2

My ClamAV daily scan is detecting Malware from apache-maven library location. So now I want to know if this is a false positive or a real alert.

Can some one help me how to figure it out this? How can I exclude a particular file from the daily scan?

Find below logs I received after the daily scan.

/home/application/SSL/build-tools/apache-maven/lib/maven-model-builder-3.2.5.jar: Java.Malware.Agent-6203119-0 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 6302283
Engine version: 0.99.2
Scanned directories: 146811
Scanned files: 193145
Infected files: 1
Total errors: 12133
Data scanned: 9106.09 MB
Data read: 57098.23 MB (ratio 0.16:1)
Time: 2184.953 sec (36 m 24 s)
  • Assuming the .jar does not contain any critical data, consider checking it via virustotal.com. Its a free online scanner which features about 50-60 av-scanners at once. – dufte Aug 3 '17 at 10:58
3

I would advice to always do 2 things:

  1. google file and malware notice.
  2. check the integrity of the file.

  1. There is not a single hit on google on "maven-model-builder-3.2.5.jar" and clamav reporting a virus in this file.

  2. To check the integrity of this file the maven repository has 2 hashes:

    • MD5 hash for it is: a216c67dae851a4cedb4b431a674eba2
    • SHA1 hash for it is: 7a32f3966fab463df9cdae95fd6df8c2e561e3ae

Commands to find those for your file are ...

md5sum /home/application/SSL/build-tools/apache-maven/lib/maven-model-builder-3.2.5.jar
sha1sum /home/application/SSL/build-tools/apache-maven/lib/maven-model-builder-3.2.5.jar

If those match: false positive. If they do not it needs more investigation.

  • Thanks for the reply. I checked the 2 hashes and they are matching. It seems like a false positive. – cinny Aug 4 '17 at 8:16
  • Yes, then those are false positives. – Rinzwind Aug 4 '17 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.