[clamav-users] Fwd: Re: Fwd: Win.Trojan.Virut-375 FOUND in libcef.dll

[Alejandro Hernández]

Here i 've just uploaded the file again to virustotal: https://www.virustotal.com/gui/file/f2ed1af539f3c783ffe0661d773a8e307ca1601536459b9db24469ebd60a80fe/detection (https://www.virustotal.com/gui/file/f2ed1af539f3c783ffe0661d773a8e307ca1601536459b9db24469ebd60a80fe/detection)

And uploaded to clamav false positive url again too: https://www.clamav.net/reports/fp (https://www.clamav.net/reports/fp)

The file belongs to 'Epic Store Games' installation, on Windows 10.
This is the directory: C:Program Files (x86)Epic GamesLauncherPortalExtrasOverlayWin32libcef.dll
I notified to Epic devs but everybody say is a false positive..... is it?

By the way, VirusTotal dont recognize the file as a virus.
But using 'ClamWin', the virus is found.

ClamWin: 0.99.4
ClamAV: 0.99.4
VirusDBversion: main:59, daily: 25991
https://mastodont.cat/@alejandroindependiente (https://mastodont.cat/@alejandroindependiente)

-------- Mensaje reenviado -------
De: "G.W. Haywood via clamav-users" <clamav-users at lists.clamav.net (mailto:clamav-users at lists.clamav.net?to=%22G.W.%20Haywood%20via%20clamav-users%22%20<clamav-users at lists.clamav.net>)>
Para: "Alejandro Hernández via clamav-users" <clamav-users at lists.clamav.net (mailto:clamav-users at lists.clamav.net?to=%22Alejandro%20Hern%C3%A1ndez%20via%20clamav-users%22%20<clamav-users at lists.clamav.net>)>
CC: "G.W. Haywood" <clamav at jubileegroup.co.uk (mailto:clamav at jubileegroup.co.uk?to=%22G.W.%20Haywood%22%20<clamav at jubileegroup.co.uk>)>
Enviado: 17 de noviembre de 2020 11:29
Asunto: Re: [clamav-users] Fwd: Win.Trojan.Virut-375 FOUND in libcef.dll
	Hi there, On Mon, Nov 16, 2020 at 1:16 PM Alejandro Hernández via clamav-users wrote: everybody says it is a false positive. Could you check it and tell
me? (I've send it you before but no feedback)
I've seen nothing from you on the ClamAV Users' mailing list. Exactly
when did you first send it, and to exactly what address? Perhaps you
can send a short test reply to this message with no attachments to see
if it gets through.

The file name which you mention does seem to have been associated with
a few false positive reports in the past but Mr. Graham has given good
advice that you should check it on one of the public sites which allow
you to scan a file using many different scanners, such as VirusTotal.

Be aware that even if you scan a file with thirty different scanners
it may still not be safe, because some threats will be so new that the
people who maintain the scanners will not yet have had time to update
them to recognize the threats. If you think there's a risk that this
might be the case then it might be worth waiting a week or two, then
submitting the file to the scanning service again. However most of
the files which cause false positives will be at least weeks or months
old, and often they will be several years old. If you can _reliably_
verify the age of the file, that will help you decide whether you need
to wait some time and then do another scan. You cannot necessarily
rely on the file's timestamp in the directory which contains it, any
half-way competent malware author is capable of forging that, but if
you have the file e.g. on a CD somewhere and you can check that it's a
bit-for-bit copy of the one you're using on disc, that's a fair bet.

If you do send a test reply please send it to the list, not directly
to my clamav list address, as all mail sent directly to this address
will be rejected.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users at lists.clamav.net (mailto:clamav-users at lists.clamav.net)
https://lists.clamav.net/mailman/listinfo/clamav-users (https://lists.clamav.net/mailman/listinfo/clamav-users)
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq (https://github.com/vrtadmin/clamav-faq)

http://www.clamav.net/contact.html#ml (http://www.clamav.net/contact.html#ml)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20201117/480b2dfb/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.jpeg
Type: image/jpeg
Size: 13089 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20201117/480b2dfb/attachment.jpeg>