False positives on trojans (Trojan.Agent-132354)

[Vanessa Lee]

ClamAV reported finding "Trojan.Agent-132354" on a Windows partition, on a file called msoobe.exe.

Removing the file caused Windows XP to enter an endless first time registration loop upon each boot.

Further inspection revealed that certain non-activation required versions of msoobe.exe were coming up as false positives for "Trojan.Agent-132354" with ClamAV. These are not trojans, but those with activated Windows XP that do not require reactivation on CPU hardware ID change.

[Scott Kitterman (kitterman)]

Upstream bug, so reported there.

[Scott Kitterman (kitterman)]

Subject: [Bug 6865] False positives on trojans (Trojan.Agent-132354)

https://bugzilla.clamav.net/show_bug.cgi?id=6865

Matthew Olney <email address hidden> changed:

           What |Removed |Added
----------------------------------------------------------------------------
             Status|NEW |NEEDINFO
                 CC| |<email address hidden>
         AssignedTo|<email address hidden> |alain.zidouemba@sourcefire.
                   | |com

--- Comment #1 from Matthew Olney <email address hidden> 2013-02-16 17:07:42 CET ---
Can you please submit a sample of the file here:

http://www.clamav.net/lang/en/sendvirus/submit-fp/

And provide us the MD5 in the upstream (clamav) bug.

Thanks,

Matt