Nirsoft publishes antivirus list of shame

[Petrovic]

Content source

http://www.ghacks.net/2015/10/19/nirsoft-publishes-antivirus-list-of-shame/

If you are using tools from Nirsoft, and you should if you are running a flavor of Windows on a machine, then you may have ran into issues before when an antivirus solution notified you that the program you were about to run was malicious in nature.

Nirsoft has been fighting with false positives for a long time, and I can only imagine how many support requests Nir Sofer gets about that.

What makes this even worse for him is that companies may blacklist his website or pages on it because of these false positives.

Google's SafeBrowsing service for instance blocked Nirsoft tools from being downloaded in 2014, and since it is being used by Chrome, Firefox and other browsers, it was certainly devastating at that time for Nirsoft.

Nir Sofer tried to make changes to some of the programs but the result, as of today, is still the same. He then decided to create a report about the issue by scanning all of his programs on Virustotal and ranking antivirus engines based on false positives.

Virustotal scans files that you upload to the service against 56 different antivirus engines. The ranking calculation is simple: each antivirus engine starts with a score of 100 points. Negative points are awarded for alerts which vary depending on whether it is a generic alert or one that points to malicious code in particular.

The results



Only 12 of the 56 antivirus solutions did not report a single false positive while the remaining 44 antivirus engines did report at least one.

The engines with a perfect score are: AegisLab, Alibaba, ALYac, ByteHero, ClamAW, Emsisoft, Panda, Qihoo-360, Tencent, Total Defense, VBA32, Zoner.

Many popular antivirus solutions did not rank well. TrendMicro got a score of 67 and 24 alerts, Nod32 a score of 57 and 26 alerts, Symantec a score of 71 and 20 alerts, and Malwarebytes a score of 83 and 11 alerts.

Three antivirus engines ended the test with negative scores: Antiy-AVL with -6.5 points, TheHacker with -230.5 points and Bkav with -1280.5 points.

You can check the full listing over on the Nirsoft blog for additional details.

Conclusion

False positives are a big issue for Nirsoft and -- likely -- other software developers -- and users on the Internet.

The ranking does not reflect how effective an antivirus engine is as a whole and one at least has to wonder whether the good placement of certain antivirus engines is due to them being really good at avoiding false positives or other factors.

Nirsoft could use the findings in several ways. First, it is shaming companies who report false positives even though it is clear that Nirsoft programs are not malicious in nature. Second, by informing security companies about the results and hoping that they will do something about it.

Considering that these companies had years to fine tune their engines, it seems unlikely that this is going to happen though.

 

[LabZero]

One of the problems is that if an average user receives the antivirus notification that detects a Nirsoft product as malicious, probably won't use it, giving up the great usefulness of these tools.
Many Nirsoft tools work in depth and have access to system areas that are usually attached also from malware and this can cause false positives, but that's no excuse for the behavior of some scan engines.

 

[frogboy]

I agree with you @Klipsh as a long term Norton user i know only to well how Norton hates Nirsoft and always have to restore or add an exemption for Nirsoft files.

 

[Enju]

Why is it a list of shame? Script kiddies often us Nirsoft tools for their (often batch based) malware, it's even mentioned on his blog. Antivirus statistics and scores according to false positives of NirSoft tools
Ghacks is taking his post completely out of context...

 

[jamescv7]

Nirsoft should communicate efficiently with the antivirus since if the products meet to deep analyze those critical systems then any components my flagged incorrectly.

HIPS and BB are uncontrollable based on the nature of tweaks, so matter of detection and whitelisting to reduce/prevent alerts.

 

[LabZero]

I found this old post on Nirsoft blog : Antivirus companies cause a big headache to small developers.

 

[Deleted member 178]

Nirsoft aren't responsible, their tools are necessary for any serious ITs. If skiddies use them , the AV algorithm should make the difference, but it doesnt.

The shame is on AV vendors who show the lack of reliability of their products. How many systems were crippled by FPs...(webroot case, etc...), how many corporate homebuild softs blocked...?

AV vendors sacrifice small developers for their own profits and good scores on AV tests...

So yes shame on them.

 

[LabZero]

Nirsoft aren't responsible, their tools are necessary for any serious ITs. If skiddies use them , the AV algorithm should make the difference, but it doesnt.

The shame is on AV vendors who show the lack of reliability of their products. How many systems were crippled by FPs...(webroot case, etc...), how many corporate homebuild softs blocked...?

AV vendors sacrifice small developers for their own profits and good scores on AV tests...

So yes shame on them.

Have to agree with you!