Review for trojan or report as a false positive #218

Activity

1. cdupuis commented on Feb 26, 2026

   

   cdupuis

   on Feb 26, 2026

   Collaborator

   More actions

   @code-devy,

   I just tried this on my end and was not able to make ClamAV report this issue:

   ClamAV update process started at Thu Feb 26 11:12:49 2026
   daily.cvd database is up-to-date (version: 27924, sigs: 355142, f-level: 90, builder: svc.clamav-publisher)
   main.cvd database is up-to-date (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
   bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
   Scanning /scandir/.oci/docker-scout_1.20.0_linux_amd64.tar.gz
   /scandir/.oci/docker-scout_1.20.0_linux_amd64.tar.gz: OK
   
   ----------- SCAN SUMMARY -----------
   Known viruses: 3627556
   Engine version: 1.5.1
   Scanned directories: 1
   Scanned files: 1
   Infected files: 0
   Data scanned: 59.67 MiB
   Data read: 56.03 MiB (ratio 1.06:1)
   Time: 7.154 sec (0 m 7 s)
   Start Date: 2026:02:26 11:12:49
   End Date:   2026:02:26 11:12:56
   

   Could you share how you are scanning this?
2. code-devy commented on Mar 2, 2026

   

   code-devy

   on Mar 2, 2026

   Author

   More actions

   It appears that we are both following the same process by running freshclam and then running clamscan on the artifact release. We also generate random unique folder directory names for reach run and delete them after each run. The only differences are that we are using an older engine version 1.4.3, and it appears that when we run the scan, more data is scanned (192.96 MB vs 59.67 MB)? We only run it on the file artifact as shown below, so let me know if you see anything that may be causing the discrepancy.

   ClamAV update process started at Mon Mar 2 09:00:47 2026
   daily database available for download (remote version: 27928)
   daily.cvd updated (version: 27928, sigs: 355150, f-level: 90, builder: svc.clamav-publisher)
   main database available for download (remote version: 63)
   main.cvd updated (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
   bytecode database available for download (remote version: 339)
   bytecode.cvd updated (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
   
   Scanning /tmp/random_temp_dir_xxx/ticket_id_xxx/docker-scout_1.20.0_linux_amd64.tar.gz
   /tmp/random_temp_dir_xxx/ticket_id_xxx/docker-scout_1.20.0_linux_amd64.tar.gz: Unix.Trojan.Agent-7158340-0 FOUND
   
   ----------- SCAN SUMMARY -----------
   Known viruses: 3627562
   Engine version: 1.4.3
   Scanned directories: 2
   Scanned files: 1
   Infected files: 1
   Data scanned: 192.96 MB
   Data read: 56.03 MB (ratio 3.44:1)
   Time: 32.309 sec (0 m 32 s)
   Start Date: 2026:03:02 14:07:19
   End Date: 2026:03:02 14:07:52
   
3. code-devy commented on May 11, 2026

   

   code-devy

   on May 11, 2026

   Last edited by code-devy

   Author

   More actions

   Hi @cdupuis,

   After seeing similar issues for other packages, it looks like we send in additional parameters to do more in-depth scanning on packages, which explains why there was more data scanned in our scenario. Please see below for the output differences based on the additional flags.

   # Confirm definitions version
   clamscan --version
   ClamAV 1.4.3/27996/Sun May 10 02:26:36 2026
   

   # Standard scan
   clamscan -v --stdout -ir --tempdir=/tmp /quarantine/docker-scout_1.20.4_linux_amd64.tar.gz 
   
   Scanning /quarantine/docker-scout_1.20.4_linux_amd64.tar.gz
   
   ----------- SCAN SUMMARY -----------
   Known viruses: 3627854
   Engine version: 1.4.3
   Scanned directories: 0
   Scanned files: 1
   Infected files: 0
   Data scanned: 59.80 MB
   Data read: 56.15 MB (ratio 1.06:1)
   Time: 11.032 sec (0 m 11 s)
   Start Date: 2026:05:11 14:28:57
   End Date:   2026:05:11 14:29:08
   

   # Enhanced scan
   clamscan -v --stdout --max-filesize=2000M --max-scansize=4000M -ir --tempdir=/tmp /quarantine/docker-scout_1.20.4_linux_amd64.tar.gz 
   
   Scanning /quarantine/docker-scout_1.20.4_linux_amd64.tar.gz: Unix.Trojan.Agent-7158340-0 FOUND
   
   ----------- SCAN SUMMARY -----------
   Known viruses: 3627854
   Engine version: 1.4.3
   Scanned directories: 0
   Scanned files: 1
   Infected files: 1
   Data scanned: 193.59 MB
   Data read: 56.15 MB (ratio 3.45:1)
   Time: 20.554 sec (0 m 20 s)
   Start Date: 2026:05:11 14:15:30
   End Date:   2026:05:11 14:15:51