[clamav-users] Potentially False Positive, but I lost the file!

[Groach]

I would put my house on that it was a false positive 100%.  Reasons for 
saying so:

1,  It was a windows installation CD
2,  Its a file nearly 20 years old
3,  Clam signatures couldnt detect water in an ocean.  (I would be very 
surprised if it ever detects a real threat for you).

And anyway, even if it was genuine, what are the chances of you ACTUALLY 
ever running an install from a Windows 95 CD?!

Dont worry.



On 21/01/2017 14:07, Antonio Piccolomini d'Aragona wrote:
> Hi,
> I'm writing for the following problem.
>
> After sudo freshclam, I had a scan of my system (UBUNTU 12.04 LTS) by sudo
> freshclam -r. ClamAv detected an infection relative to an ISO built from a
> Windows 95 installation CD. The signaled virus was said to be a
> Win.Trojan.Agent-18112140. Previous scans never reported infected files
> (although the ISO has always been there). I submitted the file to the
> VirusTotal online scan; there too, ClamAv reported the
> Win.Trojan.Agent-18112140, being anyway the only in doing so (for all the
> other checks the file was ok). Unfortunately, as I am moving and needed
> have the computer with UBUNTU 12.04 turned into Windows, I formatted and
> lost the incriminated file. So, I could not report the (potentially) false
> positive to the ClamAv site. I just wanted to ask you whether I can be
> sure, or should worry; I use computer for work, and handle important datas,
> so I would like to be sure that that was actually a false positive (or in
> which percentage it might be).
>
> Thank you!
>
> Antonio
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml