The last Straw - Anti-virus software just too full of crap
For the last while, I've been using the free edition of PrevX CSI because, it has a handy feature of pointing out the path where most malware reside. However, this software, these days has become more and more annoying with false positives to the point where I uninstalled the thing!
The final straw for me was when I attempted to encode some videos for playback on my cellphone. It flagged the DLLs of software (VirtualDub and FLASKMPEG) I've had since 2003, as infected, and I know pretty darn well those files are harmless. Yet the software cannot even detect most rootkit infections. It has also lately been flagging TightVNC and others as malware, so to hell with it, I removed it from the system.
I have also had issues where it reported my OWN OBJECT CODE as a virus. I compiled a program I had written and suddenly it went apeshit about the object executable. Changed one character in the source code by altering one of the const char arrays and the antivirus stopped bitching. I have even had trouble e-mailing said object file to an associate because GMail also flagged it as a virus.
At work, it has gone off with an in-progress download of a legitimate CAD program update from a legitimate vendor. The complete file scans clean, yet when it is downloaded to 37% the incomplete file causes PrevX to scream "virus"
I think, that with the attempt to squash and keep on top of more and more sophisticated malware, the anti-virus vendors have cocked-up bigtime. I also believe that the method of detection is no good as most malware uses legitimate call chains, conventions and other features, which are identical to commercial software, as most malware nowadays are coded using the same toolchains as many commercial products. Tons of malware is coded in Visual C++ and even Borland Delphi, and we all know that Delphi shares the VCL component classes of Borland C++ Builder, meaning any malware in delphi could trigger false positives for a BCB application, which is what probably happened to me.
Signatures are no longer good enough, better analysis and running the suspected malware through a debugger, needs to be performed.
