Avast: False Positive Much?

[CyberDruid]

After the Razer Trojan debacle a few days ago where only 7 out of 41 AV scanners found the exploit I decided to install Avast (one of the 7) and sure enough it found the Trojan in the DLed Deathadder driver, but now it has proceeded to find Numerous other Trojans in my archived collection of T-Mod .iso and .rar files (for modding DFI Bios). And in some patch files...so I have to ask: are these false positives? I have a hard time believing BIOS Medic (T) would put a trojan in his work. But maybe his server was compromised.

What do you guys think?

 

[[Ion]]

Almost certainly a false positive, Avast sometimes identifies various Folding@home cores as viruses, and it thinks my ISOs of XP Pro and Server 2008 (ripped from retail CD and downloaded from MSDN, respectively) are decompression bombs. I wouldn't worry about it, but if you think they might be viruses, go to VirusTotal and scan them

 

[oily_17]

Take a read here CD, it seems OK, Avast giving a false positive -

http://csd.dficlub.org/forum/showthread.php?t=1525

No Trojans Here:

I have had several PM's or posts regarding my DVD containing a trojan, There are no trojan's on my DVD.

The problem is most likely encountered when using Avast as it gives a false positive.

KillCMOS acts like a virus in that it wipes out the CMOS, Not destroying it but clearing it like no other method does.

So rest assured I would not place a trojan in my DVD.

 

[RejZoR]

In these days you can't really trust anyone's word without inspecting. Hacked servers with injected binaries, viruses that infect compiler resources (these are cool, programmers even slam digital signatures over them -> Win32:Induc virus) etc...

But if you suspect it's a false positive made by avast!, let me know and i'll inspect it.

 

[twilyth]

I guess it is using some sort of heuristics, which is good IMO. 0-day threats are too common to have to rely on database updates. The downside is that sometimes they are too aggressive.

Give Avira a try. It almost never gives a false positive and with Malwarebytes running too, I think I should get most shit that tries to slide by. You can use the full program for 30 days and the license rates aren't bad - especially if you get multiple licenses. I have a contract for 3 for 3 years and if I can get another cruncher up, I'll get another. I give extra licenses to friends who I know aren't sharp enough to worry about this for themselves.

 

[RejZoR]

AVIRA is very aggressive with it's heuristics and generic detections, so you can expect slightly more false positives with it.

 

[twilyth]

AVIRA is very aggressive with it's heuristics and generic detections, so you can expect slightly more false positives with it.

I disagree. I've been using it for maybe a year and a half and it rarely alerts me to anything that is a waste of my time. In fact I can't think of a single case. It does find quite a lot of shit in old files that I've archived when it does a scan, but they all look legit since they always tell me what the malware is. It's heuristics have only kicked in a handful of times and I have it on the highest setting.

But if for whatever reason you do get more than one or 2 false positive a month, you can customize it's sensitivity.

Malwarebytes on the other hand has given me false positives maybe 3 or 4 times a week.

I dl a lot of stuff. Not so much software anymore - maybe a half gig a month, if that. But I dl tons of video. Granted, a wmv file isn't that popular as a vector, but even so . . .