Download the Anti-Virus Scanning 2.4.3 could lead to false positive antivirus detection

Products

• VMware Tanzu Platform Core

Issue/Introduction

Downloading Anti-Virus Scanning 2.4.3 in preparation for upgrade resident antivirus scan detects trojan component exclusively for this version.

 Downloading 2.4.2 does not trigger the the scan.

File detected is clam.exe.emb.exes located under releases/packages/clamav/clamav-1.5.1/unit_tests/input/embedded_testfiles/clam.exe.emb-exes on both tiles p-antivirus-mirror-2.4.3.pivotal and p-antivirus-2.4.3.pivotal

Environment

Anti-Virus Scanning 2.4.3

Cause

The detection of clam.exe.emb-exes is a false positive. This is a static test artifact from the upstream ClamAV source, introduced in the 1.5 release, used solely to verify the detection of hidden executables.

It is not functional malware. In theAnti-Virus Scanning 2.4.3 tile distribution the upstream ClamAV is used as-is to ensure the engine runs the exact, audited code from the source.

Resolution

This is a false positive event triggered by antivirus system.