It is not uncommon that an antivirus or anti-malware software program has a f/p (false/positive) detection in a scan. In the event a file that has been on your computer for some time suddenly turns up during a scan, the first recommendation is quarantine rather than remove. If it is a f/p, the file can be restored from quarantine but not easily replaced if deleted, particularly if it is a critical system file.
How can you determine if the detection is a f/p? There are various vendors that provide free on-line computer scans but, in this case, we are looking at one particular file. Among the many services Virus Total provides is the ability to navigate to a specific file on the PC and send it to VirusTotal. As you can see by this example, not every service was detecting this Zbot variant when it was submitted.
To scan an individual file at VirusTotal, just go to https://www.virustotal.com/. Navigate to the location of the file on your computer. After the file is uploaded, click the Scan it! button.
There is more to VirusTotal than scanning individual files. With so many malicious websites, there are occasions when you may want to check whether a site is safe before visiting. VirusTotal also includes the ability to scan URLs. In addition to the Malware Domain Blocklist being integrated in VirusTotal's URL scanning engine, it also includes hpHosts.
hpHosts is maintained by my friend and fellow Microsoft Consumer Security MVP, Steve Burn. The activities that result in domains being included by hpHosts are described at VirusTotal as follows:
The next time you are unsure of the safety of a website, go to VirusTotal and Scan it!
How can you determine if the detection is a f/p? There are various vendors that provide free on-line computer scans but, in this case, we are looking at one particular file. Among the many services Virus Total provides is the ability to navigate to a specific file on the PC and send it to VirusTotal. As you can see by this example, not every service was detecting this Zbot variant when it was submitted.
To scan an individual file at VirusTotal, just go to https://www.virustotal.com/. Navigate to the location of the file on your computer. After the file is uploaded, click the Scan it! button.
There is more to VirusTotal than scanning individual files. With so many malicious websites, there are occasions when you may want to check whether a site is safe before visiting. VirusTotal also includes the ability to scan URLs. In addition to the Malware Domain Blocklist being integrated in VirusTotal's URL scanning engine, it also includes hpHosts.
hpHosts is maintained by my friend and fellow Microsoft Consumer Security MVP, Steve Burn. The activities that result in domains being included by hpHosts are described at VirusTotal as follows:
- Domains being used for advert or tracking purposes.
- Domains engaged in the distribution of malware (e.g. adware, spyware, trojans and viruses etc).
- Sites engaged in or alleged to be engaged in the exploitation of browser and OS vulnerabilities as well as the exploitation of gray-matter.
- Sites engaged in the selling or distribution of bogus or fraudulent applications.
- Sites engaged in astroturfing otherwise known as grass roots marketing.
- Persons caught spamming the hpHosts forums.
- Sites engaged in browser hijacking or other forms of hijacking (OS services, bandwidth, DNS, etc.).
- Sites engaged in the use of misleading marketing tactics.
- Sites engaged in Phishing.
- Sites engaged in the selling, distribution or provision of warez (including but not limited to keygens, serials etc), where such provisions do not contain malware.
The next time you are unsure of the safety of a website, go to VirusTotal and Scan it!
