1

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. How common is that and if it is too common, can we really rely on them?

Along with that, how easy it is to corrupt an antivirus?

3
  • 1
    "how easy it is to corrupt antivirus" - what do you mean with this? Disable antivirus by malware, hijack antivirus by malware to execute code, confuse antivirus by the user due to bad user interface or even something different? Aug 21, 2019 at 14:39
  • by corrupting I mean to make it stop working correctly, and yes, hijacking would be the next level.
    – Irfan
    Aug 21, 2019 at 15:30
  • Irfan, do you have any statistics to back that the often trigger a false alarm? I cannot think of many of those alarms during the last 10 years, and in such cases I always used the exception list feature to add the files in question. I think virus scan vendors to a lot to prevent too many false positives. Also, scan databases are normally signed with a private/public key so you cannot easily fool the virus scanner. In the end, disabling it is the best way to stop it working. There are a lof of infections that were successful with that.
    – flohack
    Aug 21, 2019 at 15:49

6 Answers 6

2

... Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that

There are detailed tests at https://www.av-comparatives.org/testmethod/false-alarm-tests/.

The results differ between vendors and time but on average can be said that the higher the detection rate (true positive) the higher will be the more false alarms will be triggered (false positive). This is because only parts of the malware is detected by clear signatures, the rest is detected by heuristics which will never be perfect.

These heuristics (or machine learning models) are tuned by the vendor for some specific balance between false positive and false negatives rate. False positives will confuse the user. If there are too much the user will disable the detection completely. False negatives (malware not detected) on the other hand will have a serious security impact too. And models or heuristics can usually be tuned how much false positives and negatives they produce - only the less false negatives they produce (i.e. the more malware they detect) the more false positives they will also produce (i.e. the more innocent files will be detected as malware).

... and if it is too common, can we really rely on them.

There is no true yes or no. If you mean with "rely on them" that you blindly believe the results then no. If you mean with "rely on them" that the AV results are true in most cases then then yes. You are not totally safe from malware if you install an AV (or use the existing AV built into Windows) but the average user is usually much safer than without an AV.

... Along with that, how easy it is to corrupt antivirus.

Not trivial but possible for a determined attacker with enough knowledge and time. In the past there were several cases of AV being vulnerable to code execution attacks, often due to errors in parsing (deliberately corrupted) files. This was especially bad since many of these AV did there analysis as system user. Bypassing AV instead by hiding the malware so that the AV cannot properly see it, is much easier though.

1

As a software developer, I can confirm that false positives happen a lot.

I produce a very simple piece of software (less than 200 lines of code) but because it is compiled from Python and involves outgoing network connections it frequently (ie always) gets flagged by antivirus as malware.

Each time I compile a new version (even a tiny minor upgrade) Virustotal will show it as flagged as malware by between 2 and 10 antivirus products. This is despite paying for a signature which I use to digitally sign the executables.

Fixing this as a developer involves submitting the code to each antivirus provider and asking them to review it and whitelist it as a false positive.

Lots of them have really easy and organised processes to submit this and are very pro active (Microsoft and Malwarebytes generally fix within a few hours) but some of them are super painful. McAfee only accepts submission by email and has a bunch of different similarly named virus products which are difficult to work out.

Some distributors require a completely clean scan on VirusTotal which means that even if 69/70 virus scanners deem it clean you need to track down the one random Chinese antivirus provider who has a problem with it, and needless to say only has a website in Mandarin, to try to submit a ticket asking them to fix it.

Even once you're whitelisted that only applies to the specific executable. Want to add an installer option as well as the simple executable? That's new code so you need to whitelist with everyone again. Someone needs it to be distributed as an EXE inside a ZIP rather than just an EXE? Well it's likely that the ZIP will trip someone's algorithm even if they have judged the EXE clean.

It's a real, real pain and honestly puts me off adding new features to my code or releasing new versions. I often spend more time firefighting false malware positives on code than I have on writing the code itself.

0

You can probably feel yourself how common the false positive alert can be with VirusTotal.com.

Compile Some Window User form project built in DotNetFramework.

Then obfuscate the code in the project with confuserEx or some other obfuscator.

