I had an interesting run-in with AVG this week - a user sent me an file archive he was having problems opening - I had no such problem opening the archive - until I turned off my normal antivirus and turned on AVG, which said one file was infected with a "Banker" trojan. The user who sent me the file was worried that his banking info was at risk.
As it turned out the file was a keygen for a commercial product - I pulled it apart to look at this "trojan" (I try to balance skepticism and curiosity with a healthy level of precaution and care) Maybe if I knew where to find my banking information I could also locate all that extra money that disappeared in bank fees. So I was rather curious - and after having a very close look at it - the file was actually clean - no trojan, no unusual thread, process, file or registry activity, no global hooks or DLL injections. Not a thing. This was just a boring old executable that displayed a number. So I contacted AVG to report a false positive provided the info I had to say the detection was wrong.
The response I got back surprised me.
They didn't care about the false positive - they stated the false positive would remain, because it was a keygen. So, it seems some antivirus companies don't just detect viruses, trojans and spyware - they also have some artistic license in policing what files should exist or not on your computer - and trying to scare people away from the files they don't approve of by inventing virus infections.
I think an AntiVirus developer who "invents" ficticious virus infection reports leaves a big question when it comes to credibility and accurate virus detection. Certainly my confidence levels in their product now has some doubts - now I know AVG are a willing participant in the game "Boy cried Wolf". I'm glad I don't rely on them full time.
