关于ClamAV在Ubuntu实例的Conda包中检测到Win.Virus.Expiro-10004389-0疑似误报的技术问询

大家好，今天用ClamAV扫描我的AWS Ubuntu实例时，每个实例都被检测出标记为Win.Virus.Expiro-10004389-0的“感染文件”，但我怀疑这是误报，主要有这几个原因：

• 这些文件都是2021年创建的，为什么到现在才被检测出来？
• 所有实例的SSH端口都通过MFA+密码+VPN三重保护，不存在未授权访问的风险
• 这些文件都在Conda环境目录下，而且被标记的全是.exe格式文件——我的实例是Ubuntu系统，Windows可执行文件在这里根本无法运行，更别说造成感染了

我怀疑这是不是和某些已知的误报问题类似？

以下是ClamAV检测到的具体文件路径：

/home/kidas/anaconda3/pkgs/conda-build-3.24.0-py310h06a4308_0/lib/python3.10/site-packages/conda_build/cli-64.exe: Win.Virus.Expiro-10004389-0 FOUND
/home/kidas/anaconda3/pkgs/conda-build-3.24.0-py310h06a4308_0/lib/python3.10/site-packages/conda_build/cli-32.exe: Win.Virus.Expiro-10004389-0 FOUND
/home/kidas/anaconda3/pkgs/conda-23.3.1-py310h06a4308_0/lib/python3.10/site-packages/conda/shell/cli-64.exe: Win.Virus.Expiro-10004389-0 FOUND
/home/kidas/anaconda3/pkgs/conda-23.3.1-py310h06a4308_0/lib/python3.10/site-packages/conda/shell/cli-32.exe: Win.Virus.Expiro-10004389-0 FOUND
/home/kidas/anaconda3/lib/python3.10/site-packages/conda/shell/cli-64.exe: Win.Virus.Expiro-10004389-0 FOUND
/home/kidas/anaconda3/lib/python3.10/site-packages/conda/shell/cli-32.exe: Win.Virus.Expiro-10004389-0 FOUND
/home/kidas/anaconda3/lib/python3.10/site-packages/conda_build/cli-64.exe: Win.Virus.Expiro-10004389-0 FOUND
/home/kidas/anaconda3/lib/python3.10/site-packages/conda_build/cli-32.exe: Win.Virus.Expiro-10004389-0 FOUND

我还查询了VirusTotal的检测结果，绝大多数杀毒引擎都显示“未检测到恶意内容”，仅有少数几个引擎有相关标记（其中多数是标记为“不支持的文件类型”）：

{
  "ClamAV": {
    "category": "malicious",
    "engine_name": "ClamAV",
    "engine_version": "1.1.0.0",
    "result": "Win.Virus.Expiro-10004389-0",
    "method": "blacklist",
    "engine_update": "20230730"
  },
  "SymantecMobileInsight": {
    "category": "type-unsupported",
    "engine_name": "SymantecMobileInsight",
    "engine_version": "2.0",
    "result": null,
    "method": "blacklist",
    "engine_update": "20230119"
  },
  "Trustlook": {
    "category": "type-unsupported",
    "engine_name": "Trustlook",
    "engine_version": "1.0",
    "result": null,
    "method": "blacklist",
    "engine_update": "20230730"
  },
  "Avast-Mobile": {
    "category": "type-unsupported",
    "engine_name": "Avast-Mobile",
    "engine_version": "230730-02",
    "result": null,
    "method": "blacklist",
    "engine_update": "20230730"
  },
  "Google": {
    "category": "malicious",
    "engine_name": "Google",
    "engine_version": "1690700450",
    "result": "Detected",
    "method": "blacklist",
    "engine_update": "20230730"
  },
  "BitDefenderFalx": {
    "category": "type-unsupported",
    "engine_name": "BitDefenderFalx",
    "engine_version": "2.0.936",
    "result": null,
    "method": "blacklist",
    "engine_update": "20230729"
  }
}

备注：内容来源于stack exchange，提问作者Rougher