Dateiliste

Virus scanners are software developed and configured by humans. As it is with all software, every virus scanner has bugs, and every virus scanner reports certain files at some point as being infected with a virus, worm, trojan, or malware.

This is unfortunate inevitable fact.

When the virus scanner pops up with an alert message, most users have no choice but to trust the scanner at once. However, suspicion is well placed in many cases. Ways too often the threatening scanner alerts are so-called false positives.

Admittedly, it is not always easy to tell the difference between wheat and chaff.

If you haven't heard of it yet, there's a web page that helps distinguish between clean and infected files: VirusTotal (http://www.virustotal.com).

VirusTotal offer a free service to scan suspicious files online.

With all these scoundrels out there It's probably also important to mention that this is a legitimate and reputable web site and certainly doesn't belong into the usual "Free Virus/Malware Scan! Here! Only 39.99 Today!" rip off pages. Using VirusTotal is free, doesn't require registration, and is accepted by AV manufacturers as a reference.

The benefit of a scan at VirusTotal is that it is not just run through one single anti virus product but rather a whole range of scanners from all sorts of AV companies.

It also creates permanent static internet links to previous scans. These links can be very useful when reporting a false positive to AV vendors.

Example:

URLProtocolView is a piece of software from NirSoft. It displays a list of all network protocols configured in Windows.

From time to time the program is reported as either being infected with a virus or treated as a hacking tool. Both assumptions sound quite unreasonable, considering all the software does is displaying the contents of a few registry keys and values.

Uploading the file to VirusTotal proves us right. This is the scan result from 2009-12-14:

http://www.virustotal.com/analisis/34cbe52cc935e4012ed97a2e002d22dd6f75f5860d94adbe7fbca13cde26ab73-1260784983

Ho to use VirusTotal:

1. Go to http://www.virustotal.com.
2. Browse for the file you'd like to test.
3. Upload.
4. Wait for the scans to complete and view the results.

Of course, just because neither of the scanners at VirusTotal finds suspicious software in an uploaded file, that does not necessarily mean it's "clean". However, if only one or two AV products report the file as being infected, it is more likely that these scanners got it wrong. It is also not recommended to use the web page as a replacement for anti virus software.