[ToXiCaTioN.d]

All my protection programs don't detect a file with viruses within on my computer. I get a lot of spam in my inbox and I tend to follow them, safely, seeing if the programs have viruses. I also like to test my system to see if it picks up the viruses.

I downloaded a file called Watch, to watch online movies (ahaha, not). The virus total virus scanner(s) record shows me this:

http://www.virustotal.com/reanalisis...d1b8a1fc86b528

I use ESET, Spybot Search and Destroy and Windows Defender. Windows Defender is on virus total, and appears to have detected something in this file. Although, on my computer it doesn't detect anything. My definitions are up to date and vaild. I have also tried a scan with Kaspersky and it came back positive, although on Virustotal it has came back negative.

I'm really wondering what is going on. Why isn't any of my protection programs not doing anything? I have also tried it on a different computer with the same software and again no go.

What's going on?

[lunarlander]

There can be discrepancies between antivirus vendors. It all depends on whose signatures you trust. And there can be false positives sometimes.

To balance it out, you can try ThreatFire, which is a heuristics behavorial antivirus. It detects malicious actions, and its not signatures based. It is designed to compliment your existing signature based antivirus solution.

[ToXiCaTioN.d]

So Virustotal uses different signatures than I do? Wouldn't they have to make their own signatures for the antiviruses? And isn't that illegal?

[Byteman]

Hi,

At the Jotti online one file scan, they update fast:

"Virus definitions are updated every hour" and VT probably works the same.....

You may have set the detection level lower....to "pass" certain types of files, that the online scanner gives a hit on.... we have no way to tell, but the online scanner may be set to a higher level, so it does return false positives. (I've seen it the other way round, where an installed program detects something, and the VirusTotal or Jotti site does not indicate anything wrong...we use them often to try and narrow things down)

There are different levels of the scanning engines that are used, and your version though it is the same program, may be behind the online scanner's which may have changed a bit.


If you can, copy and paste the text showing filename, and location, and what the scanners told you about the file

And I don't think lunarlander meant that the site uses different signatures or methods.... the site uses the scanning engines of many of the best security programs, and they are supposed to be exactly what is used on local computers...but, they may be set to higher sensitivity, or be a newer engine than you have.

There's also the complexity between actual virii, and other types of malware....some scanners do a better job than others at detecting it accurately. Some antimalware programs include all types of malware and may confuse the user, who thinks it's a virus... security programs are in fact changing a lot, and we are seeing new versions putting up a lot of false positives.

All of the above, is just the way I figure it....