This is a new signature that was added today. It's rather complicated and, with the "Test" in the name, I'm not sure it's meant to be published. We'll have to wait to hear from the ClamAV folks on that matter, but you can submit it as a false positive (for those Wordpress zips) using the False positive report page: https://www.clamav.net/reports/fp


On Fri, Jun 24, 2022 at 8:49 AM Cyrille37 <cyrille.clamav-users@giquello.fr> wrote:

Hello

I don't understand why, but it appends this morning on already existed files (in the wp-cli cache folder) :

Start Date: 2022:06:24 12:15:01
End Date:   2022:06:24 12:15:17
/home/caf37-pt/.wp-cli/cache/core/wordpress-5.8.3-fr_FR.zip: Archive.Test.Agent2-9953724-0 FOUND
/home/caf37-pt/.wp-cli/cache/core/wordpress-5.8.2-fr_FR.zip: Archive.Test.Agent2-9953724-0 FOUND
/home/caf37-pt/.wp-cli/cache/core/wordpress-5.9-fr_FR.zip: Archive.Test.Agent2-9953724-0 FOUND
/home/caf37-pt/.wp-cli/cache/core/wordpress-5.8.1-fr_FR.zip: Archive.Test.Agent2-9953724-0 FOUND
/home/caf37-pt/.wp-cli/cache/core/wordpress-5.9.3-fr_FR.zip: Archive.Test.Agent2-9953724-0 FOUND
/home/caf37-pt/.wp-cli/cache/core/wordpress-5.9.1-fr_FR.zip: Archive.Test.Agent2-9953724-0 FOUND
/home/caf37-pt/.wp-cli/cache/core/wordpress-5.9.2-fr_FR.zip: Archive.Test.Agent2-9953724-0 FOUND

I could not find on the web some discussions about "Archive.Test.Agent2-9953724-0" except this one
https://answers.sap.com/questions/13665326/upload-application-content-failed-malware-detected.html

Thanks for help :-)

Cyrille37.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat