-2

I just scanned another installer/EXE with VirusTotal. I've come to depend on this crappy service owned by the evil Google, in spite of its ambiguous messages and extremely confusing interface, because I don't have any other choice.

But I never feel confident about the result, especially not when some engines DO detect malware:

https://www.virustotal.com/gui/file/2c70ef057e6810f0b848bc6bac2df216d711c97699d67fb76f144230532472e7/detection

"F-Secure" says it's "Trojan.TR/Dropper.Gen", for example. Why would it say that? What makes it falsely (?) report that when other vendors say it's clean? Does this mean that if I were running and paying for "F-Secure", I would sit there with warnings on my screen and it would not allow me to install the program without jumping through hoops?

And "Cynet" says "Malicious (score: 85)". So it's 85% sure that it's malware? That makes me 100% unsure about it.

I find that my "Windows Defender" virtually never reports that anything is malware. I don't know if that's a good or bad thing.

Maybe I should stop using it entirely, because I never really trust the results or know how to interpret them. Sometimes, many/most report malware even though it doesn't seem to be, for example Bitcoin Core downloaded from the "official" website(s).

I don't understand how any "normal" person could ever have any use of anti-virus software and VirusTotal, because I'd likely be considered a "poweruser" with decades of computer experience and many years of worrying and trying to desperately figure out how to stay secure, and "even" I feel absolutely lost and essentially must blindly trust that it doesn't contain trojans and spyware.

(Let's not get into the topic of Windows 10 itself...)

PS: I'm aware of Qubes OS, but it has too many technical and practical problems to be seriously considered for somebody like me who only can fit one physical computer in my limited living space.

3
  • 3
    This reads a bit more like a rant than a question. Having read it, I'm not even really sure what your question is, other than "What does this message mean?". If that is your question then I would suggest checking with VirusTotal or looking through their support/FAQ. Sep 1 '20 at 17:52
  • 2
    Welcome to the world of false positives and false negatives,where everything can be a malware.
    – yeah_well
    Sep 1 '20 at 18:03
  • 4
    I’m voting to close this question because most of the content is a rant. And the rest is based on a wrong assumption on what Virustotal provides and how reliable the results of antivirus are in the first place. Also there are similar (but more focused) questions here about how to interpret results when few AV claim to have found malware but most others not. Sep 1 '20 at 18:31
1

If it's a legitimate Windows software program, then it should be signed by the publisher using a Microsoft Authenticode certificate. Signing certificates can be purchased relatively inexpensively from many of the same CA's that issue SSL certificates, so there is no reason that even a small software development company would not have one.

If the installation program was signed using a valid Authenticode certificate, Windows will show show you information information about the signature (including the same of the publisher, etc.) when you run the installation program, and give you a chance to confirm. This also confirms that the installation program hasn't been tampered with since it was signed. If installation program hasn't been signed, or if the signature is invalid, Windows will warn you. In this case, if you choose to proceed, you are doing so at your own risk.

Added Sep 2, 2020: As pointed out by K4M and Steffen Ullrich in the comments, there have been a number of code signing CA's that have been compromised or coerced into issuing fake certificates appearing to belong to legitimate companies. This has resulted in malware appearing to have been signed by these companies, but in fact signed using these fake certificates. Therefore, it is not enough to simply check that the program has been signed, you must also check that the program has been signed using a certificate has been issued by a reputable CA. Code signing certificates are no different than any other PKI model - a chain of trust is necessary, as Steffen Ullrich so eloquently points out in the last paragraph of his answer at Can SSL certificate (domain verification) process be eliminated?.

8
  • I am not sure this answers the question, because malware authors can also buy (or steal) code signing certificates.
    – David
    Sep 1 '20 at 22:18
  • @David True, but for that matter, the same can be said about SSL certificates for securing web sites. To buy a fake cert, the attacker would have to compromise or coerce a CA (which is rare, but it has happened, e.g. Diginotar). Stealing a cert is of no use to the attacker without the private key (certs are public anyway).
    – mti2935
    Sep 1 '20 at 22:39
  • This can help with user carefully reviewing the cert (the domain name in the cert, which CA issued, etc.). But, it will definitely NOT help in case of the vendor being breached. Example CCleaner in 2017 blog.talosintelligence.com/2017/09/…
    – K4M
    Sep 2 '20 at 2:51
  • @mti2935: From Understanding Code Signing Abuse in Malware Campaigns: "There is an entire market supporting the operations of malware operators that have gained access to valid certificates that are then used in signing malicious software. In our analysis, we observed a large number of malicious software that have been signed by trusted authorities — bypassing any client-side validation mechanisms built in recent OSs and browsers.". Sep 2 '20 at 7:08
  • I dont think this answers the question.The questionis more about reading virus total scan results/Figuring out if an exe is malware or not.What you have wrote is "just look if it is signed or not" which is not an indicator of anything.
    – yeah_well
    Sep 2 '20 at 8:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.