Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: molngab on May 26, 2013, 09:45:16 AM
-
Hello!
If I update the virus signature base of Clamwin AV, sometimes the resident shield of Avast found a "trojan horse" in the update module of Clamwin.
See: the jpg.
This is strange, because
-the source (clamav libraries) are trusted
And stranger:
- I added the full clamwin directory to the exception list of avast file shield module.
How can find an infection in this dir, if this dir can be foudn in exception?
Thanks!
-
Sound like an issue from avast side. Anyway you should try to submit the file to virus@avast.com (if the files can be sent via email).
-
This is strange, because
-the source (clamav libraries) are trusted
not strange..... ClamAV is a antivirus program
antivirus programs are known to detect on other antivirus programs, as they have virus like behavior and are full of virus signatures
and that is why you should not install multiple AV programs
this will give you a slower machine, mysterious windows errors and false detections
-
????
False detections?
I ADDED the full ClamWindir to the exceptions list of Avast file shield.
How can generate the avast FALSE detection, if the scan of the "infected" dir is forbidden?
Second.
ClamWin hasn't a resident shield. It can't slow down my pc, and can't affect another av shield-because clamwin hasn't any shield.
>>
false detections
-
explained here .... see post from quietman7
http://www.bleepingcomputer.com/forums/topic186533.html
General: Uninstalling a third-party antivirus software
http://www.avast.com/en-us/faq.php?article=AVKB11
if you want an extra scanner, Malwarebytes is recomended. www.malwarebytes.org
-
Yes I have to agree with Pondus, you could use Malwarebytes for manually scan your pc from time to time, and since starts manually, I don't experience no conflict, no false detection, no slowdown, nothing. Any way avast has a strong detection, only thing that Malwarebytes found in my pc since I start to use avast(since v.4) was tracking cookies.
Regards RealNature,
-
only thing that Malwarebytes found in my pc since I start to use avast(since v.4) was tracking cookies.
very strange.....since Malwarebytes does not scan for tracking cookies. ;)
-
only thing that Malwarebytes found in my pc since I start to use avast(since v.4) was tracking cookies.
very strange.....since Malwarebytes does not scan for tracking cookies. ;)
Believe it did a very long time ago.
-
only thing that Malwarebytes found in my pc since I start to use avast(since v.4) was tracking cookies.
very strange.....since Malwarebytes does not scan for tracking cookies. ;)
Believe it did a very long time ago.
It's never scanned for tracking cookies that I can remember ??? SuperAntiSpyware does.
-
Clamwin does have a portable version which I use for customers.
-
only thing that Malwarebytes found in my pc since I start to use avast(since v.4) was tracking cookies.
very strange.....since Malwarebytes does not scan for tracking cookies. ;)
Believe it did a very long time ago.
It's never scanned for tracking cookies that I can remember ??? SuperAntiSpyware does.
Craigb is 100% correct and I can confirm this Malwarebytes does not scan for tracking cookies, only SuperAntiSpyware does scan for tracking cookies they have an option setting to turn this off.
-
only thing that Malwarebytes found in my pc since I start to use avast(since v.4) was tracking cookies.
very strange.....since Malwarebytes does not scan for tracking cookies. ;)
Believe it did a very long time ago.
It's never scanned for tracking cookies that I can remember ??? SuperAntiSpyware does.
hmm I recall a long time ago I use to have to say not to worry about the cookies...i think back then I was using AVG though perhaps AVG was the one that picked up cookies.
-
@ molngab
No it isn't an FP when an AV that is in the lookout for virus signatures alerts when it finds the unencrypted virus signatures of another security application.
Your image doesn't show the full path to the 'Object', so it is possible it isn't in the clamwin directory ?
Updates as such may well be in the/a temp folder whilst being processed and removed when complete.
EDIT, incorrect user name for reference.
-
only thing that Malwarebytes found in my pc since I start to use avast(since v.4) was tracking cookies.
very strange.....since Malwarebytes does not scan for tracking cookies. ;)
Believe it did a very long time ago.
It's never scanned for tracking cookies that I can remember ??? SuperAntiSpyware does.
You're right, I confused with Superantispyware. My bad ;D
-
ClamWin AV is not a resident antivirus, and does not have the capability to be resident. The only resident part is the signature updater. ClamWin AV can only be used as an on-demand scanner; triggered by the user or another program. Therefore, ClamWin AV does not conflict with Avast or other resident antivirus programs. However, since ClamWin AV program file was recently updated, Avast does occasionally alert on the ClamWin signatures during ClamWin's update process.
