ClamAV False Positive On Java Malware Signature

Couple of days back, lot of Linux utilities were detected as java malware by ClamAV (open source Antivirus).
https://lists.gt.net/clamav/virusdb/69325
Antivirus release the signatures after testing the definition with huge collection of clean file set. But ClamAV missed that today. They detected more clean file as Java malware agent. In that list of signature, we can 100+ java malware signature were created as new signature and those signatures trigger clean files (stayed in VT as clean file for around three years).

These snapshots are proof for how long it is in the system and only clamav detect it as malware, it is a false positive.
The following signatures are creating false positive:
Java.Malware.Agent-6202827-0
Java.Malware.Agent-6203297-0
Java.Malware.Agent-6205980-0
Java.Malware.Agent-6205983-0
Java.Malware.Agent-6206104-0
Java.Malware.Agent-6206112-0
Signature and clean file in VT. All these files are in Virustotal for more than 2-3 years.
Java.Malware.Agent-6202827-0  :
 https://www.virustotal.com/en/file/b65161dd5d4020ba0875db66ceef0a2a362ae0225ceeccd29231d7f8132fa3d7/analysis/1491456748/
https://www.virustotal.com/en/file/014ae05271910db8ba64f07e2175989c500cc46ace868965e1ab5bc30e90ab91/analysis/1491456884/
https://www.virustotal.com/en/file/8c190264bdf591ff9f1268dc0ad940a2726f9e958e367716a09b8aaa7e74a755/analysis/1491456884/
https://www.virustotal.com/en/file/8df3d56ffd4f3cf6fd13414bc46accd6919f13e008bec04b7e435da0b0183bee/analysis/1491456898/
Java.Malware.Agent-6203297-0 :
https://www.virustotal.com/en/file/99b83f5f94e57059ecfda0a4823bdf56d6472adae3a2a5c95d9b7f23893a63bd/analysis/1491456962/
https://www.virustotal.com/en/file/dd9e79b759f813269ff15f849c9ebb1999bd7bc988e2b399f7581089fd368acb/analysis/1491456967/
Java.Malware.Agent-6205980-0 :
https://www.virustotal.com/en/file/703944b922d5351aad53b842f7dd38439b7213425f13c6c7f034b8b699b7d578/analysis/1491457053/
https://www.virustotal.com/en/file/b348cc3e0d098ab6d1200956500a0c68d304f40c19c6d4f0c67b2ee26cea00b0/analysis/1491457164/
https://www.virustotal.com/en/file/00be06d4bf98f4094998ec695d604dd258690a5f34a1a4c0dd32e40c54b3c204/analysis/1491457169/
Java.Malware.Agent-6205983-0 :
https://www.virustotal.com/en/file/bb37146a67d067069754c775b9c9f03b52da953261981738de963057023cda3a/analysis/1491457217/
https://www.virustotal.com/en/file/aba7980581027ad5fc74a27ee4d64aad74932fdb32694967242d03fc50290d1f/analysis/1491457223/
https://www.virustotal.com/en/file/c1e1d54f37b270d2391a0a8b104ab7340dcd39f9382078b5b1640528a06fcaf9/analysis/1491457228/
https://www.virustotal.com/en/file/6e3e9c949ab4695a204f74038717aa7b2689b1be94875899ac1b3fe42800ff82/analysis/1491457236/
https://www.virustotal.com/en/file/3a8dc4a12ab9f3607a1a2097bbab0150c947ad6719d8f1bb6d5b47d0fb0c4779/analysis/1491457251/
Java.Malware.Agent-6206104-0 :
https://www.virustotal.com/en/file/f550705b85d00ebbe2758de03a67d737a46c04c3e410c31f36909e4e63974334/analysis/
https://www.virustotal.com/en/file/f30cd6e5e0c872eb1cede65b15b4f0fd1f7a76cb953bded74765241e35caf96b/analysis/
https://www.virustotal.com/en/file/9a9b60e685385225f08e662cb9f60d96610b0987f0f47bbf3f0c92df8a897d00/analysis/
https://www.virustotal.com/en/file/7d4b4878bb5a9f4086f0c587aa9e21cf2f3e665e5d80f852f969b76f1346de41/analysis/
https://www.virustotal.com/en/file/637f5fb07d9b03957bc5f1a57b77a8202ba0a44f52a0d2c30e5d59b65e89ce48/analysis/
Java.Malware.Agent-6206112-0 :
https://www.virustotal.com/en/file/f550705b85d00ebbe2758de03a67d737a46c04c3e410c31f36909e4e63974334/analysis/1491460596/
https://www.virustotal.com/en/file/f30cd6e5e0c872eb1cede65b15b4f0fd1f7a76cb953bded74765241e35caf96b/analysis/1491460609/
https://www.virustotal.com/en/file/9a9b60e685385225f08e662cb9f60d96610b0987f0f47bbf3f0c92df8a897d00/analysis/1491460631/
https://www.virustotal.com/en/file/637f5fb07d9b03957bc5f1a57b77a8202ba0a44f52a0d2c30e5d59b65e89ce48/analysis/1491460647/

Post created by
newWorld

ClamAV - Opensource Antivirus

Clam AntiVirus (ClamAV) is a free, cross-platform antivirus software tool-kit able to detect many types of malicious software, including viruses. One of its main uses is on mail servers as a server-side email virus scanner. The application was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, OS X, OpenVMS, OSF (Tru64) and Solaris. As of version 0.97.5, ClamAV builds and runs on Microsoft Windows. Both ClamAV and its updates are made available free of charge.

Sourcefire, now acquired by Cisco, a maker of intrusion detection products and the owner of Snort, announced on 17 August 2007 that it had acquired the trademarks and copyrights to ClamAV from five key developers.

ClamAV is currently tested daily in comparative tests against other antivirus products on Shadowserver. In 2011, Shadowserver tested over 25 million samples against ClamAV and numerous other antivirus products. Out of the 25 million samples tested, ClamAV scored 76.60% ranking 12 out of 19, a higher rating than some much more established competitors.

ClamAV was included in comparative tests against other antivirus products. In the 2008 AV-Test it rated: on-demand: very poor, false positives: poor, on-access: poor, response time: very good, rootkits: very poor.

ClamAV for Windows is now a part of the Immunet client produced by Sourcefire.

Source:Wikipedia