Tech Support Guy banner
Status
Not open for further replies.

Best way to determine if it's a false postive?

26K views 11 replies 4 participants last post by  GreggIllinois  
#1 ·
Cookiegal has already been helping me with this (thanks!) but I still have questions.

I just want to get this yWriter6 writing software. http://www.spacejock.com/yWriter6.html Here's the VirusTotal on the .exe from the Zipfile download for Linux:

https://www.virustotal.com/gui/file...file/c3c48ba7e71c922a16fdcb2e74ff2fea00c952a92da74fa72b2810a5c1ec10cf/detection

Trapmine (the AI scanner) came up with this: Suspicious.low.ml.score

Here's the VirusTotal on the Windows .exe file:

https://www.virustotal.com/gui/file...file/da2fcd7b3e8ee6028066d2449cbc6629cbaaebe7c3607954d713cefcd3a57ae5/detection

Trapmine came up with this: Malicious.high.ml.score

And the Zipfile for Linux produced this VirusTotal outcome:

https://www.virustotal.com/gui/file...file/44cdcd674b533d24438391e744c0b8184eec722ec583a1609f82be8d06f5dbbd/detection

On this, bkav came up with: W32.HfsIemusi. Which a friend linked me this as it possibly being dangerous on Windows (despite it being the Linux download): https://www.microsoft.com/en-us/wds...wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Floxif&threatId=

I don't know what to do. Like I've been told here: consider the source and use VirusTotal.

A lot of writers use this yWriter6 software and no one complains about viruses. But seeing these potential malwares in red (and having had a virus in the past) spooks me.

Four questions:

1) With their being no guarantees, does this yWriter6 look safe to download? (I won't hold anybody to anything.)

2) Is hybrid-analysis.com good/safe to use in addition to VirusTotal? https://www.hybrid-analysis.com/

3) Any other suggestions about how to make a rational decision when VirusTotal turns up just one detection in a scan?

4) How to determine if something is a false positive or not?

Thanks
 
#2 ·
Most virus scanners (I'd say nearly all) focus on Windows-based software. Results for Linux based software could very easily come up as false positives simply because what the scan engines are looking at is not what they think they're looking at under typical circumstances.

Viruses and malware, while not absolutely absent from Linux environments, are also not nearly as common as they are in Windows-based PC environments.

When well-known software (regardless of OS platform) becomes infected, and it has happened, but rarely, word spreads like wildfire in the tech press and on forums such as these.

For Linux based programs of wide renown unless there's some online chatter about an issue I would assume safety. I assume safety for that matter for Windows-based programs of wide renown sourced directly from their makers, though virtually any security suite will scan the exe or msi installers when you download them anyway. You can always run a VirusTotal scan afterward if you want to be really, really careful. But it is not unusual for the odd scanner or two to flag something that the majority of the scanners don't. When the odd few scan positive and the majority come back with a clean result, I always presume false positives on the part of the odd-scanners-out.
 
  • Like
Reactions: GreggIllinois
Save
#7 ·
The file is not signed but Spacejock holds a copyright on it.

I'm not familiar with hybrid-analysis.com so I can't comment on that.

It it were me and I really wanted that program I'd probably go for it but as I said before there are no guarantees.
Thanks Cookiegal. I'm going to download it tomorrow morning. I appreciate all your help.
 
#8 ·
Thanks Johnny. But then how would I determine if the software was clean or not? Would it be just if it started showing signs of dysfunctionality or my anti-virus flagged something? I've been looking at it and it looks really good but I'm wondering if I really need it for this.
 
Status
Not open for further replies.
You have insufficient privileges to reply here.