Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: ClamAV: win32

False positive with ml_ipod

 

 

ClamAV win32 RSS feed   Index | Next | Previous | View Threaded


markpeloquin at gmail

Jan 11, 2009, 12:08 PM

Post #1 of 2 (952 views)
Permalink
False positive with ml_ipod

ClamWin reports that ml_ipod's 'Process.exe' is a virus
(Trojan.Killproc-1). It is not a virus, but it does exhibit some
suspicious behavior (the following post is by the primary developer of
ml_ipod):
http://forums.winamp.com/showthread.php?postid=2318907#post2319150

This is with ml_ipod-3.06 (haven't checked previous versions). I've
uploaded a copy here:
http://pages.cs.wisc.edu/~markus/misc/ml_ipod-false_positive.tar.gz
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32


mwatchinski at sourcefire

Jan 12, 2009, 8:06 AM

Post #2 of 2 (867 views)
Permalink
Re: False positive with ml_ipod [In reply to]

Please submit this as a false positive report on clamav.net

Thanks
-matt

On Sun, Jan 11, 2009 at 3:08 PM, Markus Peloquin <markpeloquin[at]gmail.com>wrote:

> ClamWin reports that ml_ipod's 'Process.exe' is a virus
> (Trojan.Killproc-1). It is not a virus, but it does exhibit some
> suspicious behavior (the following post is by the primary developer of
> ml_ipod):
> http://forums.winamp.com/showthread.php?postid=2318907#post2319150
>
> This is with ml_ipod-3.06 (haven't checked previous versions). I've
> uploaded a copy here:
> http://pages.cs.wisc.edu/~markus/misc/ml_ipod-false_positive.tar.gz<http://pages.cs.wisc.edu/%7Emarkus/misc/ml_ipod-false_positive.tar.gz>
> _______________________________________________
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32
>



--
Matthew Watchinski
Sr. Director Vulnerability Research Team (VRT)
Sourcefire, Inc.
Office: 410-423-1928
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32

ClamAV win32 RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact lists@gossamer-threads.com
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.