dave-theunsub
commented
3 years ago Hi @CodingSpiderFox ,
Check out this clamav page: http://www.clamav.net/contact .
There is a link specifically for reporting false positives. Maybe just a button that allows for submission to this would work? Earlier versions of clamtk would only submit files to clamav.net, not virustotal.com, so it shouldn't be overly hard, I wouldn't think.
respectfully, Dave M
spotlesscoder
Edit: just discovered that virustotal is already used with the analysis button :D but the rest of my feature proposal might still be interesting in order to improve that integration
As it sometimes can happen that clamAV outputs false positives, I want to have a button to submit an infected file to the virustotal API for every finding that appears in the clamtk results (have a button in every row in the result table probably is a good solution).
Next to that new column with the "scan on virustotal" button, there should be a "virustotal result" column for every row where after API call to virustotal completes, the result is shown. Either green/red colour or just a list of the virus scanning engines which also detected a virus. In that result column, should we decide to provide the more detailed info about which virus scanner detected a virus, too, we might exclude clamav there as clamav already marked the file to be infected when it first scanned the file on our machine.
However, according to my previous issue report (duplicate findings https://gitlab.com/dave_m/clamtk/-/issues/110) duplicates should only be scanned once. So compare all "infected" files to each other (group by "Virus name" (X.LoremIpsuim.X-TrojanXYZ-like identifiers of the malware), filename first to aggregate results).
So if the imurmurhash.min.js appears in the result table 3 times, clicking the new "scan on virustotal" button should only trigger one API call to virustotal, then disable the "scan on virustotal" button on all off the 3 table entries for imurmurhash.min.js and display the result after completion on all 3 of the entries. Also it should write a note below the table that clamtk considered the files to be identical just to keep the user informed.
Necessary steps: [] Check the terms of service on virustotal.com whether that would be allowed. [] Develop prototype [] Test with my default Linux VM template which contains the imurmurhas.min.js findings which are quite likely false positives. Expected result is that the file should be scanned only once and the result be displayed on every occurrence.