[clamav-users] Many reports / false positives since a couple of days

[Albrecht, Peter]

Hello,

Since Saturday (2018-07-28) we are seeing many reports from clamscan having
found (possibly) infected files. I suspect these are false positives because checking
the files on virustotal.com returns only clamav reporting them as infected.

The reported files are mostly jar files used by our applications (e.g. httpclient-*.jar,
httpcore-*.jar in different versions). These are the signatures which produce most
of the reports:

Html.Malware.Agent-6625161-0
Html.Malware.Agent-6625163-0
Html.Malware.Agent-6625207-0
Html.Malware.Agent-6625208-0
Html.Malware.Agent-6625209-0
Html.Malware.Agent-6625345-0

Currently, we have whitelisted the above signatures. I suspect that it is an error
in the database because that's the only thing that has changed since Friday. We
are using clamav 0.99.4 and 0.100.0 on Linux with a daily update of the virus
signatures.

I have uploaded the file which generated the most reports yesterday to clamav.net
and requested doublechecking if that would be a false positive.

Does anybody else see such a behaviour? Any ideas of what might be the reason?
Any suggestions what to do? Whitelisting all reported signatures would not be our
preferred solution ...

Thanks a lot,

Peter Albrecht
Senior Linux Administrator 

Wirecard Service Technologies GmbH
Einsteinring 35 | 85609 Aschheim | Germany
Tel: [phone]
https://www.wirecard.com
________________________________________________________________________________________________________

Amtsgericht München HRB Nummer 238 150

Geschäftsführer: Thomas Neef, Susanne Steidl, Yiannakis Ioannou

VERTRAULICHE INFORMATIONEN! Diese E-Mail enthält vertrauliche Informationen und ist nur für den berechtigten Empfänger
bestimmt. Wenn diese E-Mail nicht für Sie bestimmt ist, bitten wir Sie, diese E-Mail an uns zurückzusenden und anschließend
auf Ihrem Computer und Mail-Server zu löschen. Solche E-Mails und Anlagen dürfen Sie weder nutzen, noch verarbeiten oder
Dritten zugänglich machen, gleich in welcher Form. Wir danken für Ihre Kooperation!

CONFIDENTIAL! This email contains confidential information and is intended for the authorized recipient only. If you are
not an authorised recipient please return the email to us and then delete it from your computer and mail-server. You may neither
use nor edit any such emails including attachments, nor make them accessible to third parties in any manner whatsoever. 
Thank you for your cooperation.

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Al Varnell]

It helps the signature team locate those submitted files faster if you post their hash values here.

-Al-

Post by Albrecht, Peter
Hello,
Since Saturday (2018-07-28) we are seeing many reports from clamscan having
found (possibly) infected files. I suspect these are false positives because checking
the files on virustotal.com <http://virustotal.com/> returns only clamav reporting them as infected.
The reported files are mostly jar files used by our applications (e.g. httpclient-*.jar,
httpcore-*.jar in different versions). These are the signatures which produce most
Html.Malware.Agent-6625161-0
Html.Malware.Agent-6625163-0
Html.Malware.Agent-6625207-0
Html.Malware.Agent-6625208-0
Html.Malware.Agent-6625209-0
Html.Malware.Agent-6625345-0
Currently, we have whitelisted the above signatures. I suspect that it is an error
in the database because that's the only thing that has changed since Friday. We
are using clamav 0.99.4 and 0.100.0 on Linux with a daily update of the virus
signatures.
I have uploaded the file which generated the most reports yesterday to clamav.net <http://clamav.net/>
and requested doublechecking if that would be a false positive.
Does anybody else see such a behaviour? Any ideas of what might be the reason?
Any suggestions what to do? Whitelisting all reported signatures would not be our
preferred solution ...
Thanks a lot,
Peter Albrecht
Senior Linux Administrator
Wirecard Service Technologies GmbH
Einsteinring 35 | 85609 Aschheim | Germany
Tel: [phone]
https://www.wirecard.com <https://www.wirecard.com/>
________________________________________________________________________________________________________
Amtsgericht MÃŒnchen HRB Nummer 238 150
GeschÀftsfÌhrer: Thomas Neef, Susanne Steidl, Yiannakis Ioannou
VERTRAULICHE INFORMATIONEN! Diese E-Mail enthÀlt vertrauliche Informationen und ist nur fÌr den berechtigten EmpfÀnger
bestimmt. Wenn diese E-Mail nicht fÃŒr Sie bestimmt ist, bitten wir Sie, diese E-Mail an uns zurÃŒckzusenden und anschließend
auf Ihrem Computer und Mail-Server zu löschen. Solche E-Mails und Anlagen dÌrfen Sie weder nutzen, noch verarbeiten oder
Dritten zugÀnglich machen, gleich in welcher Form. Wir danken fÌr Ihre Kooperation!
CONFIDENTIAL! This email contains confidential information and is intended for the authorized recipient only. If you are
not an authorised recipient please return the email to us and then delete it from your computer and mail-server. You may neither
use nor edit any such emails including attachments, nor make them accessible to third parties in any manner whatsoever.
Thank you for your cooperation.
_______________________________________________
clamav-users mailing list
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users <http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users>
https://github.com/vrtadmin/clamav-faq <https://github.com/vrtadmin/clamav-faq>
http://www.clamav.net/contact.html#ml <http://www.clamav.net/contact.html#ml>

-Al-

[David Rosenstrauch]

