System and method for reducing antivirus false positives

A system for detecting a malicious program infection, comprising at least one hardware processor configured to:

• determine whether the data exhibits one or more particular symptoms of being infected with a malicious program by scanning the data;
• in response to determining that the scanned data exhibits the symptoms of being infected with a malicious program, verify that the scanned data is infected with a malicious program by comparing the scanned data to known-good data;
• if the scanned data does not match the known-good data and if the scanned data exhibits symptoms of being infected with the malicious program, initiate remedial action on the scanned data;
• and
• if the scanned data does match the known-good data and if the scanned data exhibits symptoms of being infected with the malicious program, determine not to initiate remedial action on the scanned data.

A computer system comprising:

• a processor;
• and
• a program storage device readable by the processor, embodying computer executable code, the processor operable when executing the code to:
• determine whether the data exhibits one or more particular symptoms of being infected with a malicious program by scanning the data;
• in response to determining that the scanned data exhibits the symptoms of being infected with a malicious program, verify that the scanned data is infected with a malicious program by comparing the scanned data to known-good data;
• if the scanned data does not match the known-good data and if the scanned data exhibits symptoms of being infected with the malicious program, initiate remedial action on the scanned data;
• and
• if the scanned data does match the known-good data and if the scanned data exhibits symptoms of being infected with the malicious program, determine not to initiate remedial action on the scanned data.

A non-transitory computer readable medium including computer executable code for detecting a malicious program infection, comprising:

• code for determining whether the data exhibits one or more particular symptoms of being infected with a malicious program by scanning the data;
• code for verifying that the scanned data is infected with a malicious program by comparing the scanned data to known-good data in response to a determination that the scanned data exhibits the symptoms of being infected with a malicious program;
• code for initiating, if the scanned data does not match the known-good data and if the scanned data exhibits symptoms of being infected with the malicious program, remedial action on the scanned data;
• and
• code for determining, if the scanned data does match the known-good data and if the scanned data exhibits symptoms of being infected with the malicious program, not to initiate remedial action on the scanned data.

A system for detecting a malicious program infection, comprising:

• means for determining whether the data exhibits one or more particular symptoms of being infected with a malicious program by scanning the data;
• means for verifying that the scanned data is infected with a malicious program by comparing the scanned data to known-good data in response to a determination that the scanned data exhibits the symptoms of being infected with a malicious program;
• means for initiating, if the scanned data does not match the known-good data and if the scanned data exhibits symptoms of being infected with the malicious program, remedial action on the scanned data;
• and
• means for determining, if the scanned data does match the known-good data and if the scanned data exhibits symptoms of being infected with the malicious program, not to initiate remedial action on the scanned data.