As you may know, some of the powerful tools on NirSoft Web site, especially the tools that recover passwords, are constantly targeted by many Antivirus programs.
In order to find out which Antivirus programs cause more troubles with the tools of NirSoft, I decided to generate a report with the number of false positive alerts of every Antivirus program. I have created a small program that downloads the Antivirus scans result of all .exe files of NirSoft from VirusTotal Web site and then processes the collected information and generates the desired report. I have also decided to generate score for every Antivirus program according to their false positive issues.
Before I continue with more information about this report... let me say a few words about the term "False Positive": There are people who say that I don't use the term "False Positive" correctly, simply because the alerts about my tools are not a mistake and the Antivirus programs have to display an alert about a program that can be used by hackers for bad purposes (like my password-recovery tools).
So here's my opinion.... It's somewhat legitimate that Antivirus program will display a warning about my password-recovery tools, as long as it's done with full explanation about the alert, which means that the Antivirus program must explain the user that the program is completely legitimate and it's not bad by itself, but it can be also used by hackers to steal passwords and that's why the warning is displayed.
Also... the alerts on password-recovery tools should not be detected in VirusTotal Web site, unless this Web site will start to make full separation between Viruses/Trojans/Malwares and non-malicious tools, so people who check the file in VirusTotal will not think that my tool is an horrible Virus.
Unfortunately, Antivirus programs and VirusTotal Web site don't provide clear explanation about the alerts they display and many people are confused, thinking that my tools are infected with Virus/Trojan, and As long as there are users who think that my programs are infected, I consider it as a "False Positive". The right definition of "False Positive", in my opinion, is a situation that a user thinks a file is infected with a Trojan/Virus/Malware according to an alert displayed by Antivirus software, while the file is not infected at all.
It doesn't really matter that the Antivirus developers only wanted to warn the user about a software that can be used by hacker, if the Antivirus program doesn't deliver the message to the end user correctly, then it' still a false positive.
It's important to say that some of the Antivirus programs imply that my tools are not a Virus by adding "not-a-virus" or "Hacktool" or "Riskware" strings to the alert name, but many
users don't understand the meaning of these strings and still think that the file is infected. Nevertheless, in my score calculation , Antivirus programs that do it got an higher score.
Explanation about the report
The report contains 6 columns and one line for every Antivirus software/engine, here's the description of every column:
- AV Name - The name of the Antivirus
- Total Alerts - The total number of NirSoft files that the specified Antivirus display alerts.
- No Virus - Number of alerts that contain the following strings, implying that NirSoft software is not a Virus/Trojan/malware: not-a-virus, tool, pup (potentially unwanted program) , pua (potentially unwanted application) , riskware, unwanted, passwordrevealer, not malicious, passwordviewer
- NO PR - Number of alerts for programs that are not a password recovery tool.
- Trojan Alerts - Number of alerts that contain the following strings, implying that NirSoft software is a Virus/Trojan (So these alerts are severe false positives): trojan, spyware, malware, adware.
- Score - Total score calculated for this Antivirus. Read the 'How the score is calculated' for more information.
How the score is calculated
Here's a full explanation about how the Antivirus score is calculated:
- Every Antivirus engine starts with 100 points.
- For every alert displayed for a password-recovery tool, 1.5 points are reduced from the Antivirus score.
- For every alert displayed for a tool that doesn't recover passwords, 3 points are reduced from the Antivirus score.
- When one of the following strings appear inside the alert name, 0.5 points are added to the Antivirus score: not-a-virus, tool, pup (potentially unwanted program) , pua (potentially unwanted application) , riskware, unwanted, passwordrevealer, not malicious, passwordviewer
That's because the Antivirus does a good thing here, implying the my tool is not a Virus/Trojan/Malware.
- When one of the following strings appear inside the alert name, 5 points are reduced from the Antivirus score: Trojan, spyware, malware, adware
That's because the Antivirus does a bad thing here, implying the my tool is a Trojan/malware, which is completely a lie. Comodo, for example, displays 'UnclassifiedMalware' alert for 11 NirSoft files, which is totally misleading, because the "Malware" term is mostly used for programs that are designed to be bad , and that's why they got very low score.
ViRobot and Antiy-AVL also got low score from the same reason.
Example for score calculation
AVG display alerts for 13 files, 12 of them are password recovery tools, so 1.5 * 12 = 18 points are reduced, 1 tool is not password recovery, so additional 3 points are reduced.
All 13 alerts contain 'hacktool' and 'passwordviewer' strings, so 13 * 0.5 = 6.5 points are added.
100 - 1.5 * 12 - 3 * 1 + 13 * 0.5 = 85.5
Finally... Here's the report.
The report is based on Virus scanners results downloaded from VirusTotal on October 4, 2015. The NirSoft files taken from NirLauncher package 1.19.53. Be aware that Antivirus signatures changes every day, so it's possible that if you check the virus alerts from today you'll get a little different result. You can download a csv file containing all alerts found on this day from here. This file contains the Antivirus Name, the alert name, the NirSoft file that triggered the alert and the SHA-256 hash of this file, and you can optionally view this file with CSVFileView...
The good news in this report is that there are 12 Antivirus engines without any false positive and they got the best score possible (100)
The bad news - There are 2 Antivirus engines that show alerts for more than 100 files of NirSoft (!!) - Bkav and TheHacker, and they got very low negative score...
|AV Name||Total Alerts||No Virus||NO PR||Trojan Alerts||Score|
It's possible that I'll generate another false positives report within a few months in order to check whether the Antivirus companies improve their software or they are getting worse...