Where to report/submit false positive samples of antivirus software
As a software developer, do you know which feature of your software your users appreciate the most?
We developed SofMeter, the free in-app analytics tool, to answer questions like that.
With SoftMeter you will see how the users are using your software, discover which features are used the most or least, and understand where you should focus your development efforts to maximize your sales.
As a desktop software developer, you might find that one of the many antivirus software flags your perfectly clean software as suspicious.
This can happen for a variety of reasons, including:
- Your software is not code-signed.
- Your software is not very popular so the antivirus engines do not have enough knowledge about it.
- New scan engines that scan the files using artificial intelligence (AI) find resemblance of your software with known computer threats.
- Your software is a small command-line utility, developed in low-level languages, e.g. C/C++.
Usually, the software developer will get an email from a user saying that their AV software caught their program as suspicious and blocked it or discourages the user from running it.
If this happens, here is what you need to do if you are the developer or the end-user of the software:
Desktop software developers | End-users of software |
---|---|
|
|
*False positive: a test result which wrongly (falsely) indicates (positive) that a particular condition (virus body) was detected.
List of antivirus software and their false positive submission URLs
Below we started a list of the URLs where software developers can submit their software for further analysis. After the analysis is complete the antivirus software makers update their engines and the new patterns are distributed to the users in a couple of days.
Antivirus software | For desktop software developers: Submit false positive |
For end-users and developers: Free antivirus scanner |
---|---|---|
360 Total Security |
If you think the file intercepted by 360 Total Security is not a Trojan horse or virus files, please send it to us for analysis Submit via a form. |
|
Adaware |
Report a suspected false positive. |
|
AhnLab |
Report a suspected false positive. (Requires login) |
|
Avast antivirus |
Report a suspected false positive. |
|
AVG antivirus |
Report a suspected false positive. |
|
Avira antivirus |
||
BitDefender |
Submit a sample file or URL. |
Download a free antivirus edition (for Windows or MacOS) to scan the files locally. |
Check Point |
Sometimes the Check Point Spyware Scanner inappropriately detects an application as Spyware. If you have come across what seems to be identified as malicious Spyware, but in fact it is not, you can report such detection to the Check Point Security Team. Report a false positive (by email). |
|
ClamavNet |
Use the following form to report your false positive. |
|
Eset antivirus |
You have a suspicious file, suspicious website, potential false positive or potential miscategorization by Parental Control (or Web control)that you would like to submit to ESET for analysis. Submit a virus, website or potential false positive sample to the ESET lab. |
|
F-secure antivirus |
Think a file is harmful? Or that a file or website was incorrectly detected or rated? Submit it for analysis. |
F-secure free virus scanner (for Windows). It does a generic 3' scan and does not give you the ability to scan a specific folder or file that you are interested in. |
Kaspersky |
False detections by Kaspersky products / What to do with the false detections: instructions. |
Free online tool to analyse files and website pages: OpenTip. |
Malwarebytes antivirus |
Is Malwarebytes incorrectly flagging a program or website? Report it at the Malwarebytes forum. |
|
McAfee |
For end-users: Submit potential false positives from the product or through Global Threat Intelligence to McAfee Labs. Report it here. McAfee makes it really hard for both the users to send false positives back to them. By submitting a false positive, the users help the AV companies to fix their threat detection algorithms. So they deserve at least an easy way to do that. Normally, antivirus software have a button that the user can click to send a suspicious file for further analysis to the company. There is no such option in McAfee. The users have to prepare a specifically formatted email and provide .sup files. Probably not many users or developers will invest all the effort needed to submit a false positive. |
|
For developers: How to submit your company's software to be considered for whitelisting Customers, partners, and other third-party software manufacturers can submit their own propriety software for inclusion in the McAfee False Positive Test Rig. This ability to submit significantly reduces the chances of a DAT causing false positives on unique customer applications or data. |
||
Microsoft defender |
Report your false-positive to Microsoft. You will need to login with a Microsoft account. |
Microsoft safety scanner. |
Norton |
Submit false positive. |
Free offline scanner, Norton Power Eraser. |
VirusTotal |
Virus total has also launched a special tool for developers and antivirus vendors, the VirusTotal Monitor. VirusTotal Monitor is a service to mitigate false positives. |
You can upload your software to VirusTotal to be scanned by 70+ antivirus engines. If one or more of the engines detect your software as a false-positive threat, you can find here the details of each engine and contact them with your false-positive sample. List of virus scan engines. |
SecureAPlus |
Report false positive files if you think that a detection made by one of the cloud engines of the Universal AV scanner is not actually a virus or malware. Report False Positive. |
Comments
Patrice Martel (not verified)
Fri, 09/18/2020 - 20:24
Permalink
Kaspersky
Why does Kaspersky is not on the list? It's one of the most used antivirus in the world.
web admin
Tue, 09/22/2020 - 11:21
Permalink
Thanks for pointing this out.
Thanks for pointing this out. Kasperksy and its free online scan tool were added to the list of antivirus software.
Kristof Mulier (not verified)
Fri, 01/01/2021 - 17:06
Permalink
This is a great article!
This is a great article! Thank you very much for compiling this list.
Unfortunately, submitting an executable is only a short term solution. As a startup software company, we release new versions almost every week. Our software is young (alpha version) and needs bugfixes and feature updates very regularly. Is it possible to submit a certificate (eg. an EV-certificate from Sectigo) to be added to the whitelists of antivirus companies?
Kind regards,
Kristof Mulier
embeetle.com
Add new comment