[clamav-users] Many reports / false positives since a couple of days

[Joel Esler (jesler)]

I am dropping these signatures now.

> On Aug 1, 2018, at 9:57 AM, David Rosenstrauch <darose at darose.net> wrote:
> 
> 
> 
> On 07/31/2018 04:53 AM, Albrecht, Peter wrote:
>> Hello,
>> Since Saturday (2018-07-28) we are seeing many reports from clamscan having
>> found (possibly) infected files. I suspect these are false positives because checking
>> the files on virustotal.com returns only clamav reporting them as infected.
>> The reported files are mostly jar files used by our applications (e.g. httpclient-*.jar,
>> httpcore-*.jar in different versions). These are the signatures which produce most
>> of the reports:
>> Html.Malware.Agent-6625161-0
>> Html.Malware.Agent-6625163-0
>> Html.Malware.Agent-6625207-0
>> Html.Malware.Agent-6625208-0
>> Html.Malware.Agent-6625209-0
>> Html.Malware.Agent-6625345-0
> 
> I've been seeing these as well.  It's curious, as VT shows ClamScan as the only detection system that's flagging these.
> 
> https://www.virustotal.com/#/file/ca6cce94277cca95ce5812e72a5ed24dd95a995788541be2c225a4a2e2bc5089/detection
> 
> DR
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml