clamav shows a trojan in stage3 2018-07-12 file

jagdpanther · l33t Joined: 22 Nov 2003 Posts: 729

I down loaded the amd64 stage 3 file
http://distfiles.gentoo.org/releases/amd64/autobuilds/20180712T214503Z/stage3-amd64-20180712T214503Z.tar.xz for a new system build tomorrow. I ran 'tar xJf' on that file as a regular user. (Yes, I expected the /dev/ files to fail.)
Then I ran 'clamscan -r -i' on the upper most directory and I keep getting one hit:

Chiitoo · Posted: Sat Jul 14, 2018 5:38 am Post subject: ><)))°€

I'm inclined to believe that to be a false positive, but you never know. :]

For the sake of curiosity, I tested scanning the file too, two times.

First, with a “virus database is older than 7 days” (did not check how old, possibly one month almost exactly), and did not detect anything.

After a 'freshclam', however, I got what you got, so it's rather new what ever it is.

Might submit a suspected false positive report (or to confirm it's indeed bad report).
_________________
Kindest of regardses.

Maitreya · Guru Joined: 11 Jan 2006 Posts: 441

https://forum.manjaro.org/t/clamav-detecting-viruses-on-manjaro/52066/13
https://www.linuxquestions.org/questions/showthread.php?p=5878457#post5878457

So it seems a overactive matching pattern is at play (or we are dealing with a massive infection across repositories and distributions, unlikely)

bunder · Bodhisattva Joined: 10 Apr 2004 Posts: 5934

FWIW...

Fitzcarraldo · Posted: Sat Jul 14, 2018 2:20 pm Post subject:

I checked the same Gentoo Stage 3 download using the version of ClamAV on a Lubuntu installation (0.99.4, the same as the latest Gentoo Stable version), and it also flagged the same file:

jagdpanther · l33t Joined: 22 Nov 2003 Posts: 729

Although it appears that the clamav 'hit' on /usr/bin/xzdec is a false positive, I noticed that on my old Gentoo system that is up to date (software wise, not hardware) does not trip clamav. So before I ran the chroot command on the new system, during the install, I just replaced the stage3 provided xzdec with the one from my old system. (Both are x86_64). They are a few bytes different in size and I suspect that my CFLAGS (and perhaps some useflag) settings account for the difference in size.

krinn · Watchman Joined: 02 May 2003 Posts: 7470

You might also look at the trojan effect, it generally define its nature. While this one is name "Unix" it still seems that it's one for Windows and not nix.
And finding its partern inside an elf format file is then a false positive.