Antivirus false positives

Question

ReadyNAS 4312, Firmware 6.7.5This option was not available in the drop-down menu when creating this post.&nbsp;We are receiving a number of warning emails from the anti-virus software on the NAS about infected files. On further inspection, these files are totally fine and are not infected.&nbsp;Example warning messages are:Antivirus scanner found a threat (Heuristics.Broken.Executable) in the file /data/****/Sentin~1.cab. Please delete the infected file soon.Antivirus scanner found a threat (Win.Trojan.Agent-525152) in the file /data/***/StartSophos.exe. Please delete the infected file soon.&nbsp;This appears to be a known issue as there are some other topics in these forums discussing this very problem but there appears also to be no real solution other than disabling the anti-virus functionality.&nbsp;Has there been any progress on resolving this issue from Netgear?&nbsp;Thanks in advance.

DCARichardM · Answer

We've just had 93 hits in the space of 56 minutes and this is happening most days now. All of the files are old archive files which have not been used or changed in 6 months or more so I'm not sure how they could suddenly contain a virus or have become corrupted, or in fact, why the NAS AV is suddenly picking these up.Very annoying none-the-less and compounded by the fact that Netgear/Clam seem to not be bothered about it.

Paul_P · Answer

I am using a Netgear ReadyNAS 526X running Clam AV to back up my work Windows laptop which contains multiple files on the host file system which are Wind River VxWorks RTOS binary files - these are in ELF binary format for either PowerPC, Intel IA32 or ARM processor architectures.&nbsp;During the backup, Clam AV reported many error messages, each for a VxWorks RTOS binary file, claiming "Antivirus scanner found a threat (Heuristics.Broken.Executable)" in each case. These definitely DO NOT contain viruses as I have already scanned the whole laptop with Intel MacAfee and Malwarebytes, so I think Clam AV is reporting false positives.&nbsp;I tried to report this via Clam AV website, but unfortunately this cannot be done without providing the false positive file, and I am not able to do this, as VxWorks RTOS and libraries&nbsp;are the intellectual property of Wind River, and the company's advance permission would be required in order to distribute these files to a third-party.&nbsp;However, surely, it can't be that uncommon for Netgear customer's to use their NAS for backup of host platforms used for embedded software development?&nbsp;

Fortun81 · Answer

FW:&nbsp; 6.9.1 with XRAID utilizing 7 - 4TB drives in a RAID6 array.&nbsp;I installed the RN628X&nbsp; last week, it is my first time using a Netgear NAS. I am getting hits on 4 files that pass Malwarebytes, Norton and McAfee scans. As they are old archived files that are not relevant anymore, I deleted them rather than take a chance. I will submit the file copies and see what happens.

JennC · Answer

Hello DCARichardM,
&nbsp;
Previously we had AntiVirus Plus app that gave some options but when 6.6.1 was released, this app would no longer work with the built AV of the ReadyNAS of an update on AV that it changed to ClamAV server.
&nbsp;
For now, there is no other option nor setting that you can adjust on the ReadyNAS for its AV until there is an app from a developer that will be submitted to Netgear.
&nbsp;
Welcome to the community!
&nbsp;
Regards,

mlopilato · Answer

I'm getting the same AV email message on multiple files since I upgraded to 6.9.0:

Antivirus scanner found a threat (Heuristics.Broken.Executable) in the file /data/Shared/Jobs/Desktop File Back Up/Notes/nntspreld.exe. Please delete the infected file soon.

Forum Discussion

Antivirus false positives

10 Replies

Related Content

False Positive DoS Attacks

Antivirus false positives

How best to diagnose false positive app upgrade in logs?

Antivirus

Antivirus False Positives Very High

NETGEAR Academy

ProSupport for Business