What's new

Welcome to StoreFront Forums

Join us now to get access to all our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, and so, so much more. It's also quick and totally free, so what are you waiting for?

Ask question

Ask Questions and Get Answers from Our Community


Answer Questions and Become an Expert on Your Topic

Contact Staff

Our Experts are Ready to Answer your Questions

TUTORIAL Viruses: Addressing False Positives


Forum Admin
Staff member
Trusted Uploader
Aug 21, 2021
Reaction score
Genesis Forum

Not every file an antivirus program flags is malicious. Even clean files can be flagged as a virus if they behave like viruses in the eyes of antivirus programs.

Basically, antivirus programs use two methods to identify a virus. These are Heuristics and Signature-Based Methods.

Heuristics Method

The heuristic or behavioral analysis method is regarded as a better antivirus program than its counterpart - the signature-based program. Unlike the signature-based program, it doesn't rely on bytes pattern previously catalogued as a virus. In other words, it doesn't rely on signatures or already catalogued bugs.

It instead relies on the behavior of a file. If the file possesses any behavior of a vulnerable class like Cross-site Scripting (XSS) and SQL Injecting, it immediately flags it as malicious. This is great and this quality makes it better than the other method.

However, even this is not perfect. Actions, which are not malicious, may be faulted as malicious simply because they "behave" like a malware. In other words, files that use identical compression and protection techniques the viruses use risk being flagged even though they are clean.

Signature-based Method

This method relies on signatures of previously catalogued malware to decide whether a file is malicious or not. Its database is updated frequently with signatures of previously declared viruses. This means it can't detect a virus if there's no signature of its (the virus') kind in its database. It also means it can erroneously catalogue a clean file as malicious if it identifies any suspicious signature. This is because Signature-Based Programs don't run additional security checks to verify. It just only relies on a flawed system - checking file paths and structures, version details, and version, making this method more prone to reporting false positives. Examples of Signature Based Programs are WPScan and Nikto.

What Next?

The VirusTotal.com website is a great place to scan your files as it uses a wide variety of different antivirus programs to scan for viruses. To be on a safer side, experts recommend that after the scan, if some of the programs flag your file as malicious, then it's better to dump it (the flagged file).

However, if most of the programs are okay with the file, then you may go for it.

If only one or two programs flag the file, then it's probably a false positive.

But all this isn't a guarantee. Nothing is 100% guaranteed. That's why you should consider the source of the file.
  • Like
Reactions: Dan
AdBlock Detected

We get it, advertisements are annoying!

Sure, ad-blocking software does a great job at blocking ads, but it also blocks useful features of our website. For the best site experience please disable your AdBlocker.

I've Disabled AdBlock    No Thanks