I've got a partition that holds a knoppix.iso that I rebuild now and again, also use it as a backup for my usb stick. Last night I ran clamav against my complete machine and it reported -

//spare2/knoppix/3.6/KNOPPIX/KNOPPIX: Trojan.URLspoof.gen FOUND
//spare2/knoppix/knoppix36.iso: Trojan.URLspoof.gen FOUND

This morning I ran clamav against -
my latest knoppix CD;
just the /spare2 directory
the complete machine

in none of the above did clamav find the URLspoof

I also ran Norton against the CD and again nothing!

Can anyone shed some light on this?

Thanks

Which version of ClamAV are you using?

According to Google (http://66.102.9.104/search?q=cache:J...poof.gen&hl=en) there was a fix on 2004-02-28 that fixed a false positive bug with Trojan.URLspoof.gen

Alternatively, you may have found a virus that's good at hiding itself.

rjlee

Thanks for the quick response. Should have looked at the error logs first.

In clamav-update error log started to get the following some time between 15/10/2004 and 31/10/2004 -

ClamAV update process started at Tue Nov 23 11:45:01 2004
main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: tomek)
WARNING: Your ClamAV installation is OUTDATED - please update immediately !
WARNING: Current functionality level = 2, required = 3
daily.cvd is up to date (version: 601, sigs: 782, f-level: 3, builder: trog)
WARNING: Your ClamAV installation is OUTDATED - please update immediately !
WARNING: Current functionality level = 2, required = 3

Updated from 0.71 to 0.80 so that clamav-update is ok now. Will be running another scan this evening.

The clamav-update log looks like this now -

ClamAV update process started at Tue Nov 23 12:29:49 2004
main.cvd updated (version: 28, sigs: 26630, f-level: 3, builder: tomek)
daily.cvd updated (version: 601, sigs: 782, f-level: 3, builder: trog)
Database updated (27412 signatures) from database.clamav.net (147.229.3.16).

which looks ok to me. Still don't understand where URLspoof came from or went! One of life's mysteries I suppose. Until the next scan!

Thanks

Given the fact that a false-positive bug was found (i.e. a bug that reports a virus even though it isn't there), I suspect that you never had a urlspoof in the first place.