Author Topic: About multi-engine online scanners  (Read 2392 times)

0 Members and 1 Guest are viewing this topic.

Lusher

  • Guest
About multi-engine online scanners
« on: December 23, 2007, 12:12:55 PM »
Like lots of people, I use virustotal and similar sites to check stuff i download (at least those with small size).

The problem i notice with using so many antiviruses, is that the possibility of a FP increases - even if the chance of one fp for one scanner is low, when you have 32 "bites at the apple"..... (I heard some of them are set to maximum heuristics even which makes matters worse).

No matter what i upload, it seems that pretty much they will be flagged by at least 1-2 as suspicious or in some cases even a specific detection is given.

How does one then decide? Okay so maybe if you say 2 and they say heuristics or suspicious, AND you know the rep of the software is good you might ignore, but what about 4 detections? 6? 8?

Or does one look at what scanner is crying foul? Maybe you trust a detection if it by A rather than B etc..

What do you guys think?

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11863
    • AVAST Software
Re: About multi-engine online scanners
« Reply #1 on: December 23, 2007, 12:44:28 PM »
Yes, I'm afraid we are painfully aware of this situation.
Since almost every file is reported by some heuristics on VirusTotal as suspicious at least, we get all these samples from VirusTotal as "undetected".

Personally, I'd restrict the heuristic settings of the scanners significantly... but I guess their authors wouldn't agree  :-\

Offline bob3160

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 48647
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: About multi-engine online scanners
« Reply #2 on: December 23, 2007, 03:50:45 PM »
Heuristics with the wrong settings are an annoying cause of False Positives.
As Lusher mentioned, it becomes a judgment call which of these to blow off as smoke
and which warnings to treat as a possible fire.
My rule has always been "When in doubt, do without"
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v24H2 64bit, 32 Gig Ram, 1TB SSD, Avast Free 24.4.6112, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet