When is software malware?

XEyedBear · 06-06-2009, 10:50 AM

This is not a request for help on a specific problem, but a request for understanding and guidance. If I have posted in the wrong place, apologies; please redirect me.

I am just slightly concerned that malware scanners may not be doing an effective job of preventing false positives (which is, admittedly, much safer then allowing real positives !)

I was asked to replace a faulty laptop hard drive for a student from China. First step was to build a sacrificial computer out of old bits I have and then connect the failed laptop drive to it, to recover user data.

I had Comodo Internet Security installed on the sacrificial computer. It found malware on the laptop harddrive. One item intrigued me so I submitted it to an on-line scan service which submits suspicious software to a large selection of malware detection services. The majority vote was that it was indeed malware.

I created a clean install on the sacrificial computer and took a copy of the Windows amd Program Files directories. I invoked the malware and took a second copy of those directories. I could find no unexpected new files or changes to existing files in these two directories.

Was it therefore truly malware? What is the definition of malware other than that it places malicious software onto a vicitm's PC?

Or is it possible that this example is 'innocent' but just happens to have a sequence of binary code which invokes the 'malware found' logic in the heuristics checking of Comodo?

How frequently is this likely to happen?

Is this why the 'vote' by the on-lime multiple scanning service does not yield a 100% identical decision from malware scanners?

06-06-2009, 10:50 AM	#1 (permalink)
XEyedBear Registered User Join Date: Jun 2008 Posts: 21 OS: XP SP3	When is software malware? This is not a request for help on a specific problem, but a request for understanding and guidance. If I have posted in the wrong place, apologies; please redirect me. I am just slightly concerned that malware scanners may not be doing an effective job of preventing false positives (which is, admittedly, much safer then allowing real positives !) I was asked to replace a faulty laptop hard drive for a student from China. First step was to build a sacrificial computer out of old bits I have and then connect the failed laptop drive to it, to recover user data. I had Comodo Internet Security installed on the sacrificial computer. It found malware on the laptop harddrive. One item intrigued me so I submitted it to an on-line scan service which submits suspicious software to a large selection of malware detection services. The majority vote was that it was indeed malware. I created a clean install on the sacrificial computer and took a copy of the Windows amd Program Files directories. I invoked the malware and took a second copy of those directories. I could find no unexpected new files or changes to existing files in these two directories. Was it therefore truly malware? What is the definition of malware other than that it places malicious software onto a vicitm's PC? Or is it possible that this example is 'innocent' but just happens to have a sequence of binary code which invokes the 'malware found' logic in the heuristics checking of Comodo? How frequently is this likely to happen? Is this why the 'vote' by the on-lime multiple scanning service does not yield a 100% identical decision from malware scanners?