD5: ed0fde686788caec4f2cb1ec9c31680c

VirusTotal comments would also indicate an FP

Since the signature for this file is ee35353fd80f8e2447095b753732dbca, I guess I’m a bit confused as to why id doesn’t match the file MD5.

Al Varnell
Mountain View, CA

Help us build a comprehensive ClamAV guide:

More information about the clamav-users mailing list