New signatures, different error msg for same Firefox file

As I reported a couple of days ago, ClamAV 1.0.9 found what was almost certainly a false positive, since VirusTotal said file was AOK:

====================
Firefox Setup 115.34.0esr.exe: Win.Trojan.Spora-7724442-0 FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 36.458 sec (0 m 36 s)
Start Date: 2026:03:26 10:03:00
End Date:   2026:03:26 10:03:37
RC = 1
====================

Today, sending the same Firefox file to my local clamd (1.0.9) with latest freshclam update gave a different error:

====================
Firefox Setup 115.34.0esr.exe: Heuristics.Limits.Exceeded.MaxRecursion FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 41.079 sec (0 m 41 s)
Start Date: 2026:03:31 19:19:38
End Date:   2026:03:31 19:20:19
RC = 1
====================

So I upped the recursion limits from 30 (max-dir-rec) and 32 (max-rec) to 40 and 40 and got ...

====================
Firefox Setup 115.34.0esr.exe: Heuristics.Limits.Exceeded.MaxRecursion FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 87.691 sec (1 m 27 s)
Start Date: 2026:03:31 21:14:31
End Date:   2026:03:31 21:15:59
RC = 1
====================

Next I upped the recursion limits from 40/40 to 60/60 and got much the same:

====================
Firefox Setup 115.34.0esr.exe: Heuristics.Limits.Exceeded.MaxRecursion FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 95.908 sec (1 m 35 s)
Start Date: 2026:03:31 21:23:08
End Date:   2026:03:31 21:24:44
RC = 1
====================

So, are the new signatures broken too, but in a different way?

If so, since today's behavior is so different from a few days ago, I'm not sure if I should report a False Positive, something else, or both via clamsubmit.

P.S. I am now beginning to wonder about VirusTotal. Could they be running a version and configuration of ClamAV that doesn't really examine the entire file? The file is about 57 MB, well within ClamAV's 2 GB limit, and even less than the *default* size cutoff of 100 MB.






_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat