False positives with Trend AV

AlanYork · 19-08-2005, 05:35

I just opened an e mail attachment (a picture) sent from a very PC savvy friend to my hotmail address. No way would this friend knowingly send me a virus and I'd be very surprised if she sent one in error too. Trend, which scans all Hotmail attachments found it to be infected. However a second attempt at opening it gave a result that it was clean.

Concerned, I did a scan of my computer with my AV, Bullguard, which came up clean and another scan with Trend Housecall, which ironically came up clean too.

As a triple check, I sent some of my own photos already on my pc from Hotmail to my Yahoo e mail address. Again Trend at first insisted these pics were infected, then changed its mind and let me attach them. They duly arrived at my Yahoo address and the AV that Yahoo use (Norton I believe) scanned them, found them to be clean and allowed me to download them.

I have no intention of getting paranoid about this, since I reloaded Windows many of my pc woes have been resolved and as far as I'm concerned if my AV says my PC is clean, that's good enough for me, but is it possible that the Trend scan on Hotmail could be giving a false positive reading? I don't see how it can say that a file is infected and then, when asked again, change its mind. I also don't see why Housecall, (a Trend product!!!!!) can find no infected files on my pc. It can't seem to make its mind up. Has anyone come across this before?

Gareth · 19-08-2005, 12:50

Yes, sounds like it's throwing a false positive. When it comes to virus infections, I'd rather have a false positive than a false negative, and I think that the AV vendors tend to err on the cautious side as a result.

You did exactly what I'd have done, ie re-check with another vendor's solution.

By the way, just because your friend is computer-savvy doesn't mean that their address hadn't been spoofed, if they're found in the address book of someone who is infected, then their address can be used. If I'm suspicious about an attachment, I send a mail to the person asking htem if they recently sent me something

AlanYork · 19-08-2005, 15:07

Thanks, I've just triple checked by running Symantec AV scan and that's clean as well. So I have Bullguard, Symantec and Trend all saying my PC is clean, thats great, confirms what I already knew.

I very rarely, if ever, send attachments so that in itself is not a problem, but I am concerned that e mails to my contacts might be rejected if they appear to come from an infected PC. If I'm sending just plain text mail with no attachments, as 99 times out of a hundred I normally do, is that going to be a problem do you think, or is it only attachments that can be infected?