December 2011 False Positives

[siketa]

https://www.virustotal.com/file/81c9103dc5e989cf40d945e9c9d460e40b8e96fae39e3504fdc38a7948ed590e/analysis/

https://www.virustotal.com/file/eb07c9649a29fd58ff8f63905e19172be64dfee02ae666cabebac541c540d1a4/analysis/

https://www.virustotal.com/file/e2c9a3e56d05b403c79ec215afe4e2f3c7505ca75d4cc1093aacb35b0cf703ba/analysis/

https://www.virustotal.com/file/bfe6b5934686e966358aeaafe26e43562173f9832dce3ecd8e017628f6df14c2/analysis/

https://www.virustotal.com/file/ff4e8fccf19139957982665c23e65be132d754fe98cca8781af75bea8ecef2af/analysis/

https://www.virustotal.com/file/0c59457bd4abeb6a7fb824ef9c297eb60ae5f8fa6b0a5966c93a39ef6165d7ce/analysis/

[miekiemoes]

Hi,

At first sight, they don't look like FPs either though. I'll review and fix where needed.

[siketa]

Thank You.

In next days I will also update possible FPs from January to October 2012.

Please, be so kind and check them.

[miekiemoes]

Hi,

If you don't mind, can you only post the FPs where you are certain they are FPs? Because it doesn't mean, because the major vendors don't detect them, but we do, that it is an FP. We don't mind to doublecheck them again, but we rather want to spend our time in analysing the load of actual malware samples we receive daily, so detection for these can be delivered faster.

Thanks

[siketa]

I understand your POV but I am not an expert or malware analyzer.

How can I recognize or be sure if something is FP or not?

[siketa]

For example:

If you would have a file that only MBAM and one or two less-known vendors detect, what would you think about it?

Take first file in this submission.

It is detected by MBAM and Kingsoft.

BTW, Kingsoft is known to have lots of FPs.

Well.....is it FP or not?

[miekiemoes]

The files you submitted earlier were real old files and mainly asian files. Some vendors may have not received them or didn't bother to add detection since they are old.

Other than that, we try our best to add detection where needed (and avoid Fps).

[siketa]

I hope you do bother to add detection for older files. Malware is malware. It doesn't have to be downloaded from a web page. It can silently sits on my removable drive, CD or NAS.

And I want my antimalware product to detect it, no matter hiw old it is.

In the same way, FPs should be fixed.

[nosirrah]

I hope you do bother to add detection for older files. Malware is malware.

This simply is not true and this notion is the result of corrupt AV testing over the years. What the AVs wont tell you is that a huge chunk of their DBs never hit anything at all other than samples in the corrupt tests.

The truth is that a legit malware sample will have real world statistical hits. If there are no hits IRL then the samples are not valid.

We remove definitions all the time that have no IRL hits for several years.

[siketa]

So, you are saying that downloaded and stored malicious file can not harm your system if you execute it after one or two years?

[siketa]

Ok....to make a long story short...

I will send you files considered to be possible FPs.

I'm not interested in guessing why other vendors detect something or not.

I have chosen you and your paid product.

And I just want to improve it and contribute as much as I can.

I did the same thing with Avira and Comodo.

You can re-analyze them if you want to or not.

It is up to you, guys.

[nosirrah]

So, you are saying that downloaded and stored malicious file can not harm your system if you execute it after one or two years?

Millions of scans around the world are done every day. If none of those scans see something for 2 years it is dead and defining it does not help our users.

You will notice that many of the largest security apps perform poorly against current malware. This is because they subscribe to the idea of defining everything forever. Their poor performance IRL against current malware confirms that this is a useless endeavor.

[nosirrah]

You can re-analyze them if you want to or not.

You do not understand how this works. A detected file does not mean that it was ever analyzed to begin with. For example if someone uses a cryptor to build their game trainer and that same cryptor is used to build loads of malware the trainer may be detected even though it was never the intended target. Poor choices when it comes to building an executable is the cause of most FPs. In reality it is common for 1 def to hit millions of malware samples, 99% of which we wont ever see in our actual lab.

In reality a lot of these will be analyzed for the first time and we may be able to make adjustments for these but it wont be at the cost of real world detection of real malware.

[siketa]

Thanks for detailed explanation of the situation.