Categories
Interior

How to tell if a virus is actually a false positive

As a website that offers tested, safe downloads, it’s not all that uncommon for someone to claim a file contains a virus. So, how do you know if a file contains a virus or if it’s just a false positive? And, what is a false positive?

TIP : Hard to fix Windows Problems? Repair/Restore Missing Windows OS Files Damaged by Malware with a few clicks

A false positive means that one or more antivirus programs have detected a virus, but the file is clean. How does this happen?

There are numerous ways for a file to be flagged as a false positive. Let’s look at a few.

Heuristics

Heuristics is something we deal with frequently. Because we support many small developers, many of our programs aren’t recognized by the antivirus companies. Let’s first give you the official Wikipedia definition of Heuristics. “A heuristic technique, or a heuristic for short, is an approach to problem solving or self-discovery that employs a practical method that is not guaranteed to be optimal, perfect or rational, but which is nevertheless sufficient for reaching an immediate, short-term goal.”

In other words, they don’t recognize the program, so they guess. Often incorrectly. It’s that simple.

Bundleware or Ad-Supported

While there are many free and Open Source apps available, there are more that are looking to sell you something. Some programs run ads. Some offer to install third-party applications, and some limit the features available.

Programs that run advertisements or offer third-party are often now tagged as PUPs or Potentially Unwanted Programs. They aren’t a virus, but some large companies, particularly Malwarebytes, have made PUPs a target. That’s not a bad thing, but it’s not a virus.

Program Behavior

Many programs that access particular Windows settings can also be incorrectly flagged. For example, keyloggers, many networking applications, product key finders, and more. Ironically most third-party trusted and safe, antimalware apps will be flagged as a virus. If a program has the potential to access any part of Windows known to be vulnerable to viruses or malware, then it might be flagged as a false positive.

Most of the downloads in our Covert Ops category will flag as false positives. For example, we scanned Jalapeno Keyfinder, a program that’s been on MajorGeeks for over ten years and is clean. You can almost smell the heuristics on the VirusToal results.

VirusTotal

Virustotal is the bomb. You can scan any file with over thirty antivirus apps in one place. We feel thirty antivirus apps are overkill, and the reason for so many false positives.

A little common sense is required to understand Virustotal results. For starters, do a Google search for the discovered virus name and read the comments.

How to Know If It’s a Virus or a False Positive

The truth is that it’s hard to tell, and nothing is 100%, but you can be careful.

When we test at MajorGeeks, we run everything in a virtual machine after we scan with Virustotal. This way, we can watch for suspicious behavior, including the program dialing out, monitoring, installing PUPs, and much, much more.

Sandboxie is a good, freeware alternative to test suspicious programs.

When in doubt, find another program and whenever possible, look for portable, freeware, and Open Source programs.

MIT Medical answers your COVID-19 questions. Got a question about COVID-19? Send it to us at [email protected], and we’ll do our best to provide an answer.

Last week, I tested positive during routine Covid Pass testing on campus and was told to self-isolate for 10 days. My family members have all tested negative, but they are also being asked to quarantine for 14 days.* None of us have had any symptoms, and we’re all feeling pretty frustrated at having to put our lives on hold like this. Isn’t it possible that my test was a false positive? Can’t I be retested?

How to tell if a virus is actually a false positive

We define a false positive as a test result that incorrectly indicates that a particular condition or attribute is present. By that definition, no, your test was almost certainly not a false positive. The PCR test used by MIT, like other PCR tests, is very unlikely to return a false positive. If the test comes back positive, we can be sure that it has correctly detected genetic material from the SARS-CoV-2 virus, the virus that causes COVID-19.

But might PCR tests be too good at finding traces of the virus? That’s a question scientists are starting to investigate.

The PCR test analyzes samples by amplifying viral RNA in cycles. Most tests, like the Broad Institute test used by MIT, use a 40-cycle protocol. If the virus isn’t detected within 40 amplification cycles, the test result is negative. If viral RNA is detected in 40 cycles or less, the PCR machine stops running, and the test is positive. Because you received a positive result, we know that the test detected the virus in your sample by the time it reached its 40-cycle limit.

But as we learn more, this binary way of viewing test results — positive/negative, infected/not infected — may change. After all, the amount of virus in a sample is directly correlated with the number of amplification cycles needed to detect it, a number known as its cycle threshold (Ct). A positive test that comes back positive in 20 cycles contains a greater amount of virus than one requiring 40 cycles. Right now, we just call both results “positive.” But it’s obvious that the first sample came from an individual with a higher viral load. And the greater the viral load, the more contagious the patient is likely to be.

There is some evidence that Ct values may be useful in predicting patients’ infectiousness and prognosis, but we’re not yet at the point where it makes sense for us to include that information in our decision-making process at MIT, says Associate Medical Director Shawn Ferullo. For one thing, Ct values are not absolute. Different machines can produce different Ct values for the same sample, and the same machine can give different Ct values for different samples from the same person. “While it may be useful to know if an individual’s Ct value is on the high or low end of the scale,” Ferullo says, “based on our current knowledge, it would not change quarantine or self-isolation recommendations.”

At this point, Ct value is not included in the test results MIT Medical receives, and we have no way of obtaining that information. “While we can’t know the Ct value associated with your test or any other,” Ferullo says, “we can be pretty sure that your test result is a true positive. But it may be a subclinical case, meaning that your viral load is so low that you are not infectious and cannot spread the virus to other people, including those in your immediate household — which is a good thing!”

At the same time, Ferullo understands the frustration at being asked to put your life, and the lives of your family members, on hold. “Unfortunately, retesting is not an option,” he explains. “The Massachusetts Department of Public Health will not accept subsequent negatives to clear a previous positive test. The rules are very clear that people should not be retested once they have a positive result.”

Given our community’s experience with Covid Pass testing so far, Ferullo doesn’t believe subclinical positives are prevalent. “In proof of this, as of the end of October, we have done more than 156,000 tests on asymptomatic individuals through COVID Pass and have had fewer than 90 positives,” he notes. “If this was a pervasive problem, I’d expect to see many more than that.”

While Ferullo acknowledges that the test’s 40-amplification-cycle protocol and binary result reporting could result in unnecessary isolation for some people, he says it’s all about keeping the Institute community safe. “While the virus has forced many universities around the country, and even here in Massachusetts, to suspend in-person activities or send students home during the fall semester, MIT has been able to maintain a monthly positive-test rate of 0.05–0.06 percent since August,” he says. “I do believe the test may be identifying some sub-clinical cases, but based on our current understanding of the virus, we’d rather err on the side of caution than put our community at risk.”

*Note: In early December 2020, the CDC announced two new options for quarantine periods shorter than 14 days for close contacts of individuals diagnosed with COVID-19 or testing positive for the virus. State and local public health authorities can choose to continue recommending a 14-day quarantine or can choose to adopt one or both shorter options. Read more…

This news story has not been updated since the date shown. Information contained in this story may be outdated. For current information about MIT Medical’s services, please see relevant areas of the MIT Medical website.

Modern antivirus applications often do a good job at protecting your machine on its day-to-day operations. However, security applications are not perfect and there are occasional false positive detection. It is typically tricky to determine whether it is a false positive or a legitimate threat.

What Are False Positive Antivirus Detection

False positives are instances when your security application identifies a file or a program to be malicious and you believe it isn’t. It typically happens when you’ve just installed the antivirus program or after a major update. Security programs follow the signature of known threats and it will flag anything that resembles those. However, some trusted programs may resemble those threats.

Security applications, such as MalwareFox, will provide as much information as it can about the identified threat. For instance, detection results will show the file location, associated program, and what type of threat it thinks matches the file. Some antivirus programs may even provide a quick way to research the threat without leaving the security interface.

How False Positive Detection Happens

There are several instances when false detection happens. Knowing them is half the battle.

First, it is possible that security developers may roll out bad virus definition. For example, in 2011, a faulty Microsoft Essentials update caused it to identify Google Chrome as Trojan and subsequently remove it . This rarely happens, but it is possible. Thus, it is important to check the news and updates sections of your antivirus’ websites before deleting any false positive results.

Also, newly installed security programs may also identify several false positives. Most antivirus software “learn” the behavioral patterns of the programs and files in your machine over time.

However, it will follow known threat signatures during its first scan which may identify legitimate files as malicious. As such, you can identify “exceptions” to teach the program which files applications and files are harmless.

Lastly, some programs may fall under a “gray area”. You may trust a freeware with a bunch of advertisements with it but the security programs don’t know that. Programs that employ file compression and protection techniques will also catch the attention of your security program as they may resemble certain types of malware. Utility programs will also fall under the gray area. Moreover, questionable toolkits such as those for cracking software will fall under threats.

For example, MalwareFox and AVG typically detect Incredimail on its first scan as a potential threat. However, the email application is preferred by many and not really harmful to the system. Another example is Malwarebytes tagging Advanced SystemCare as potentially unwanted program (PUP). The Advanced SystemCare Performance Monitor will not work properly when the flagged files are deleted.

How to Confirm False Positives Detection

It is highly likely that a file or an application is harmful when an updated security program tags it as one. However, there are a couple of steps that you can take when you want to determine if a scan result is a false positive.

Solution 1: A quick Google search will often show you what the file or program does. Moreover, it is an easy way to confirm if the file detected is indeed a threat or otherwise. You further confirm details by reading community posts and forums especially those hosted by your security application provider.

Only a few antivirus programs will identify a file as a threat if it is a false positive. At this point, you can use your secondary security application (those that work alongside security suites) to check if it will result in a similar report. If it does, then the file or program is indeed harmful.

Solution 2: A better way is to use VirusTotal to survey the results of most security engines. VirusTotal is online virus scanner which aggregates over 70 antivirus products and online scan engines to show a comprehensive analysis. Locate the file on your quarantine, then upload it to the website. The results are also shared with the contributors which then improve their own products and services.

How to tell if a virus is actually a false positive

Assess the validity of the detection according to the results of further scans. It is highly likely that a file or a program is a threat if most security programs report it as one.

Final Thoughts

False positive detection do not happen quite often. Make sure that you consider the results of the steps above before declaring a file or a program as safe. Also, schedule a regular scan of your computer using the latest security programs, like MalwareFox, to allow it to learn your machine. Moreover, keep all your programs in the computer updated including drivers as these can also cause false positives.

In the wake of The View‘s Sunny Hostin and Ana Navarro receiving false-positive COVID-19 tests results, just how common are false-positive results?

Sunny Hostin and Ana Navarro had a COVID-19 scare last week when they were suddenly pulled from The View stage after testing positive for the virus, despite being vaccinated. But on Monday, it was revealed that their test results were false positives and that, thankfully, neither host was actually infected.

"It was really uncomfortable for my results to be released publicly before I even knew what was going on before they were verified before I was tested again and again," said Hostin, 52, during Monday's episode.

"I was relieved, to say the least, to find out that I was COVID-negative. And I always was assured by the fact that I am fully vaccinated," she continued. "And so, if even if I were COVID-positive, I was convinced that I would likely be okay. And if this type of thing were to happen to me, Ana Navarro is the best person to have it happen with you, because her charm and her wits and her sense of humor really got me through it. I won't tell you the types of things that she was saying in Spanish, but it was pretty terrific." (Related: What Is a Breakthrough COVID-19 Infection?)

Navarro, 49, also reflected on the experience during Monday's show: "Frankly, my first thought was, 'Oh my God' — because I had just spent the day with Kamala Harris' sister, niece, and brother-in-law, so I'm thinking I'm Typhoid Mary and I'm going to wipe out the entire Harris family in one week. So I had to call them [and] immediately call [my] family because you don't want them to find out from TV — of course, they had, and it shows you just how instant, these days, news travels."

While the drama made for interesting view-ing (eh? eh?), it may have also raised some concerns about the possibility of false-positive test results overall. Here's what to know about potential discrepancies in COVID-19 test results.

What Is a False-Positive Test Result?

A false-positive result is when you test positive for COVID-19 despite not actually being infected with the illness, according to Harvard Health.

How Common Is a False-Positive COVID-19 Test?

The accuracy of COVID-19 tests can vary due to a number of factors. For some, it depends on when you get tested and the size of your potential viral load — how much of the virus you're carrying — you have at the time of your test. Generally, asymptomatic, vaccinated patients are most likely to generate false-positive results in their tests, according to the Centers for Disease Control and Prevention. The odds come down to a numbers game: The CDC recommends not testing asymptomatic vaccinated patients due to the likelihood of false positives, noting that in areas where few people are infected and most are vaccinated, you're more likely to see a higher proportion of false positives in test results.

That said, if you are symptomatic, chances are you won't get a false-positive result, notes the CDC, because tests are typically most accurate after patients have shown symptoms (and most accurate within five to 10 days of the first signs of illness). In a March 2021 study of rapid tests across several brands, such tests also showed false positives only one percent of the time in symptomatic patients. (Related: The Most Common Coronavirus Symptoms to Look Out for, According to Experts)

Are Certain Types of COVID-19 Tests More Likely to Net a False Positive Result?

Generally, rapid antigen tests (the type typically used in at-home tests which test for protein fragments specific to the coronavirus) are accurate for symptomatic patients, with 99.6 percent accuracy in positive test results, according to a March 2021 study. Most of the currently authorized antigen tests can return results anywhere between 15 to 30 minutes, according to the CDC. Their individual accuracy can vary slightly in terms of delivering false positives, says Charlene Brown, M.D., public health physician and advisor for Everlywell, an at-home health testing company, though it's still very, very rare.

"Rapid antigen tests are useful if you need results fast, with results available in as little as 10 to 15 minutes," says Dr. Brown. "However, they're generally considered less accurate than PCR tests and may miss some cases. There is also a chance of getting a false positive due to the fact that no rapid test is 100 percent accurate. The accuracy rate varies among each specific test and can often be found directly on the test company's website."

Polymerase chain reaction tests (PCR tests) had a 97.2 percent accuracy rate in a January 2021 study, with a false-positive rate of nearly zero. They're typically most accurate about eight days after infection.

"PCR testing is considered the gold standard in SARS-Cov-2 detection and is generally more accurate than rapid tests," according to Dr. Brown. "The accuracy of PCR tests varies, and often depends on when someone is tested." (Related: How Effective Is the COVID-19 Vaccine?)

What’s the Best Way to Assure Your COVID-19 Test Results Are Accurate?

Let's face it: COVID-19 tests are uncomfortable but important. And, more often than not, the best way to get an accurate result is to take more than one test (Sorry!)

"Rapid antigen tests are great for convenience, but there are some tradeoffs for accuracy," says Dr. Brown. "Some rapid tests come in a two-pack for serial testing. Taking both tests can reduce the chance of false positives. It's important to follow rapid antigen tests up with confirmatory PCR testing since PCR tests are more reliable. The FDA-authorized rapid tests that are now available in stores and online tend to be more accurate if you're symptomatic." Dr. Brown adds that PCR tests are more likely to have a false-positive result within the first four days after infection, so getting tested twice within 10 days of exposure to the virus is a good way to ensure you have the most accurate result to keep yourself and others safe.

And, of course, no matter how many or what kind of COVID-19 tests you get, the best protection from the virus is to get the vaccine. For the folks who received the two-dose Pfizer-BioNTech vaccine, you may be eligible to receive a third shot six months after your second inoculation. Currently, those over the age of 65 and people who may be considered immunocompromised (such as recipients of organ transplants) can consider getting a booster.

The information in this story is accurate as of press time. As updates about coronavirus COVID-19 continue to evolve, it's possible that some information and recommendations in this story have changed since initial publication. We encourage you to check in regularly with resources such as the CDC, the WHO, and your local public health department for the most up-to-date data and recommendations.

Antivirus and anti-malware apps fill an important need on our computers, but they're not foolproof (*ahem*, McAfee ). More often than you'd think, they're just plain wrong. Here's what to do when you're not sure whether a download has a virus.

How to Fix the McAfee Restart Debacle on Your Machines

Reader Max Buser's company was hit by the bad McAfee update earlier today. Here's how they got…

On a regular basis, we get email from readers saying that some download we posted contains a virus, and we assure them that said download is clean. (Over the past five years, our track record in this arena is next to spotless.) So how do you know if a download really has a virus or not?

Lifehacker's Weirdest and Most Controversial Posts

Everybody gets a little ribbing at their birthday party, and we're no different. As part of…

There's no exact science when it comes to figuring out if a file has a virus or is just being detected as a false positive, but today we'll share a little background and some tips that will help you figure out whether a file really contains a virus or not.

Target breakouts and wrinkles at the same time
Each item is also free of all possible pore-cloggers and contains zero hormone disruptors.

What Is a False Positive Exactly?

A false positive is when your virus scanner detects a file as a virus, even when it really isn't a virus, and then tries to quarantine or delete that file. If you've read about the recent McAfee fiasco , you'll begin to see the problem—they released a virus definition update that detected internal Windows files as a false positive, deleted them, and then suddenly Windows couldn't boot anymore. Antivirus software is not perfect.

McAfee Update Shuts Down XP Machines

McAfee corporate customers across the globe using Windows XP experienced massive shutdowns today as

Some virus scanners also employ an additional line of defense called heuristic analysis , which attempts to identify new forms of malware right away by scanning for smaller sections of code that might indicate some bad behavior, even if the virus has never been detected before. Unfortunately, because this method is not exact, it also will detect a lot of files as viruses incorrectly.

Use VirusTotal to Check for False Positives

Whenever there's a possibility that a file you've downloaded might contain a virus, the first thing you should do is upload it to online virus scanning service VirusTotal , which instantly scans the file against 40 different antivirus engines at the same time, and gives you the results.

You can use the VirusTotal Uploader to instantly scan any file via your right-click context menu. (We'd highly recommend installing this small utility.) VirusTotal Uploader will upload any file you choose directly to the VirusTotal web site and run the scan without you having to hassle with annoying web upload forms. Even better, most of the time you don't even have to wait for the file to upload, since before uploading, the app checks your file's hash (a unique identifier, sort of like a fingerprint for files) against their database, so if they've already checked that file, you'll get instant results.

VirusTotal Uploader 2.0 Instantly Scans Files for Viruses Against 41 AV Apps

Windows only: Previously mentioned VirusTotal Uploader automatically uploads any file to online…

You'll sometimes find that files are caught as viruses by just a single virus scanner out of the 40, which is a good sign that you're dealing with a false positive from one of the more aggressive virus scanners. It should be noted that VirusTotal is not a replacement for using your favorite antivirus application , which offers real-time protection against a variety of attack vectors—but it is a strong supplement.

Five Best Antivirus Applications

Computer viruses are increasingly sophisticated and pervasive. If you can't afford to run your…

AutoHotkey and Overly Aggressive Virus Scanners

We're huge fans of the AutoHotkey scripting language around here, because it helps you simplify your life by turning any action into a hotkey . Many of the small utilities that we link to, like our own Lifehacker Code projects , are also written in AutoHotkey, or are provided as both a script and a compiled version.

Turn Any Action Into a Keyboard Shortcut: A Beginner's Guide to AutoHotkey

We waste a ton of time every day clicking through menus and typing repetitive text. AutoHotkey is…

Since the AutoHotkey language provides the ability to monitor keystrokes and mouse movements, it is often detected by heuristic virus scanners incorrectly as a keylogger or trojan—because those are the same type of internal Windows functions that a trojan might take advantage of to steal your password. This doesn't mean that the file necessarily has a virus.

The great thing about most AutoHotkey applications that we link to is that the source code is usually provided, so you can just open up the .ahk file yourself and see what exactly is going on. In fact, if you have AutoHotkey installed, you can run any .ahk file instead of the provided executable file.

Ask the Developer

You'd be surprised to find out just how easy it is to get in touch with some developers. People email us all the time asking about the false-positive AutoHotkey apps we host on the site, and we do our best to reply. Other developers—who aren't also sorting through hundreds of other tips emails every day—are probably even easier to get a hold of, and if they're legit, they care a great deal about what antivirus apps are saying about their software and will do whatever it takes to help. Again, you shouldn't necessarily trust everything said developer has to say, but if a developer is easy to contact, chances are they're making legit apps. It's the developers who are impossible to get a hold of (because it's in their best interest not to be found) that are a little more worrisome.

Use Your Judgment

If your antivirus software is telling you that a file contains a virus, you shouldn't blindly assume that you're dealing with a false positive; use that opportunity to ask yourself if you really need to install that application. If you do, make sure to check with VirusTotal first, make sure the download is from a reputable place, and then make that judgment call on your own.

So what about you? What do you do when a file is detected as a virus? Share your thoughts in the comments.

The How-To Geek prefers his AutoHotkey scripts in source code form. His geeky articles can be found daily here on Lifehacker, How-To Geek , and Twitter .

DISCUSSION

Not that I would ever use such software myself, but I have heard from a friend that apps for circumventing copy protection on software (such as WGA patching utilities or "warez") often get flagged as containing viruses. Is this because the AV industry just considers crackers to be malware, or are they actually loaded with nasty stuff?

A COVID-19 antigen test, also known as a rapid test, can be false positive. In fact, the rapid test false positive rate is one of the reasons many clinicians will follow up a rapid test with a PCR or molecular COVID-19 test. This confirms the rapid test result or reveals if the rapid test has been inaccurate in both positive and negative cases.

When can false positives happen with COVID-19 antigen tests? And what should be done to confirm the results or to stay safe? Here’s what you need and want to know about COVID-19 rapid test false positives.

Antigen Test False Positive Rate

Between false positives and false negatives, false-negative COVID-19 tests are far more common. A false negative COVID-19 test result means that you are told you don’t have the virus, but you actually do. A false positive COVID-19 test result, on the other hand, would mean you are told you have the virus, but in reality, you do not.

The antigen/rapid COVID test false positive rate was found to be less than 1% in March 2021. This means that in over 99% of cases where a rapid test is positive, the person actually does have COVID-19.

The antigen/rapid COVID test false-negative rate is much higher, between 25-30% of people in the first week of showing symptoms. Only around half of COVID-19 cases were detected by rapid tests in the second week.

That means that in a significant number of cases where a person gets a negative rapid test result, they are actually positive for COVID-19, especially if they have had the virus for longer than one week.

When can a COVID-19 Test Result in a False Positive or False Negative?

The timing of a patient’s COVID-19 test is just one factor that influences if a COVID-19 test gives an accurate or false result. Another cause of a false positive or false negative COVID-19 test is how common COVID-19 is in the surrounding community. As fewer people in the community have the disease, the number of false positives goes up. This is because it becomes statistically less likely that people in the area are getting sick. This is one reason the CDC recommends that rapid test results be confirmed with a PCR test, especially in rural areas where cases are low.

Another factor that drives an inaccurate COVID-19 test result is how the test is completed and managed in the laboratory setting. Especially with antigen/rapid tests, the FDA and CDC caution that the instructions must be followed to the letter for the test to provide accurate results. Risks could include not allowing the specimen enough processing time, or cross-contamination if multiple samples are being batch tested.

What Should Be Done if the COVID-19 Antigen Test Result is Positive?

Whether you conduct an at-home rapid COVID-19 test or get your results from a local care provider, it’s recommended by the CDC that you get a molecular COVID-19 test (PCR test) within 48 hours. While you are waiting to get the PCR test and get the PCR results, it’s important to quarantine, follow social distancing guidelines, wash your hands regularly, wear a mask, and follow other COVID-19 safety best practices to avoid infecting family, friends, and colleagues.

How to tell if a virus is actually a false positive

An exceedingly awkward moment occurred on The View last week when two of the hosts, Sunny Hostin and Ana Navarro, unexpectedly tested positive for COVID-19 while the show was live on the air. Those results later turned out to be false positives, but at the time, the kerfuffle was enough to derail the plans for the day—and for Vice President Kamala Harris's scheduled visit to switch to a virtual call.

“Since that show ended, however, this is the update—we were all given numerous, numerous COVID tests,” host Joy Behar said on the September 27, 2021, episode of The View. “Throughout the weekend this was happening, too. And I am thrilled to report that Sunny and Ana's Friday results turned out to be false positives and everyone is safe, healthy, and COVID-free.” Both hosts who (falsely) tested positive were fully vaccinated, which Hostin said brought her some comfort even when she thought she may have had the virus.

It was a messy situation and one that involved revealing people's health information to the public in a particularly vulnerable moment. The supposedly positive test results had ramifications for the hosts' families and personal lives, they explained. But the truth is that false-positive results are not uncommon, especially with rapid COVID-19 tests. Thankfully, though, most don't happen on live TV.

So, how common are false-positive COVID-19 results? First, it depends on the type of test you're taking. With tests that rely on polymerase chain reaction (PCR) technology to provide results, the results are generally considered to be more reliable. Although PCR tests are still the gold standard for diagnosing a COVID-19 infection, they can be uncomfortable and take a few hours to days to provide results, Yale Medicine explains. But rapid tests (typically antigen tests) are relatively cheap and can deliver your results within 15 to 30 minutes.

In a Cochrane review published in March involving 64 studies and more than 24,000 testing samples, the researchers found that the potential for false-positive and negative results from a rapid COVID-19 test varied widely. The accuracy and specificity of results depended on whether or not the person had symptoms, how long they'd had the potential infection, and the specific brand of test they were using.

Of the studies the researchers looked at, 58 evaluated rapid antigen tests. Their results showed that the tests were generally more reliable when someone had noticeable symptoms and during the first week of symptoms. On average, rapid antigen tests correctly identified those who had COVID-19 infections in 72% of people with symptoms and 58% of people without symptoms, Cochrane explains. These tests also correctly ruled out people who did not have COVID-19 infections in about 99% of cases, on average.

The sensitivity of the tests also depends on the overall prevalence of the virus in the pool of participants you're testing. For instance, at an estimated 5% prevalence, between 1 in 10 and 1 in 6 positive results would be false positives even for the most sensitive rapid antigen tests when used in symptomatic people. On the other end of the spectrum, at 0.5% and in asymptomatic people, between 7 in 10 and 9 in 10 positive results would be false positives. (Keep in mind that, in communities where the prevalence of the virus is high, there are fewer consequences for false-positive results and higher consequences for missed positive cases.)

Rapid antigen tests for COVID-19 are less sensitive than PCR tests, but you should never ignore a positive result.

9 June 2021 – by Linda Geddes

Rapid antigen tests for COVID-19 are less sensitive than PCR tests, but you should never ignore a positive result.

9 June 2021 – by Linda Geddes

Lateral flow tests (LFTs) can tell you if you’re infected with COVID-19 within minutes, rather than waiting 24-48 hours for the results of a PCR test. They’ve been suggested as a means of avoiding self-isolation or ensuring that it is safe to visit vulnerable people. However, because they are less accurate than PCR tests, the results need to be more carefully interpreted.

Sensitivity versus specificity

When people talk about the accuracy of different COVID-19 tests, what they often have in mind is their sensitivity. This is the ability of the test to accurately diagnose people who are infected with SARS-CoV-2. A recent Cochrane Review, which combined the results of multiple studies assessing the accuracy of LFTs, found that the average sensitivity of such tests was 72% among people with COVID-19 symptoms, and 58% for people without symptoms. This would mean that in for every 100 people infected with COVID-19 who had symptoms, only 72 of them would test positive on a LFT.

Most people who are infected with coronavirus remain contagious for 4–8 days, with most transmission occurring two days before to five days after developing symptoms.

Because of this relatively low sensitivity, a negative test result cannot guarantee that you aren’t infected – false negatives are reasonably common. So, if you have any symptoms of COVID-19, you should behave as if you are infected, which will mean self-isolating and ideally book a PCR test if possible.

However, if you get a positive test result, you can be more confident that you really are infected. This is because the specificity of LFTs – their ability to accurately diagnose uninfected individuals – is higher, and therefore false positives are highly unlikely. In people who did not have COVID‐19, LFTs correctly ruled in infection in 99.5% of people with COVID-like symptoms, and 98.9% of those without them.

Whether or not the test is being used in an area with many COVID-19 cases is also important. If an LFT (or any diagnostic test) is used in a context where the disease is very rare, the likelihood that a positive result is true is lower and the likelihood that a negative result is true is higher. Conversely, if an LFT (or any diagnostic test) is used in a context where the disease is very common, the likelihood that a positive result is true is higher and the likelihood that a negative result is true is lower.

Have you read?

This still means that a small number of people who receive a positive test result will be unnecessarily told to self-isolate (the precise number depends on the prevalence of the virus in the community at any given time). To reduce this risk, some countries ask anyone who tests test positive on a LFT to do a confirmatory PCR test.

Infection versus infectiousness

Although PCR tests are widely regarded as the most accurate way to diagnose COVID-19, one problem with them is that fragments of viral RNA can linger for weeks after infectious virus has been cleared – meaning you may test positive even though you no longer pose a risk to other people.

Most people who are infected with coronavirus remain contagious for 4–8 days, with most transmission occurring two days before to five days after developing symptoms. However, the average (median) duration of people testing positive using PCR is 22–33 days.

Even though LFTs are less sensitive than PCR, the Cochrane Review found that they were most accurate when used during the first week after symptoms developed (when 78% of confirmed cases recorded a positive LFT result). This is most likely because people have more virus in their bodies at this time.

For this reason, some governments, such as the UK, are exploring whether daily LFTs could be used as an alternative to quarantine for close contacts of people with COVID-19. The contacts are required to test themselves each morning for seven days. Those who test negative and develop no symptoms are permitted to leave their homes to carry out essential activities, including work. They must then take another test the next morning to see if they need to self-isolate that day, or can continue to leave the house for essential activities.

Children are always going to find cunning ways to bunk off school, and the latest trick is to fake a positive COVID-19 lateral flow test (LFT) using soft drinks.

So how are fruit juices, cola, and devious kids fooling the tests, and is there a way to tell a fake positive result from a real one? I’ve tried to find out.

First, I thought it best to check the claims, so I cracked open bottles of cola and orange juice, then deposited a few drops directly onto LFTs. Sure enough, a few minutes later, two lines appeared on each test, supposedly indicating the presence of the virus that causes COVID-19.

It’s worth understanding how the tests work. If you open up an LFT device, you’ll find a strip of paper-like material, called nitrocellulose, and a small red pad, hidden under the plastic casing below the T-line.