-
ClamWin AV is not a resident antivirus, and does not have the capability to be resident.
it does..... if you use Clam Sentinel. ;)
http://clamsentinel.sourceforge.net/SentinelSimpleGuide.html
Therefore, ClamWin AV does not conflict with Avast or other resident antivirus programs.
quote quietman7
"However, even when one of them is disabled for use as a stand-alone scanner, it can affect the other. Anti-virus software components insert themselves into the operating systems core and using more than one can cause instability, crash your computer, slow performance and waste system resources."
-
Without ClamSentinal, which is a separate program which integrates with ClamWin AV but requires a separate download and install, ClamWin AV has no resident components that can interfere with Avast.
Something in ClamWin AV updater has changed that causes Avast to sometimes alert when ClamWin's signatures are updated. However, even with the alert, it hasn't caused a problem with either Avast nor ClamWin AV.
-
ClamWin creates .tmp and .clamtmp files in C:\Documents and Settings\Ownername\Local Settings\Temp (on XP). This is usually where Avast finds ClamWin infections.
-
Thanks Simon, that confirms my suspicion in Reply #12 that the exclusions doesn't work because it isn't in the clamwin directory but a temporary one.
-
You're welcome, DavidR.
-
ClamWin creates .tmp and .clamtmp files in C:\Documents and Settings\Ownername\Local Settings\Temp (on XP). This is usually where Avast finds ClamWin infections.
Avast alerts on ClamWin signature files in a subdirectory of C:\Documents and Settings\All Users\.clamwin\db\, which it didn't do before. The majority of the signature files do not cause an alert. I have ClamWin AV on my WinXP desktop, and haven't had an alert for several days now. If I get another one, I will exclude the directory and all subdirectories under it.
-
ClamWin creates .tmp and .clamtmp files in C:\Documents and Settings\Ownername\Local Settings\Temp (on XP). This is usually where Avast finds ClamWin infections.
Avast alerts on ClamWin signature files in a subdirectory of C:\Documents and Settings\All Users\.clamwin\db\, which it didn't do before. The majority of the signature files do not cause an alert. I have ClamWin AV on my WinXP desktop, and haven't had an alert for several days now. If I get another one, I will exclude the directory and all subdirectories under it.
Hello Gopher John:
You are partially correct because many of the temp files I referenced ultimately land in the ClamWin DB folder, which is re-written upon updating. However, ClamWin/ClamAV signatures have long been detected by Avast. A forum search offers this topic (http://forum.avast.com/index.php?topic=45201.msg386140#msg386140) from 2009.
Regards, Simion
-
I've been running ClamWin AV for several years now, and Avast for 4-5 years. Only recently (after the most recent ClamWin program update) has Avast alerted on ClamWin signatures for me, and even now it's not that often. I just did a full scan on my WinXP machine which has ClamWin AV with Avast, and Avast didn't alert. The alerts are quite random. I haven't yet set any exclusions in Avast for ClamWin.
-
I've been running ClamWin AV for several years now, and Avast for 4-5 years. Only recently (after the most recent ClamWin program update) has Avast alerted on ClamWin signatures for me, and even now it's not that often. I just did a full scan on my WinXP machine which has ClamWin AV with Avast, and Avast didn't alert. The alerts are quite random. I haven't yet set any exclusions in Avast for ClamWin.
Well, my link in Reply #21 shows that Avast has alerted on ClamWin since at least 2009.
There have been some changes at ClamAV since Sourcefire acquired them and Immunet about a year ago. One notable improvement has been the implementation of automated signature creation five or six months ago, which has greatly increased the detection rate of ClamAV, hence ClamWin and Immunet. If I had to guess, I would say the change in signatures is more likely causing your sudden detection of ClamWin, rather than a recent program update, which have mostly been minor bug fixes.
Regards, Simion
-
ClamWin AV was updated to 0.97.8 on April 08, 2013. Avast released 8.0.1489 on May 09, 2013. The first Avast detections ever (for me) of ClamWin signatures were in the second week of May, 2013. There have only been 3 of them, with the last one several days ago. Actually, this seems to indicate that Avast scanning is more aggressive.
At any rate, the detections have done no harm as I have Avast set to ask as first option. Avast streaming updates are likely more aggressive than before, as there have been a lot more of them lately.
-
Avast streaming updates are likely more aggressive than before, as there have been a lot more of them lately.
what does more updates have to do with being more aggresive ???
-
Avast streaming updates are likely more aggressive than before, as there have been a lot more of them lately.
what does more updates have to do with being more aggresive ???
Less time for the Avast team to evaluate the possible results. ???
-
Avast streaming updates are likely more aggressive than before, as there have been a lot more of them lately.
what does more updates have to do with being more aggresive ???
Less time for the Avast team to evaluate the possible results. ???
i dont think that has changed...
i think they now release them as they are ready instead of waiting for xx amount of signatures tested or a preset release time