Re: Why are recent Firefox (for Windows) downloads ALL being found to contain ransomware?

On Thu, 26 Mar 2026, Andrew C Aitchison via clamav-users wrote:

> On Thu, 26 Mar 2026, Paul Kosinski via clamav-users wrote:
>
>> For example:
>> 
>> Firefox Setup 140.9.0esr.exe  --> Win.Trojan.Spora-7724442-0 FOUND
>> Firefox Setup 115.34.0esr.exe --> Win.Trojan.Spora-7724442-0 FOUND
>> Firefox Setup 115.34.0esr.msi --> Win.Trojan.Spora-7724442-0 FOUND
>> 
>> 
>> These are from ClamAV 1.0.9 clamd on Linux receiving file to be scanned 
>> over TCP.
>
> https://docs.clamav.net/faq/faq-eol.html#version-support-matrix
> suggests that 1.0.9 went end-of-life Nov-28 2025
> Version 1.3 is also EOL.
>
> Can you verify the problem with version 1.4.3 or 1.5.1 ?

I confirm that the issue exists with the Debian/Ubuntu build of clamav 
v1.4.3:

# clamscan -V
ClamAV 1.4.3/27953/Fri Mar 27 06:24:46 2026
# clamdscan --fdpass /tmp/werdna/Firefox\ Setup\ 149.0.msi
/tmp/werdna/Firefox Setup 149.0.msi: Win.Trojan.Spora-7724442-0 FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 115.905 sec (1 m 55 s)
Start Date: 2026:03:27 12:05:08
End Date:   2026:03:27 12:07:04

However, clamscan (with no "d") does not report a problem:

#clamscan -V
ClamAV 1.4.3/27953/Fri Mar 27 06:24:46 2026
# clamscan /tmp/werdna/Firefox\ Setup\ 149.0.msi
Loading:     6s, ETA:   0s [========================>]    3.63M/3.63M sigs
Compiling:   2s, ETA:   0s [========================>]       41/41 tasks

/tmp/werdna/Firefox Setup 149.0.msi: OK

----------- SCAN SUMMARY -----------
Known viruses: 3627742
Engine version: 1.4.3
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 408.25 MB
Data read: 82.41 MB (ratio 4.95:1)
Time: 128.877 sec (2 m 8 s)
Start Date: 2026:03:27 12:09:13
End Date:   2026:03:27 12:11:22


I note that the scan takes around two minutes
which may be enough for a timeout such as ReadTimeout to kick in.

-- 
Andrew C. Aitchison                      Kendal, UK
                    [email protected]
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat