Ubuntu

how are the results of virus total.com read?

Asked by 908423-p

I had three files on my Ubuntu 14.04 computer show up on clamTK 5.11. I scanned those files using virus total.com. Two of them got a 0% reading while one got a 100% reading. I know that 100% means the file is clean & -100% means it is an extremely massive threat. What do the results mean when they give a 0% reading?

The names of those files are in question # 256509

ps

The question number above was from the first question I ever asked because it was from when I first started using this site. I did not see a place to respond to answers at the time, so I responded to those answers using the place where I typed my question. I started using the comments feature when one of the people that responded told me about it.

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Manfred Hampl (m-hampl) said : 		#1

Where do you see -100%, 0% or 100% in virustotal.com? What have you tried? Please provide links to the pages with the test results of the files that you have uploaded for testing.

Revision history for this message
908423-p (908423-p) said : 		#2

There is a picture on the right of the page that has a green side and a red side with a black arrow showing the level of the threat. Place the cursor over the black arrow or on the meter that the black arrow is in, to see the level of the threat in text.

MokManager.efi.signed
https://www.virustotal.com/en/file/50da6f628c1a51deff3baac40e33a467b56caa0524207549bf83b254439f52cf/analysis/1415335743/

shim.efi
https://www.virustotal.com/en/file/702a10fa1541869f455143ed00425e4e9b2d533c3b639259bde6aac97eca15ed/analysis/1415335785/

shim.efi.signed
https://www.virustotal.com/en/file/b6058875ca3d3cc2bd8925e1255942eca445c81c0f93619c4bab5508ecc56b92/analysis/1415335817/

Revision history for this message
908423-p (908423-p) said : 		#3

Sorry. I clicked the wrong link for my last response. The comment above is the information you wanted.

Revision history for this message
908423-p (908423-p) said : 		#4

ps

Don't click the red and green faces under the meter because it may influence the results since no one used them yet.

You can tell if no one used them yet if there is a 0 next to them.

Those faces are for the people to vote if the file is a threat or if it is clean.

Revision history for this message
Manfred Hampl (m-hampl) said : 		#5

In my opinion the only information that really matters is in the top left box:

"Detection ratio: 0 / 54"

Not a single one of the 54 used malware scanners has identified the file and its contents as harmful.

That angel/devil icon is just something where end users can indicate whether they THINK the file is malicious or harmless. I would never base any decision on such public rating.

Revision history for this message
908423-p (908423-p) said : 		#6

Thank you for your advice. I just have one more question simply from curiosity, if the results were below 0, what would your opinion be?

Revision history for this message
908423-p (908423-p) said : 		#7

I have one last question then done. The question is above.

Revision history for this message
Manfred Hampl (m-hampl) said : 		#8

I wouldn't care about other people's personal rating if all other information tells that the file is most probably trustworthy.

"Probably harmless! There are strong indicators suggesting that this file is safe to use."

Can you help with this problem?

Provide an answer of your own, or ask 908423-p for more information if necessary.

To post a message you must log in.