[clamav-users] Many reports / false positives since a couple of days

[David Rosenstrauch]

On 07/31/2018 04:53 AM, Albrecht, Peter wrote:
> Hello,
> 
> Since Saturday (2018-07-28) we are seeing many reports from clamscan having
> found (possibly) infected files. I suspect these are false positives because checking
> the files on virustotal.com returns only clamav reporting them as infected.
> 
> The reported files are mostly jar files used by our applications (e.g. httpclient-*.jar,
> httpcore-*.jar in different versions). These are the signatures which produce most
> of the reports:
> 
> Html.Malware.Agent-6625161-0
> Html.Malware.Agent-6625163-0
> Html.Malware.Agent-6625207-0
> Html.Malware.Agent-6625208-0
> Html.Malware.Agent-6625209-0
> Html.Malware.Agent-6625345-0

I've been seeing these as well.  It's curious, as VT shows ClamScan as 
the only detection system that's flagging these.

https://www.virustotal.com/#/file/ca6cce94277cca95ce5812e72a5ed24dd95a995788541be2c225a4a2e2bc5089/detection

DR