Minimizing False Positives with Avira Antivir?

I'm currently trialling Avira Antivir in a very diverse corporate environment.

I've had a few things that are, for our use, totally legitimate get flagged as infected, such as jmail (a common emailer used on website backends) and various .exe's based on the "packing type".

To those of you using Antivir, what settings have you enabled/disabled to minimize the risk of this whilst catching as much genuinely nasty stuff as possible?

I like the product so far, but have concerns that I could be spending a long time adding exceptions or submitting false positives to Avira.

Any advice appreciated.

 

If you have "Advanced Heuristic Analysis Detection" set on High level, I'd use Medium (default level), and keep testing on low, or disable it altogether.

Unfortunately high detection rate means also the possibility of FPs, so if in doubt you can set the guard and the scanner to automatically copy the file to quarantine before any action is taken.

 

Are you using the free or premium version?

 

Professional version.

I have heuristics on low as I've already encountered a few FP's, it was more if there are any other settings that are suggested/recommended but not obvious.

 

About False Positives with Avira, when submiting the file to Avira, how long does it take to avira to correct the false positives?

I have submitted, 2 days ago, a few files from Business-in-a-box wich were detected has trojan and they are still pending?!?!?!

 

Doing well so far. Had one client that seemed to have infections detected by Trend so I used that as a Guinea Pig and installed Antivir and did a manual scan and picked up two things that Trend appeared to have missed.

Also had one chap do a manual scan and it detected "Malware 'TR/Spy.Banker.Gen' [trojan] was found in file 'C:\WINDOWS\SysWOW64\msindc.dll'."

If I google msindc.dll I don't see any legitimate reference to it so good on Avira, **** on Trend.

 

I has two false positives this weekend (Avira security suite). I submitted them and today they replied that those were indeed false positives. After running a scan with updated definitions, my system was clean.

Corporate environment or not, I don't think it's a good idea to set the heuristics at lower than medium. I mean, there is a point when it just stops working. Avira doesn't have a HIPS , Sandbox or anything like that, so you just have to rely (mostly) on the signatures. And signatures and heuristics are not separate, complicated subject.