Forum Discussion

Aspirant

Feb 25, 2019

Antivirus alert: Doc.Malware.Sagent-6865733-0

ReadyNAS 314 - Fw 6.9.5 After last update of antivirus engine (Feb 24, 2019), i recive alert "System: Antivirus scanner found a threat (Doc.Malware.Sagent-6865733-0)" on every winword document ...

StephenB

Guru - Experienced User

Feb 27, 2019

tecniciCaq wrote:

Yesterday was released new Antivirus scanner definition updated 58.25372 and resolved exploit (not firmware)

Certainly it was ClamAV's issue. Upgrading the firmware would trigger apt-get updates though, so it could have gotten the new definitions onto the NAS more quickly.

rph1

Star

Feb 27, 2019

Hi Everyone,

It looks like my issue may be resolved. It appears for me, a check is done for virus definition updates at 2:45pm PST on a daily basis. Yesterday at that time, a new virus definition file was installed, 58.25372, which appears to have resolved the false positive. Since that was installed I have not seen one entry in the logs for the Doc.Malware.Sagent-686733-0 malware. It looks like this should resolve the problem for those experiencing the issue.

Unfortunately, there is no mechanism to force a check for an updated virus definition file and install it if there is one. That would be a nice addition and not have us wait for the system to do it on its own. Just think about an actual virus or malware infection and having to wait a day when a fix is available to stop an infultration. Not a good way to manage things.

2Compute
Aspirant
Feb 28, 2019
Indeed, an issue Netgear should fix.
Marc_V
NETGEAR Employee Retired
Mar 03, 2019
Hi

rph1 You can submit this idea on the Ideas exchange board.

The issue with False positives is with ClamAV that is why it needs to be reported to their site.

Good day to all

Regards
StephenB
Guru - Experienced User
Mar 03, 2019
Marc_V wrote:

The issue with False positives is with ClamAV that is why it needs to be reported to their site.

This is the issue that Netgear should fix (and I think is what 2Compute was meaning )

rph1 wrote:

Unfortunately, there is no mechanism to force a check for an updated virus definition file and install it if there is one.

In general, Netgear doesn't provide any controls for ClamAV other than "on" and off". Requests for more options have been on the idea exchange for a couple years now - they were posted immediately after Netgear switched to ClamAV and removed all the configuration controls. So far they've been ignored.