[clamav-users] FP: Win.Trojan.Agent-1696554 is md5sum of 2240 null bytes

David Shrimpton d.shrimpton at its.uq.edu.au
Tue Sep 27 03:39:27 EDT 2016


Hi, 

Win.Trojan.Agent-1696554 added to daily.hdb on 21/9/16 is an
md5sum of a file containing 2240 null bytes only, so appears
to be a broken signature. 

It is causing false positives.

The example I have was a FP on a 944010 byte pdf which comes up
negative on virustotal except for clamav.


-- 
David Shrimpton 



More information about the clamav-users mailing list