Review for trojan or report as a false positive

[code-devy]

ClamAV Engine version: 1.4.3 with latest virus definitions is reporting a potential trojan (Unix.Trojan.Agent-7158340-0) with the latest Linux release: docker-scout_1.20.0_linux_amd64.tar.gz. Please review and confirm if a fix is needed or if it needs to be reported as a false positive to the AV engine: https://www.clamav.net/reports/fp.

[cdupuis]

@code-devy,

I just tried this on my end and was not able to make ClamAV report this issue:

ClamAV update process started at Thu Feb 26 11:12:49 2026
daily.cvd database is up-to-date (version: 27924, sigs: 355142, f-level: 90, builder: svc.clamav-publisher)
main.cvd database is up-to-date (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
bytecode.cvd database is up-to-date (version: 339, sigs: 80, f-level: 90, builder: nrandolp)
Scanning /scandir/.oci/docker-scout_1.20.0_linux_amd64.tar.gz
/scandir/.oci/docker-scout_1.20.0_linux_amd64.tar.gz: OK

----------- SCAN SUMMARY -----------
Known viruses: 3627556
Engine version: 1.5.1
Scanned directories: 1
Scanned files: 1
Infected files: 0
Data scanned: 59.67 MiB
Data read: 56.03 MiB (ratio 1.06:1)
Time: 7.154 sec (0 m 7 s)
Start Date: 2026:02:26 11:12:49
End Date:   2026:02:26 11:12:56

Could you share how you are scanning this?

[code-devy]

It appears that we are both following the same process by running freshclam and then running clamscan on the artifact release. We also generate random unique folder directory names for reach run and delete them after each run. The only differences are that we are using an older engine version 1.4.3, and it appears that when we run the scan, more data is scanned (192.96 MB vs 59.67 MB)? We only run it on the file artifact as shown below, so let me know if you see anything that may be causing the discrepancy.

ClamAV update process started at Mon Mar 2 09:00:47 2026
daily database available for download (remote version: 27928)
daily.cvd updated (version: 27928, sigs: 355150, f-level: 90, builder: svc.clamav-publisher)
main database available for download (remote version: 63)
main.cvd updated (version: 63, sigs: 3287027, f-level: 90, builder: tomjudge)
bytecode database available for download (remote version: 339)
bytecode.cvd updated (version: 339, sigs: 80, f-level: 90, builder: nrandolp)

Scanning /tmp/random_temp_dir_xxx/ticket_id_xxx/docker-scout_1.20.0_linux_amd64.tar.gz
/tmp/random_temp_dir_xxx/ticket_id_xxx/docker-scout_1.20.0_linux_amd64.tar.gz: Unix.Trojan.Agent-7158340-0 FOUND

----------- SCAN SUMMARY -----------
Known viruses: 3627562
Engine version: 1.4.3
Scanned directories: 2
Scanned files: 1
Infected files: 1
Data scanned: 192.96 MB
Data read: 56.03 MB (ratio 3.44:1)
Time: 32.309 sec (0 m 32 s)
Start Date: 2026:03:02 14:07:19
End Date: 2026:03:02 14:07:52

[code-devy]

Hi @cdupuis,

After seeing similar issues for other packages, it looks like we send in additional parameters to do more in-depth scanning on packages, which explains why there was more data scanned in our scenario. Please see below for the output differences based on the additional flags.

# Confirm definitions version
clamscan --version
ClamAV 1.4.3/27996/Sun May 10 02:26:36 2026

# Standard scan
clamscan -v --stdout -ir --tempdir=/tmp /quarantine/docker-scout_1.20.4_linux_amd64.tar.gz 

Scanning /quarantine/pkgid-a9b3bee1_docker-scout_1.20.4_linux_amd64.tar.gz

----------- SCAN SUMMARY -----------
Known viruses: 3627854
Engine version: 1.4.3
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 59.80 MB
Data read: 56.15 MB (ratio 1.06:1)
Time: 11.032 sec (0 m 11 s)
Start Date: 2026:05:11 14:28:57
End Date:   2026:05:11 14:29:08

# Enhanced scan
clamscan -v --stdout --max-filesize=2000M --max-scansize=4000M -ir --tempdir=/tmp /quarantine/docker-scout_1.20.4_linux_amd64.tar.gz 

Scanning /quarantine/docker-scout_1.20.4_linux_amd64.tar.gz: Unix.Trojan.Agent-7158340-0 FOUND

----------- SCAN SUMMARY -----------
Known viruses: 3627854
Engine version: 1.4.3
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 193.59 MB
Data read: 56.15 MB (ratio 3.45:1)
Time: 20.554 sec (0 m 20 s)
Start Date: 2026:05:11 14:15:30
End Date:   2026:05:11 14:15:51