Now go to Virus total.com and run virus scanning

https://www.virustotal.com/gui/

You will see 2 to 30 AV software raising false positive alert among 70 AV software vendor.

Not having any single harmful code inside the file, this is pretty high false positive alert rate.

It is best to try yourself and see the results with your own eyes.

In my finding, more you obfuscate your code, you will get higher the rate of false positive alert. From my experience, this was even the case, when your project consists with buttons, textboxes, radio buttons, and some mathematical calculation only.

-1

This is one of the major issues faced by antivirus programs. They can give false positive to anything you can possibly think of, apart from the most famous programs and sites.

In fact, they are some examples when some antivirus programs detected the most trusted sites as malware. Also, they can be corrupted and hijacked as well. A few years back this was easier, but now there have been some improvements in the security flaws.

-1

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected.

You say often antivirus programs triggers a false alarm. You said correct answer by yourself already. In fact, how you feel is correct. Anti Virus software triggers false alarm (aka false positive) frequently. That is probably how most of us feel.

My question is that how common is that and if it is too common, can we really rely on them.

In fact, many anti virus software are based on similar heuristics. They do make a lot of mistakes raising false alarm for genuinely good and safe software. If you are looking for statistics, then it would be hard to find one. First reason is that Anti virus software company does not feel comfortable to share such information because it would affect the sales for their anti virus software. You will also find that any negative post about anti virus software is removed from site too even if they are the honest opinion.

Even if you find such statistics, in my own opinion, testing results seems to be far from how we feel from everyday usage of anti virus software. From below link, you will find what anti virus software expert says about the accuracy of anti virus software. According this expert, anti virus software is only accurate around 45%.

https://www.theguardian.com/technology/2014/may/06/antivirus-software-fails-catch-attacks-security-expert-symantec

It means anti virus software is correct at 45% and they are wrong at 55% of time. This is not a direct answer to your question. However, at least, you could figure out some ideas on the frequency of false positive based on this 45% accuracy of anti virus software.

Along with that, how easy it is to corrupt antivirus.

I do not understand your question fully. I rephrased your question like:

"how easy it is to test antivirus false positive at my own computer at home."

I will try to answer. In fact, you can do some simple experiment.

  1. Just create some simple windows form application using c sharp or any other language.

  2. Then use confuserEx or other software to obfuscate to the highest level.

  3. Next, scan the windows form application from virustotal.com.

Then you will see the false positive alert over 90%.

3
  • You can't take the finding from 2014 that AV "misses 55% of attacks" and then make any kind of conclusion about the false positive rate. That entire section of your answer is faulty. And no, your interpretation of the "corruption" question is not correct. Irfan explained what he meant in the comments. So, that entire section doesn't apply. And an AV alerting on the use of confuserEx is not a false positive. It is the job to alert on obfuscated binaries. They will even say that the binary is obfuscated, not that it is confirmed to be malicious.
    – schroeder
    Sep 29, 2021 at 14:59
  • And if you read the other answers, you will see that there are public tests on flase positive rates. So the first part of your question isn't correct. I think you need to rethink this entire answer.
    – schroeder
    Sep 29, 2021 at 15:00
  • If AV software honestly tell that the AV software does not have the ability to tell the obfuscated binaries is virus or not, then it should be fine. But AV software always label the most of obfuscated binaries as Trojan or some other virus type. That is inaccurate detection lowering the reliability of AV software but no AV company correct that. That is the big problem. Check on virustotal.com with some genuine safe application but obfuscated binaries will be often raised as Trojan or other virus. If this is not false positive, then what is false positive ?
    – auto9817
    Oct 20, 2021 at 12:02
-3

This small program is triggering 5 AV scanners:

int APIENTRY WinMain( HINSTANCE hInst, HINSTANCE phi, char *CmdLine, int CmdShow )
{
   return 0;
}
2
  • I think he wants to proof that even this harmless code can trigger an AV Sep 7, 2022 at 18:29
  • 1
    I'm not sure this is useful. There are dozens of AV. Which ones trigger? What techniques do they use? Are they signature-only? The fact that this code creates flags isn't very interesting without context.
    – schroeder
    Sep 8, 2022 at 7:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .