I hate false positives

[Diosoth]

Malware is bad, but false positives are almost as bad, in my experience.

I know no single antimalware is perfect, and free programs aren't near the quality of pay programs, and you often have to run 2 or more to find everything. MSE is.... well, it's free and part of Window sand while it offers live protection and is okay at catching a lot of bad stuff, I've had a few false positives with it, generally jpeg files and it only happens on occasion. I think it's an instance of the new definitions set having a bug that flags an image file the second it's created on the hard drive. It's happened... maybe 3 times for me and I know the files were safe otherwise.

I haven't had a malware infection for months. I was clean as of March, at the very least. I run MSE, Malwarebytes and SAS, with TDSSkiller on hand. I run a scan once a week and, at most, I find the same few tracking cookies. Between Adblock Plus, NoScript and Spybot's immunizations, I'm dodging the stuff the infects through browsers.

This morning I was playing freeware game Gungirl 2 on my secondary Dell XP computer, and on exiting the game I get a popup that says "stdst.exe has stopped working". A program not quitting right on exit isn't a big deal in itself, I've gotten somewhat used to it for certain games, especially freeware titles... Google that up and find lots of mentions of malware. So I have to run scans on both PCs and files on the Dell were taken off the Gateway.

EXCEPT I'm not infected as it seems stdst.exe is also a legit part of Multimedia Fusion and games made with it tend to have that internal program name- which likely explains why the program's icon in the notice box was that of the game. So I spent 15 minutes freaking out over nothing, apparently.

 

[DavidE]

I agree false positives are a problem.
When you find a questionable file, you can upload it to VirusTotal.
That will scan it with a LOT of scanners.
If only 1 or 2 show an issue while 40+ say it's ok, it's probably an FP.
https://www.virustotal.com/en/

Upload your stdst.exe and see what VT reports...

 

[Layback Bear]

David could you explain the method of uploading to VirusTotal. I have never got it to work.

 

[UsernameIssues]

David could you explain the method of uploading to VirusTotal. I have never got it to work.

If by "never got it to work" you mean that you encounter a problem during the upload process - then that is happening to several people that use IE10. The work around is to try again or use another browser.

 

[Layback Bear]

I use Firefox.
Let me try to explain.
Lets say I want to upload aaaaa.exe
Where on my computer do I copy/paste aaaaa.exe to able to upload to that site. It won't let me just type it in or copy/paste.
What method do you use?

 

[UsernameIssues]

I select Choose File...



...and then navigate my way to the file.

 

[DavidE]

I use the Choose File and navigate to it...same as Usernameissues
I use Firefox...

 

[DavidE]

I just tried Left mouse clicking in the VT file selection field.
It opened the File Upload (Explorer) window to the directory I last uploaded a file from.

 

[Layback Bear]

I'm thick headed so Bear with me. The file is not on my computer.
I have to copy/paste from a post and put it somewhere and then upload to virustotal.
This from post #1
stdst.exe

I know I'm missing some stupid little step somehow.

 

[DavidE]

If I understand correctly, you want to scan a file that is not on your computer.
I've never done that, but I found this in the VT documentation:
They have an "Uploader" utility program you can install that may do what you want.

Fetching and scanning online files

Another handy option will have VirusTotal fetch and scan an online file without you even having to download it first. Type in the URL, or right-click it and choose "Copy link location" to cut and paste it, and then click the Get and upload button. The file will skip through your computer's memory, but will never be saved to your hard drive (by default). You will get the usual list of results and can then decide whether you want the download.

Source: https://www.virustotal.com/en/documentation/desktop-applications/virustotal-uploader

 

[Layback Bear]

Thank you very much. I have downloaded it and will give it a try later.