Author Topic: ClamAV detected by avast! ???  (Read 28026 times)

0 Members and 1 Guest are viewing this topic.

trumpy81

  • Guest
Re: ClamAV detected by avast! ???
« Reply #15 on: May 25, 2009, 08:48:23 PM »
Nope, it's ClamAV problem and I'm personally again doing anything on our side. It's usual non-encrypted data in their database, and it started because either them or we added that particular detection in the db.

But the root of the problem is still in their inability to provide inspection-safe db.

Actually it's not ClamWin's problem at all, it's a clear case of yet another 'FALSE' Positive made by Avast, which is why most of us have ClamWin installed in the first place!

A simple fix that has already been outlined here is to simply add a wildcard exemption for ClamWin's various folders. So why can't Avast include these exemptions in their next update?

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33892
  • malware fighter
Re: ClamAV detected by avast! ???
« Reply #16 on: May 25, 2009, 08:56:16 PM »
Hi trumpy81,

I have reported this issue also, when avast flagged this. I use ClamWin just to close the vulnerability window on machine and because it has another range of signatures as the run of the mill av-vendors.
I agree with you, ClamWin portable apps functioned fine upon my machine until avast started to interfere, I made an exclusion for these alerts and I do hope the issue can be settled with an upcoming update,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: ClamAV detected by avast! ???
« Reply #17 on: May 25, 2009, 09:02:23 PM »
Actually it's not ClamWin's problem at all, it's a clear case of yet another 'FALSE' Positive made by Avast, which is why most of us have ClamWin installed in the first place!

Detecting someone's virus signatures is not a false positive; they are virus signatures, not just some random unrelated file.

A simple fix that has already been outlined here is to simply add a wildcard exemption for ClamWin's various folders. So why can't Avast include these exemptions in their next update?

And why can't Clam do their homework and properly scramble their virus database?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: ClamAV detected by avast! ???
« Reply #18 on: May 25, 2009, 09:06:32 PM »
Nope, it's ClamAV problem and I'm personally again doing anything on our side. It's usual non-encrypted data in their database, and it started because either them or we added that particular detection in the db.

But the root of the problem is still in their inability to provide inspection-safe db.

Actually it's not ClamWin's problem at all, it's a clear case of yet another 'FALSE' Positive made by Avast, which is why most of us have ClamWin installed in the first place!

A simple fix that has already been outlined here is to simply add a wildcard exemption for ClamWin's various folders. So why can't Avast include these exemptions in their next update?

How can it possibly be a false positive, when avast is alerting on finding a virus signature, that is after all what an antivirus is meant to do. Why clamav haven't encrypted the signatures is beyond me as they must be aware that installed resident scanners will detect them.

There is no guarantee that clamav will always be installed in the same location, there is also nothing stopping clamav changing the file name format breaking any exclusion created. Personally I would be a bit pi**ed if the use of wildecard exclusions as without care that wildcard could leave a large hole in your security.

I also don't see why avast should chase other AVs issues of not encrypting their signatures like panda and calmav, two that I know of with the possibility of there being more.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48524
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: ClamAV detected by avast! ???
« Reply #19 on: May 25, 2009, 09:28:36 PM »
David,
The exclusion you posted some time back as a reply to my original request for help
has work without any problems or risk to my system.
I'm again happily using avast! and have ClamAV available as a second opinion when needed.
Thanks  :)
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

trumpy81

  • Guest
Re: ClamAV detected by avast! ???
« Reply #20 on: May 25, 2009, 09:41:27 PM »

How can it possibly be a false positive, when avast is alerting on finding a virus signature, that is after all what an antivirus is meant to do. Why clamav haven't encrypted the signatures is beyond me as they must be aware that installed resident scanners will detect them.

There is no guarantee that clamav will always be installed in the same location, there is also nothing stopping clamav changing the file name format breaking any exclusion created. Personally I would be a bit pi**ed if the use of wildecard exclusions as without care that wildcard could leave a large hole in your security.

I also don't see why avast should chase other AVs issues of not encrypting their signatures like panda and calmav, two that I know of with the possibility of there being more.

The whole point of having an Anti-Virus program on ones computer in the first place is to prevent malicious code from tampering with ones computer. In this case ClamWin poses no threat to ones computer, in fact it is the opposite, and exists for the same purpose as does Avast, therefore, it is NOT a threat and hence my determination of a False Positive.

Granted, Clamwin should encrypt their database, but then Avast would/should detect ClamWin when it decrypts it's database, causing yet another False Positive.

A simple solution exists, (and yes you are correct in that Wildcards should not be used), and in this case I see no reason why it should not be implemented by default.


CharleyO

  • Guest
Re: ClamAV detected by avast! ???
« Reply #21 on: May 26, 2009, 09:04:33 AM »
***

I have yet to have avast alert on ClamAV.

Perhaps because it is in Spyware Terminator?


***

spg SCOTT

  • Guest
Re: ClamAV detected by avast! ???
« Reply #22 on: May 26, 2009, 12:26:02 PM »
***

I have yet to have avast alert on ClamAV.

Perhaps because it is in Spyware Terminator?


***

Not sure about that one, there was someone asking about the ClamAV and Spyware Terminator in the 'virus in temp' sticky thread

-Scott-

megas

  • Guest
Re: ClamAV detected by avast! ???
« Reply #23 on: May 26, 2009, 03:47:38 PM »
sorry i dident understand how to isolate the folder for avoiding the problem ??? ???

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: ClamAV detected by avast! ???
« Reply #24 on: May 26, 2009, 08:52:40 PM »
sorry i dident understand how to isolate the folder for avoiding the problem ??? ???
You need to use the Exclusion lists:

For the Standard Shield provider (on-access scanning):
Left click the 'a' blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab and click on Add button...

For the other providers (on-demand scanning such as the screen-saver or the Simple User Interface):
Right click the 'a' blue icon, click Program Settings.
Go to Exclusions tab and click on Add button...

You can use wildcards like * and ?.
But be careful, you should 'exclude' that many files that let your system in danger.
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: ClamAV detected by avast! ???
« Reply #25 on: May 26, 2009, 09:00:08 PM »
sorry i dident understand how to isolate the folder for avoiding the problem ??? ???

Check my post in the previous page, Reply #8 of this topic, http://forum.avast.com/index.php?topic=45231.msg379055#msg379055
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

megas

  • Guest
Re: ClamAV detected by avast! ???
« Reply #26 on: May 27, 2009, 08:07:55 AM »
thanks and another thing but why clam av dont encripted well is database

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: ClamAV detected by avast! ???
« Reply #27 on: May 27, 2009, 02:51:59 PM »
I can't understand why either, but that is something you would have to ask them.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

netgk5815

  • Guest
Re: ClamAV detected by avast! ???
« Reply #28 on: June 01, 2009, 03:20:00 AM »
that really should be ?:\ClamWin\ClamWinPortable\Data\db\* the ? which allows for the clamwin portable version USB not being allocated the same drive letter and you need to have the \ after db and before the wildcard.

I'm also not keen on excluding a whole folder as that could leave a small hole in your security, but to exclude only the troublesome file types within that folder, ?:\ClamWin\ClamWinPortable\Data\db\*.clamtmp

Thanks for the information for users having ClamWinPortable installed on their USB flashdrives. I also have that setup. However, for my home PC, I have installed the static ClamWin on my hard drive [Windows Vista Home Premium 32-bit]. What would be the exclusion string for it? Thanks in advance.    ???
« Last Edit: June 01, 2009, 03:34:24 AM by netgk5815 »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: ClamAV detected by avast! ???
« Reply #29 on: June 01, 2009, 04:01:50 AM »
The exclusion string example is independent of OS presuming you installed it in the OS.s program files folder, if the vista program files are stored in a different location you need to change 'program files' to that folder name. I don't use vista.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security