Any feedback on VirusTotal.com?

[techs]

http://www.virustotal.com/

"Virustotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines"


I heard about this when someone claimed a file I posted for download was infected. Yet the file is over 10 years old and has been scanned at least once a week, by whichever AV I was running at the time, on about 7 different computers.
It is inconcievable the file is in any way infected. Yet when I upload the file, 2 out of the 41 antivirus's on the site say it has a trojan.

Interestingly the two the say it has a trojan are Chinese av's that I have never heard of, while all other 39, which are all major AV's say it is clean.


Is this site legit? Are the two Chinese av's giving a false positive? Or is the site a gimmick to try and get you to buy one of these two Chinese AV's?

Any feedback is welcome.

 

[lxskllr]

That site's legit. It's probably a false positive. It's useful for scanning suspicious files, because different A/Vs can have different results. That way you can use them all, then make up your own mind about the file. In your case, I'd say the file's clean.

 

[StormSide]

http://www.virustotal.com/

"Virustotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines"

Is this site legit? Are the two Chinese av's giving a false positive? Or is the site a gimmick to try and get you to buy one of these two Chinese AV's?

Any feedback is welcome.

Yes it is legit. Most likely they are false positives. I use it alot for newer unknown files.

If it is a new file and has been flagged by a few I will usually wait a day or 2 and submit it again to see if it was added to any other AV.

Since this is a known old file I would trust the mass majority on Virustotal.

 

[tzdk]

Must remember that while service is nice and useful it only do a file scan based on command line tools. They are not the same as a fully installed AV. Seems like you have run into false positive no. 123456789 but in theory your file could be heavily infected, but no AV notice until it is executed. What the "someone" noticed perhaps. Another false positves but still. Could be from AVG or whatever which when used on Virustotal give thumbs up.

Typically you will focus on what ESET, Kaspersky, MS, Norton, Avira etc. has to say about a file. Some brands are unknown to mankind.

 

[balloonshark]

I use virustotal and http://virusscan.jotti.org/en often. It seems that FP's are the norm.

tzdk brings up a good point about their results not being the same as an installed anti-whatever. That is why I also scan files with 3 programs that I have installed on my machine.