ClamAV detected by avast! ???

[trumpy81]

Nope, it's ClamAV problem and I'm personally again doing anything on our side. It's usual non-encrypted data in their database, and it started because either them or we added that particular detection in the db.

But the root of the problem is still in their inability to provide inspection-safe db.

Actually it's not ClamWin's problem at all, it's a clear case of yet another 'FALSE' Positive made by Avast, which is why most of us have ClamWin installed in the first place!

A simple fix that has already been outlined here is to simply add a wildcard exemption for ClamWin's various folders. So why can't Avast include these exemptions in their next update?

[polonus]

Hi trumpy81,

I have reported this issue also, when avast flagged this. I use ClamWin just to close the vulnerability window on machine and because it has another range of signatures as the run of the mill av-vendors.
I agree with you, ClamWin portable apps functioned fine upon my machine until avast started to interfere, I made an exclusion for these alerts and I do hope the issue can be settled with an upcoming update,

polonus

[igor]

Actually it's not ClamWin's problem at all, it's a clear case of yet another 'FALSE' Positive made by Avast, which is why most of us have ClamWin installed in the first place!

Detecting someone's virus signatures is not a false positive; they are virus signatures, not just some random unrelated file.

A simple fix that has already been outlined here is to simply add a wildcard exemption for ClamWin's various folders. So why can't Avast include these exemptions in their next update?

And why can't Clam do their homework and properly scramble their virus database?

[DavidR]

Nope, it's ClamAV problem and I'm personally again doing anything on our side. It's usual non-encrypted data in their database, and it started because either them or we added that particular detection in the db.

But the root of the problem is still in their inability to provide inspection-safe db.

Actually it's not ClamWin's problem at all, it's a clear case of yet another 'FALSE' Positive made by Avast, which is why most of us have ClamWin installed in the first place!

A simple fix that has already been outlined here is to simply add a wildcard exemption for ClamWin's various folders. So why can't Avast include these exemptions in their next update?

How can it possibly be a false positive, when avast is alerting on finding a virus signature, that is after all what an antivirus is meant to do. Why clamav haven't encrypted the signatures is beyond me as they must be aware that installed resident scanners will detect them.

There is no guarantee that clamav will always be installed in the same location, there is also nothing stopping clamav changing the file name format breaking any exclusion created. Personally I would be a bit pi**ed if the use of wildecard exclusions as without care that wildcard could leave a large hole in your security.

I also don't see why avast should chase other AVs issues of not encrypting their signatures like panda and calmav, two that I know of with the possibility of there being more.

[bob3160]

David,
The exclusion you posted some time back as a reply to my original request for help
has work without any problems or risk to my system.
I'm again happily using avast! and have ClamAV available as a second opinion when needed.
Thanks 

[trumpy81]

How can it possibly be a false positive, when avast is alerting on finding a virus signature, that is after all what an antivirus is meant to do. Why clamav haven't encrypted the signatures is beyond me as they must be aware that installed resident scanners will detect them.

There is no guarantee that clamav will always be installed in the same location, there is also nothing stopping clamav changing the file name format breaking any exclusion created. Personally I would be a bit pi**ed if the use of wildecard exclusions as without care that wildcard could leave a large hole in your security.

I also don't see why avast should chase other AVs issues of not encrypting their signatures like panda and calmav, two that I know of with the possibility of there being more.

The whole point of having an Anti-Virus program on ones computer in the first place is to prevent malicious code from tampering with ones computer. In this case ClamWin poses no threat to ones computer, in fact it is the opposite, and exists for the same purpose as does Avast, therefore, it is NOT a threat and hence my determination of a False Positive.

Granted, Clamwin should encrypt their database, but then Avast would/should detect ClamWin when it decrypts it's database, causing yet another False Positive.

A simple solution exists, (and yes you are correct in that Wildcards should not be used), and in this case I see no reason why it should not be implemented by default.

[CharleyO]

***

I have yet to have avast alert on ClamAV.

Perhaps because it is in Spyware Terminator?


***

[spg SCOTT]

***

I have yet to have avast alert on ClamAV.

Perhaps because it is in Spyware Terminator?


***

Not sure about that one, there was someone asking about the ClamAV and Spyware Terminator in the 'virus in temp' sticky thread

-Scott-

[megas]

sorry i dident understand how to isolate the folder for avoiding the problem

[Lisandro]

sorry i dident understand how to isolate the folder for avoiding the problem

You need to use the Exclusion lists:

For the Standard Shield provider (on-access scanning):
Left click the 'a' blue icon, click on the provider icon at left and then Customize.
Go to Advanced tab and click on Add button...

For the other providers (on-demand scanning such as the screen-saver or the Simple User Interface):
Right click the 'a' blue icon, click Program Settings.
Go to Exclusions tab and click on Add button...

You can use wildcards like * and ?.
But be careful, you should 'exclude' that many files that let your system in danger.

[DavidR]

sorry i dident understand how to isolate the folder for avoiding the problem

Check my post in the previous page, Reply #8 of this topic, http://forum.avast.com/index.php?topic=45231.msg379055#msg379055

[megas]

thanks and another thing but why clam av dont encripted well is database

[DavidR]

I can't understand why either, but that is something you would have to ask them.

[netgk5815]

that really should be ?:\ClamWin\ClamWinPortable\Data\db\* the ? which allows for the clamwin portable version USB not being allocated the same drive letter and you need to have the \ after db and before the wildcard.

I'm also not keen on excluding a whole folder as that could leave a small hole in your security, but to exclude only the troublesome file types within that folder, ?:\ClamWin\ClamWinPortable\Data\db\*.clamtmp

Thanks for the information for users having ClamWinPortable installed on their USB flashdrives. I also have that setup. However, for my home PC, I have installed the static ClamWin on my hard drive [Windows Vista Home Premium 32-bit]. What would be the exclusion string for it? Thanks in advance.   

[DavidR]

The exclusion string example is independent of OS presuming you installed it in the OS.s program files folder, if the vista program files are stored in a different location you need to change 'program files' to that folder name. I don't use vista.