41

First things first, I'm not asking this question because of any specific alarm on my PC that I suspect to be false.

It's just that from the perspective of the software industry, it would make some sense to implement false alarms every now and then, give paying users the wrong feeling that they really do need the antivirus software, and thereby keeping them paying for updates, even if there never was an actual threat on the system.

Are there any known cases of something like this happening?

Improve this question
18
  • 40
    You're probably looking for the term scareware.
    – Arminius
    May 18, 2017 at 19:12
  • 14
    one of my windows-using friends told be that some AVs detect all "keygens" and similar stuff as threats. it's probably not because all of them are full of malicious behavior, I assume it's because they get money for this from some proprietary software copyright holders.
    – Display Name
    May 19, 2017 at 4:36
  • 14
    When I worked for a major AV vendor, we had a data loss issue which we solved by setting our internal AV clients to scan for and alarm on any pieces of the data in question on our corporate workstations. It worked, and we managed to recover all the data we were after. Kind of fits your case... and is probably as close as you'll get to deliberate false alarms from a legitimate AV vendor.
    – HopelessN00b
    May 19, 2017 at 5:58
  • 10
    @SargeBorsch that actually has more to do with the way AV products detect malware than payoffs from IP holders. Cracks and keygens and such do actually behave like actual malware, so to prevent them from triggering AV alarms or warnings, they'd have to be deliberately whitelisted, which would put the AV vendor in an uncomfortable position from a legal and liability standpoint. The vendor I worked for didn't get any money from IP holders for triggering on cracks, but didn't want to get sued by IP holders for deliberately enabling piracy, basically... and that's the boat all AV vendors are in.
    – HopelessN00b
    May 19, 2017 at 6:05
  • 7
    While it's quite plausible that cracks have behaviours that may be similar to viruses, as it patches parts of another software, I don't see why a keygen would be confused with virus-like behaviour. All that a keygen does is make some calculations, some may collect hardware id, if the software uses hardware specific key, but that's pretty much it, AFAIK.
    – Lie Ryan
    May 19, 2017 at 13:38

4 Answers 4

Reset to default
35

The problem with deliberately triggering false alarms is that users will at some point lose trust in the AV software. The rates of false positives are also an important factor in AV rankings - and these rankings potentially influence users' buying decisions.

So legitimate AVs will probably offer you potentially unnecessary bonus features rather than pretending there is a concrete dangerous infection that can only be fixed with an expensive upgrade. (Software that constantly warns about non-existent threats would get into the realm of scareware.)

How important good detection rates are for an AV company's reputation shows the reported story from 2015 that Kaspersky employees had submitted mocked records to VirusTotal to trigger false positives in competing AVs:

Two former Kaspersky employees have accused the company of faking malware to harm rival antivirus products. They would falsely classify legitimate files as malicious, tricking other antivirus companies that blindly copied Kaspersky's data into deleting them from their customers' computers.

(Source)

That said, many AV companies have been criticized for unethical behavior. E.g., Symantec (the company behind Norton Antivirus) has been alleged of charging unapproved extra fees and pretending "remove" non-existent malware:

Symantec has been criticized by some consumers for perceived ethical violations, including allegations that support technicians would tell customers that their systems were infected and needed a technician to resolve it remotely for an extra fee, then refuse to refund when the customers alleged their systems had not actually been infected.

(Source)

Improve this answer
45

I have not seen false alarms, but I have seen an excessive amount of warnings/notifications, with Avast, for example. You could receive warnings about how vulnerable you 'might' be, and how you could fix it by buying another product or an upgrade (e.g. a VPN solution or web shield), every time you go on a bank website, pull up a login form, or click yes on any "18 or older" boxes. I'm sure there is a way to turn them off, but I believe that's one way they try to make the user feel like they need this software.

So it's not really false alarms, but a lot of warnings that might get non-tech-savy people to buy a license or another solution. Not a big fan of it, but it does help with awareness to some degree.

Improve this answer
5
  • 20
    Same happens when you try to turn most antivirus off, it starts screaming at you "You are not protected! You are vulnerable to viruses, malware, leprosy, and genocide! Please turn us back on immediately!"
    – DasBeasto
    May 19, 2017 at 13:37
  • 17
    it does help with awareness to some degree -- I'd argue it actually hurts awareness of security concerns. Because non-tech-savvy individuals buy the license/software/promised-miracle and then assume that's it, they're safe as can be and, most unforunately, that they don't need to practice any other good habits.
    – tonysdg
    May 19, 2017 at 19:00
  • 5
    Alternatively, you could view this as a "pay to remove ads" scheme. +1, though.
    – jpmc26
    May 19, 2017 at 22:41
  • 3
    @tonysdg Or conditions people to ignore such warnings - so when a more important one comes along, they ignore that, too.
    – Bob
    May 20, 2017 at 8:34
  • I had seen a lot of Avast false alarms when I have been learning C. Often I needed to add some dummy code in order to be able to run my compiled programs.
    – abukaj
    Feb 3, 2018 at 17:03
2

Any detection system has certain number of false negatives and false positives (see ROC curves). A good system has relatively few of these, but still any system may report a file as malware when it is not, or miss the true malware if well masked. A system tuned to be very reluctant may be too reluctant and miss the real threat.

Hence it will always be a certain number of false alerts over perfectly legitimate software. A false alert is not a proof that anti-virus software is sending alerts intentionally, and may even not be an indication that the tool is bad in spotting real threats.

Various kinds of fraud surely have been attempted also in the past, including "antivirus software" that only produces false alarms and does not actually look for any viruses.

Improve this answer
0

Yes. The EICAR Standard Anti-Virus Test File is a completely harmless file that anti-virus software deliberately detects as malicious.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The intention is to help testing if the anti-virus is works, and thus more benign than the scare-ware approach you're concerned about.

Improve this answer
1
  • 1
    OP is actually asking if there's any Anti-Virus that will just pop warnings of "Viruses" it caught without anything being there. As a way to scare people into buying it.
    – Black Magic
    May 22, 2017 at 14:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .