up vote 1 down vote favorite

ClamAV scans on our application servers are identifying some of our legitimate Flex .swf files as malicious, specifically citing CVE-2015-5548 (specifically, "Swf.Exploit.CVE_2015_5548 FOUND"). Relevant CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5548

Best I can tell, this is a vulnerability with Flash player itself, which we don't even have installed server-side. Any idea why Clam is reporting this?

share|improve this question
  • False Positive? Getting the same thing on our CXS scans through cpanel, specificly our joomla editor components. components/com_jce/editor/libraries/mediaplayer/mediaplayer.swf Scanning with Kaspersky shows no virus. – Keith Page Nov 19 '15 at 6:04
up vote 2 down vote

In some cases, antivirus scanners can have false positives based on a similar appearance of some of the code in the files you are scanning. You can rule out a false positive by scanning the files with another antivirus utility. For example, a trial version of ESET's NOD32. Please try scanning with another AV solution and let us know the results.

share|improve this answer
  • False positive. Not detected by Windows Defender. – thak Nov 18 '15 at 20:07
  • FYI - Windows Defender, while it is an acceptable AV solution, is not the best choice for really detecting the most known threats. Check out Virus Bulletin's VB 100 awards to see who is the best out there. Virus Bulletin Site ESET has consistently won decades of these awards. There are some others that are close behind as well. Windows Defender = not so much. – Darkstar Nov 29 '15 at 3:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.