Post by Albrecht, Peter
Hello,
Since Saturday (2018-07-28) we are seeing many reports from clamscan having
found (possibly) infected files. I suspect these are false positives because checking
the files on virustotal.com returns only clamav reporting them as infected.
The reported files are mostly jar files used by our applications (e.g. httpclient-*.jar,
httpcore-*.jar in different versions). These are the signatures which produce most
Html.Malware.Agent-6625161-0
Html.Malware.Agent-6625163-0
Html.Malware.Agent-6625207-0
Html.Malware.Agent-6625208-0
Html.Malware.Agent-6625209-0
Html.Malware.Agent-6625345-0

I've been seeing these as well. It's curious, as VT shows ClamScan as
the only detection system that's flagging these.

https://www.virustotal.com/#/file/ca6cce94277cca95ce5812e72a5ed24dd95a995788541be2c225a4a2e2bc5089/detection

DR
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Joel Esler (jesler)]

I am dropping these signatures now.

Post by Albrecht, Peter
Hello,
Since Saturday (2018-07-28) we are seeing many reports from clamscan having
found (possibly) infected files. I suspect these are false positives because checking
the files on virustotal.com returns only clamav reporting them as infected.
The reported files are mostly jar files used by our applications (e.g. httpclient-*.jar,
httpcore-*.jar in different versions). These are the signatures which produce most
Html.Malware.Agent-6625161-0
Html.Malware.Agent-6625163-0
Html.Malware.Agent-6625207-0
Html.Malware.Agent-6625208-0
Html.Malware.Agent-6625209-0
Html.Malware.Agent-6625345-0

I've been seeing these as well. It's curious, as VT shows ClamScan as the only detection system that's flagging these.
https://www.virustotal.com/#/file/ca6cce94277cca95ce5812e72a5ed24dd95a995788541be2c225a4a2e2bc5089/detection
DR
_______________________________________________
clamav-users mailing list
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Albrecht, Peter]

Hi Joel,

Post by Joel Esler (jesler)

Post by Albrecht, Peter
The reported files are mostly jar files used by our applications
(e.g. httpclient-*.jar, httpcore-*.jar in different versions). These
Html.Malware.Agent-6625161-0
Html.Malware.Agent-6625163-0
Html.Malware.Agent-6625207-0
Html.Malware.Agent-6625208-0
Html.Malware.Agent-6625209-0
Html.Malware.Agent-6625345-0

I am dropping these signatures now.

Here are some other signatures that create many messages:

Html.Malware.Agent-6625159-0
Html.Malware.Agent-6625162-0
Html.Malware.Agent-6625209-0

If more signatures show up, I'll forward them.

Has there anything changed in the database which has caused this?

Regards,

Peter

Peter Albrecht
Senior Linux Administrator 

Wirecard Service Technologies GmbH
Einsteinring 35 | 85609 Aschheim | Germany
Tel: [phone]
https://www.wirecard.com
________________________________________________________________________________________________________

Amtsgericht München HRB Nummer 238 150

Geschäftsführer: Thomas Neef, Susanne Steidl, Yiannakis Ioannou

VERTRAULICHE INFORMATIONEN! Diese E-Mail enthält vertrauliche Informationen und ist nur für den berechtigten Empfänger
bestimmt. Wenn diese E-Mail nicht für Sie bestimmt ist, bitten wir Sie, diese E-Mail an uns zurückzusenden und anschließend
auf Ihrem Computer und Mail-Server zu löschen. Solche E-Mails und Anlagen dürfen Sie weder nutzen, noch verarbeiten oder
Dritten zugänglich machen, gleich in welcher Form. Wir danken für Ihre Kooperation!

CONFIDENTIAL! This email contains confidential information and is intended for the authorized recipient only. If you are
not an authorised recipient please return the email to us and then delete it from your computer and mail-server. You may neither
use nor edit any such emails including attachments, nor make them accessible to third parties in any manner whatsoever. 
Thank you for your cooperation.

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Albrecht, Peter]

Good Morning,

Post by Albrecht, Peter
Html.Malware.Agent-6625159-0
Html.Malware.Agent-6625162-0
Html.Malware.Agent-6625209-0

These stopped being reported this morning at around 04:00 our time (CEST).

Currently, there is one signature left which I believe being a false positive:

Html.Malware.Agent-6625344-0

Thanks a lot,

Peter

Peter Albrecht
Senior Linux Administrator 

Wirecard Service Technologies GmbH
Einsteinring 35 | 85609 Aschheim | Germany
Tel: [phone]
https://www.wirecard.com
________________________________________________________________________________________________________

Amtsgericht München HRB Nummer 238 150

Geschäftsführer: Thomas Neef, Susanne Steidl, Yiannakis Ioannou

VERTRAULICHE INFORMATIONEN! Diese E-Mail enthält vertrauliche Informationen und ist nur für den berechtigten Empfänger
bestimmt. Wenn diese E-Mail nicht für Sie bestimmt ist, bitten wir Sie, diese E-Mail an uns zurückzusenden und anschließend
auf Ihrem Computer und Mail-Server zu löschen. Solche E-Mails und Anlagen dürfen Sie weder nutzen, noch verarbeiten oder
Dritten zugänglich machen, gleich in welcher Form. Wir danken für Ihre Kooperation!

CONFIDENTIAL! This email contains confidential information and is intended for the authorized recipient only. If you are
not an authorised recipient please return the email to us and then delete it from your computer and mail-server. You may neither
use nor edit any such emails including attachments, nor make them accessible to third parties in any manner whatsoever. 
Thank you for your cooperation.

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml