Re: False positive in emacs-22.2-bin-i386.zip?

[Jason Rumney]

Angelo Graziosi wrote:
> After unpacking
> ftp://ftp.gnu.org/gnu/emacs/windows/emacs-22.2-bin-i386.zip, running under
> Cygwin,
>
> $ clamscan -r emacs-22.2
>
> the result is:
>
> ...
> emacs-22.2/bin/ddeclient.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/digest-doc.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/hexl.exe: Trojan.Hijacker.Qhost FOUND
> emacs-22.2/bin/sorted-doc.exe: Trojan.Hijacker.Qhost FOUND
> ...
>   

I fed ddeclient.exe to the online scanner at http://virusscan.jotti.org/ 
(and others which only run one virus scanner on the file). ClamAV was 
the only scanner to report anything, so I think it was likely a false 
positive. The report from the above website was:

POSSIBLY INFECTED/MALWARE (Note: this file was only classified as 
malware by scanners known to generate more false positives than the 
average scanner. Do not consider these results definately accurate. 
Also, because of this, results of this scan will not be recorded in the 
database.)