Absorbed to the red pad are antibodies that bind to the COVID-19 virus. They are also attached to gold nanoparticles (tiny particles of gold actually appear red), which allow us to see where the antibodies are on the device.

When you do a test, you mix your sample with a liquid buffer solution, ensuring the sample stays at an optimum pH, before dripping it on the strip.

How to tell if a virus is actually a false positive

Two COVID-19 at-home tests show fake positives due to cola and orange juice. (Mark Lorch)

The fluid wicks up the nitrocellulose strip and picks up the gold and antibodies. The latter also bind to the virus, if present. Further up the strip, next to the T (for test), are more antibodies that bind the virus.

But these antibodies are not free to move – they are stuck to the nitrocellulose. As the red smear of gold-labeled antibodies passes this second set of antibodies, these also grab hold of the virus.

The virus is then bound to both sets of antibodies – leaving everything, including the gold, immobilized on a line next to the T on the device, indicating a positive test.

Gold antibodies that haven’t bound to the virus carry on up the strip where they meet a third set of antibodies, not designed to pick up COVID-19, stuck at the C (for control) line. These trap the remaining gold particles, without having to do so via the virus.

This final line is used to indicate the test has worked.

Acid test

So how can a soft drink cause the appearance of a red T line?

One possibility is that the drinks contain something that the antibodies recognize and bind to, just as they do to the virus. But this is rather unlikely. The reason antibodies are used in tests like these is that they are incredibly fussy about what they bind to.

There’s all sorts of stuff in the snot and saliva collected by the swabs you take from the nose and mouth, and the antibodies totally ignore this mess of protein, other viruses, and remains of your breakfast. So they aren’t going to react to the ingredients of a soft drink.

A much more likely explanation is that something in the drinks is affecting the function of the antibodies. A range of fluids, from fruit juice to cola, have been used to fool the tests, but they all have one thing in common – they are highly acidic.

The citric acid in orange juice, phosphoric acid in cola and malic acid in apple juice give these beverages a pH between 2.5 and 4. These are pretty harsh conditions for antibodies, which have evolved to work largely within the bloodstream, with its almost neutral pH of about 7.4.

Maintaining an ideal pH for the antibodies is key to the correct function of the test, and that’s the job of the liquid buffer solution that you mix your sample with, provided with the test.

The critical role of the buffer is highlighted by the fact that if you mix cola with the buffer – as shown in this debunking of an Austrian politician’s claim that mass testing is worthless – then the LFTs behave exactly as you’d expect: negative for COVID-19.

So without the buffer, the antibodies in the test are fully exposed to the acidic pH of the beverages. And this has a dramatic effect on their structure and function.

Antibodies are proteins, which are comprised of amino acid building blocks, attached together to form long, linear chains. These chains fold up into very specific structures. Even a small change to the chains can dramatically impact a protein’s function.

These structures are maintained by a network of many thousands of interactions between the various parts of the protein. For example, negatively charged parts of a protein will be attracted to positively charged areas.

But in acidic conditions, the protein becomes increasingly positively charged. As a result, many of the interactions that hold the protein together are disrupted, the delicate structure of the protein is affected and it no longer functions correctly. In this case, the antibodies’ sensitivity to the virus is lost.

Given this, you might expect that the acidic drinks would result in completely blank tests. But denatured proteins are sticky beasts. All of those perfectly evolved interactions that would normally hold the protein together are now orphaned and looking for something to bind to.

So a likely explanation is that the immobilized antibodies at the T-line stick directly to the gold particles as they pass by, producing the notorious cola-induced false-positive result.

Is there then a way to spot a fake positive test? The antibodies (like most proteins) are capable of refolding and regaining their function when they are returned to more favorable conditions.

How to tell if a virus is actually a false positive

(Mark Lorch)

Above: A COVID-19 test with a fake positive caused by cola and a COVID-19 test that used cola after it was washed with a buffer.

So I tried washing a test that had been dripped with cola with buffer solution, and sure enough, the immobilized antibodies at the T-line regained normal function and released the gold particles, revealing the true negative result on the test.

Children, I applaud your ingenuity, but now that I’ve found a way to uncover your trickery I suggest you use your cunning to devise a set of experiments and test my hypothesis. Then we can publish your results in a peer-reviewed journal.

Mark Lorch, Professor of Science Communication and Chemistry, University of Hull.

This article is republished from The Conversation under a Creative Commons license. Read the original article.