[clamav-users] Elmedia Player.app detection

[Douglas Stinnette]

Nice responses, here is the hash
f9933dfc18107383b4093206daba283d106f86acb6284c92632f5a43143040c6
I provided the file in question to F-Secure, Microsoft and Sophos labs for
manual review and they returned no threat.

Odd that Microsoft still reports threat on Virustotal, my guess is that is
due to autodetection.
https://www.virustotal.com/gui/file/f9933dfc18107383b4093206daba283d106f86acb6284c92632f5a43143040c6/detection


Look forward to your thoughts.
Thanks,
Doug

On Tue, Dec 10, 2019 at 11:33 AM Eric Tykwinski <eric-list at truenet.com>
wrote:

> Found an article on it:
>
>
> https://www.intego.com/mac-security-blog/osxproton-malware-is-back-heres-what-mac-users-need-to-know/
>
>
>
>
>
>
>
> *From:* clamav-users [mailto:clamav-users-bounces at lists.clamav.net] *On
> Behalf Of *Al Varnell via clamav-users
> *Sent:* Tuesday, December 10, 2019 11:25 AM
> *To:* ClamAV users ML
> *Cc:* Al Varnell
> *Subject:* Re: [clamav-users] Elmedia Player.app detection
>
>
>
> That signature has been in the database since Oct 20, 2017 and is a hash
> signature, so there's little chance of it being an FP.
>
> [daily.hsb]
> 17fe5ebacff74bfb6028eb371ceeaf2b:2484384:Osx.Trojan.Proton-6352635-0:73
>
>
>
> -Al-
>
> ClamXAV User
>
>
>
> On Tue, Dec 10, 2019 at 06:02 AM, Douglas Stinnette wrote:
>
> Seems to me that this is a false positive.
> /Applications/Elmedia Player.app/Contents/MacOS/Elmedia Player
>  Osx.Trojan.Proton-6352635-0 FOUND
>
>
>
> I sent a copy of the file to other vendors to double check it and they
> reported it was not malware.
>
> I have submitted false positives to ClamAV before and never received an
> update on them:
> https://www.clamav.net/reports/fp
>
> What do others do when they get ClamAV false positives?
> Thanks,
> Doug
>
>
>
>
>
>
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>


-- 


Doug Stinnette

VCU Technology Services

Endpoint Security Specialist

Virginia Commonwealth University

827-0933



Don't be a phishing victim - VCU and other reputable organizations will
never use email to request that you reply with your password, Social
Security number or confidential personal information. For more details
visit http://go.vcu.edu/phishing or http://phishing.vcu.edu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20191210/501303b1/attachment.htm>