False Positive Contacts

⚠️

Note on False Positives

VirusTotal only aggregates data from a variety of vendors. We produce no verdicts of our own and as such, we can’t modify these results. We are not intended to be an authoritative reputation engine, but rather provide intelligence and context to users so that they can make the best decision. 1/60 and even 5/60 doesn’t automatically mean “Bad”, and 0/60 doesn't always mean good. Each decision on whether something is malicious ultimately the responsibility of users or the security vendors who use the data to improve their services.

Below are the steps to take if you want to fix a false positive report.

• If the false positive is for a File or a URL try re-scanning first.
• If the false positive persists please reach out to the vendor that is producing it providing a link to the VirusTotal report. List of vendor contacts can be found at the table below.
• If you do reach out to us, we will tell you to reach out to the vendors, as we will not be able to modify any results of scans.
• We cache some URL results. If vendors have confirmed removal but a URL is still detecting, please reach out to us along with evidence that the vendor has removed your URL from the blacklist, as we may be able to speed up propagation.

⚠️

Note on reporting False Positives

Before reporting a False Positive, please make sure that the engine team you are engaging is responsible for the type of indicator you want to report here!

• Files - Antivirus products
• Network indicators - Website/domain scanning engines & datasets

Below is a list of vendor contacts that may help: