False negatives versus false positives

[polonus]

Hi malware fighters,

False negatives are more dangerous than false positives are. A false positive means that the signature of certain malware has been found, but the data in the file have nothing to do with the real malware.
When signatures check for certain sequences that are also commonly found in normal files, you tend to have a lot of false positives.

The opposite is a false negative. The scanner scans a file against all its signatures. Nothing is found, but the file scanned has a virus inside, a real virus. This is a false negative.

What to do. Look at the file that has been triggered, then look at the description of the virus activities, see if that fits what is happening in your machine. Upload the file to jotti or virustotal,
and check the file against DrWeb's pre-hyperlink scanner.

polonus

[bob3160]

The opposite is a false negative. The scanner scans a file against all its signatures. Nothing is found, but the file scanned has a virus inside, a real virus. This is a false negative.

If your AV system doesn't detect it, how would you know which file to forward onto jotti or virustotal??

[neal62]

Hi Polonus,

Very interesting. Guess there is always going to be something new on the Internet to worry about. Have a nice day. 

[polonus]

Hi friend neal,

It is not that you worry about a thing, but it is that you are fully aware. If you know what you're up against, the worrying stops. Don't worry, be happy!

polonus

[FreewheelinFrank]

The opposite is a false negative. The scanner scans a file against all its signatures. Nothing is found, but the file scanned has a virus inside, a real virus. This is a false negative.

If your AV system doesn't detect it, how would you know which file to forward onto jotti or virustotal??

If it arrives in your junk mail folder, it's usually a pretty safe bet it's malware:

http://forum.avast.com/index.php?topic=20319.from1144228463;topicseen#msg170285

[Dwarden]

Well avast still have problem with adding lot of trojans , malware or spam worms "in time" ...

not so critical but tell that user who got infected ...

[polonus]

Hi Dwarden,

Therefore we have addidtional in-browser protection, like the DrWeb pre-hyperlink plug-in (very frequently updated, second only to Kaspersky's). Then you could always scan with the free on-line scanners once in a while. I just did a complete file by file scan with Bitdefender 8, very thoroughly. There is stinger.exe to close the vulnerability window. There is even a frequently updated non-resident open source scanner. To just completely rely on one virus solution is just living too easy on yourself.

polonus

[rdsu]

They are both very bad for an AV and us!!!

[CharleyO]

***

Somewhere in this forum, I once posted that I would rather have false positives than false negitives. It is always better to be warned about something that is not a threat than to not be warned about something that is a threat.   


***

[Dwarden]

Hi Dwarden,

Therefore we have additional in-browser protection, like the DrWeb pre-hyperlink plug-in (very frequently updated, second only to Kaspersky's). Then you could always scan with the free on-line scanners once in a while. I just did a complete file by file scan with Bitdefender 8, very thoroughly. There is stinger.exe to close the vulnerability window. There is even a frequently updated non-resident open source scanner. To just completely rely on one virus solution is just living too easy on yourself.

polonus

polonus
I'm sorry to say that but sometimes You sounds like guy trying sell me something (don't take this as offense anyway i just mumble

thing is your DrWeb plugin usage is limited (size,speed,online) it needs manual trigger but also limited to single engine (one firm opinion)
not to mention non english/russian users dislike use such addons too (need to translate that extension on FF but what about IE owners) ...

free or not free (paid) things are moving toward that one or two products can't protect You enough ...

You need 3,4,5 or even more to get the 99% security and yet there will be still IF
not to mention even if You have 20 of these AV/AT/AS/FW products You still can missing something

tons of "all of sudden" appearing products can be in fact "smoke" cover for spyware and malware authors ,
it can work some months, year or two fine but then "it miss" something ...
if that was on purpose or not You hardly notice ...
typical example is Lavasoft company and theirs products ... i simple don't trust them enough anymore...

that's why i can live with some additional false positives from old trustable programs (or "suspicious" alarms) instead of no warning at all
that's my biggest gripe about Avast! delays on some detections not being added for weeks/months
(for now i trust Vlk and Pk it's worked on)...

[CharleyO]

***

free or not free (paid) things are moving toward that one or two products can't protect You enough ...

You need 3,4,5 or even more to get the 99% security ......

We've been past that stage for at least several years.   
It is just that the majority are now beginning to realize this fact.   

I've had no less than 4 security programs on my computers for the last 6 years.

(Unfortunately, the first 3 of those 6 years involved first Norton and then McAfee. I was not protected enough in those 3 years. After that, I finally found Avast!)   


***