4 ms·
> Each time that a popular AntiVirus software begins to detect one of my utilities as Virus or Trojan, my email is flooded with messages from worried people tha
by snarfy 9y ago
> Each time that a popular AntiVirus software begins to detect one of my utilities as Virus or Trojan, my email is flooded with messages from worried people that think my Web site is infected with Viruses. Some of them even blame me that I spread Viruses through my Web site.
I wonder if there is a defamation/libel type of lawsuit here. Anti virus vendors are making false accusations.
- petecooper 9y ago>I wonder if there is a defamation/libel type of lawsuit here. Anti virus vendors are making false accusations. Some (many? most?) will report these applications as 'potentially unwanted applications' (PUAs) and sidestep the issue of blame or malicious intent, often asking the user if they want to proceed rather than just denying access. Source: former Sophos employee.
- CWuestefeld 9y agoMy employer's security team, in their infinite wisdom, is entirely blocking access to the NirSoft site.
- petercooper 9y agoI wonder if there is a defamation/libel type of lawsuit here. If that would ever fly, I want to take action against mail servers that tell me my mail is "spam" when it clearly isn't and was double opted-in by their users :-D
- digi_owl 9y agoGoogle seems to have a habit of dumping directly to spam emails from any domain they do not recognize. Or at least i have seen some complaints bouncing around certain mailing lists in that regard.
- deleted 9y ago[deleted]
- woolvalley 9y agoviruses may use the tools to achieve things, which creates an association
- neko_koneko 9y agoMalware authors often incorporate legitimate software into their malware - e.g. Nir Sofer's Mail PassView and Web PassView are used in Emotet spam bot to harvest user credentials. Usually such files are marked as "Potentially unsafe software" by analysts, or in some cases could be detected as part of a malware family by AV companies' automated detection tools.
- digi_owl 9y agoAnother thing is that actions malware take and actions legitimate "power user" software takes are separated only by context. Thus automated behavior analysis is always going to produce false positives.
- voltagex_ 9y agoIs there much behaviour analysis done by consumer AV? Even Defender seems to be mostly signature based.
- neko_koneko 9y agoYep. Malware is constantly repacked/encrypted. It is impractical/impossible to write static unpacking engines for every type of malware packing technique, so behavioral analysis engine is a must (btw, behavioral engines still detect malware using signatures).
- rurban 9y agoSame for psexec and xexec for remote execution.