But how do you *know* it's a false positive ? I recently read one post
where someone said that AVG detected a Trojan in a program they'd
downloaded...and some person replied that they should ignore it because
it was a false positive ! How the hell did *he* know this ?
There are two ways most Antivirus programs can trigger - one, they think
they recognise a file as being a particular virus; or two, they think the
file has content similar to that of other viruses. I'll talk about each of
these seperately.
Where a package finds that a particular file might be a Virus, it does so
because part of the computer code contained in that file matches what the
antivirus program has on record as "characteristic and specific" to that
particular variety of that particular virus. The AV packages can't contain
the whole of the virus code - besides being dangerous and potentially
educating people in how to write viruses (there's more than enough help out
there anyway for that), it would make the signature files absolutely massive
and therefore impractical. So the AV researchers locate something unique to
that particular virus and just look for that code when they scan a file.
Because this is a limited slice of the whole virus, there is always the risk
of a virus "identification" being a false positive. For this reason, most
antivirus programs "quarantine" affected files rather than deleting them
outright - that makes it easier to recover from.
I don't trust googling per se, there are too many people posting info they
don't actually know. There are a couple of sites that are reputable, though,
and if I see one of the links provided by Google as coming from a site that
I recognise and trust, I will look more closely at that response.
It's generally the case that if you get a false positive from one anti-virus
package, you are unlikely to get the same result from a second. That's why
the "scan a suspect file with multiple anti-virus packages" link is so
useful.
The big problem with scanning for viruses this way is that only a known and
identified virus can be stopped. All the virus writer has to do is switch a
couple of things around within the file, and you have a new version of the
old virus - one that may not match the "signature" that the AV program has.
In fact, they can keep trying until they successfully make a variant that
stops the AV from identifying the virus.
To stop this, and give the customers on the firing line a chance to discover
a new virus BEFORE your system is infected, some AV programs also look for
"suspicous characteristics" - this was described fairly well in a seperate
post, so I won't repeat it here. If a file matches too many of the criteria
that are common to viruses, the AV program will report that "file X may be
infected with an unknown virus" or something similar.
When this happens - and it has happened to me - there are three steps that I
follow (and double clicking on the file is not one of them!)
1) work out how long you've had that file - if you've had it for 6 years
it's very unlikely to be a genuine virus (or you would have found it by now
with previous scans). I would treat it as a false positive and test the same
as I would any other "virus warning". But, if it's a new file, you don't
have that safety net - even if the file itself is supposed to be 6 years
old, if you've only just downloaded it, it's new and potentially a problem.
And so to step 2.
2) Visit the major antivirus sites and look at the news section - they will
all have them. If there is a new virus doing the rounds, they will usually
tell you all about it - definitively and quickly. There usually is one, and
if so, I compare the characteristics reported - like filename, file size,
etc - with the suspect file. If the details match, then you know that you've
just been saved by you AV program, and act accordingly. But what if the file
doesn't match any of the new viruses reported over the last week or two?
Does that mean that it's safe and the warning can be disregarded? Not on
your nellie! It's on to step 3.
3) There's always someone in the world who will be the first person to
notice a new virus. SOMEONE has to be first, and it might just be you! Most
AV companies will provide a link or instructions for uploading a suspected
virus so that their scientists can take a look at it. Unless the file is
supposed to contain information that has to be kept secret or private, like
payroll info, bank details, confidential memos, and the like, Send it to
your AV company and let them check it. I've done that three times - two were
false positives, and the other was indeed a new virus. (In fact, I was the
third person to report the suspicious file to them, world-wide). Once you
know, you can act.
Antivirus companies love to discover false positives, because they like to
eliminate them, if only to save their researchers time and themselves money.
The more time that gets wasted on the umpteen hundredth report of a false
positive, the less time they have to devote to real viruses. So even if
you're sure it's a false positive (from steps 1 or 2), send it to them
anyway, and in an update or three it should stop being detected. And you'll
have that knowing look about you for quite a while!
Someone here reading over my shoulder as I type has asked how I would deal
with a situation where I got a possible virus in a file that DID contain
sensitive information - payroll info or bank details or whatever. So, for
what it's worth....
Anyone receiving that info either has no business receiving it and deserves
whatever they get, or they have received it legitimately. If you're in a
position to receive that sort of information legitimately, there is usually
an IT security contact you can report to. DO IT. Then, get the person who
sent you the file on the phone. Warn them that they may have a new virus on
their system. Get them to send you a file of the same file TYPE without any
of the sensitive info, immediatly. If they really are infected, the same
Heuristic Analysis that warned you in the first place SHOULD react to the
file without the sensitive content in the same way that it did the first
file. If it does, then you have something that can be safely sent to the AV
company for analysis. By the time you are ready to do so, you should have
heard from the IT Security department. Bring them up to date on what you
have done, and ask their permission to send the safe file to the AV company
for analysis - they may well want to do it themselves. Either way, you
should get significant kudos for intelligently handling the situation!
Mike Bourke
