Where to report a false positive from virustotal.com?

[Detlef]

Sorry, not using malwarebytes. But I have a false positive on virustotal.com for a file I've just compiled with VisualStudio (a c++ app).

 

[miekiemoes]

Hi,

Please zip and attach the file, so we can have a look.

Thanks!

[Detlef]

1 minute ago, miekiemoes said:

Hi,

Please zip and attach the file, so we can have a look.

Thanks!

Here you are.

Station.zip

[miekiemoes]

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Also see here for more explanation: https://forums.malwarebytes.com/topic/238670-machinelearninganomalous-detections-and-explanation/
Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

This should be fixed by now. Please give it some time (max 10 minutes) in order to have it populate, so detection won't happen anymore.
 

[Detlef]

On 5/12/2021 at 6:27 PM, miekiemoes said:

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Also see here for more explanation: https://forums.malwarebytes.com/topic/238670-machinelearninganomalous-detections-and-explanation/
Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

This should be fixed by now. Please give it some time (max 10 minutes) in order to have it populate, so detection won't happen anymore.
 

It's still detected on virustotal.com today. Please check!

 

[Porthos]

7 hours ago, Detlef said:

t's still detected on virustotal.com today. Please check!

The attached file is not detected by the consumer or commercial versions of Malwarebytes.

The engine format and configuration in VirusTotal is different than the consumer and corporate products’ default configuration. In VirusTotal Malwarebytes uses a command-line engine with different configuration and detection techniques/heuristics which might detect more than the commercial product. There are also false-positive suppression mechanisms in the commercial product which are not present in the command-line engine in VirusTotal.

This will eventually fix itself in Virustotal as well, as Malwarebytes has no control over this. Virus Total is having trouble reaching Malwarebytes cloud.

[Detlef]

13 hours ago, Porthos said:

The attached file is not detected by the consumer or commercial versions of Malwarebytes.

 

The engine format and configuration in VirusTotal is different than the consumer and corporate products’ default configuration. In VirusTotal Malwarebytes uses a command-line engine with different configuration and detection techniques/heuristics which might detect more than the commercial product. There are also false-positive suppression mechanisms in the commercial product which are not present in the command-line engine in VirusTotal.

 

This will eventually fix itself in Virustotal as well, as Malwarebytes has no control over this. Virus Total is having trouble reaching Malwarebytes cloud.

 

Thanks, will check again next week.

[Detlef]

FYI: Today (Monday 17 May) it's still detected as false-positive by virustotal.com. I've contacted their helpdesk and they replied with this:

 

María (VirusTotal)

May 17, 2021, 10:33 AM GMT+2

Hi Detlef,

We don't scan files or URLs ourselves. We receive results from different AV vendors. If it's still listed as malware in our results it's because the AV vendor hasn't sent us updated results. Once they send us updated results, the information is automatically updated in VirusTotal.

If after some days it's still flagged, please contact the AV vendor and let them know that they have to send updated results to VirusTotal.

Thank you

Best regards,
María - VirusTotal - www.virustotal.com

So please send "updated results" to virustotal to get this off the table!

[miekiemoes]

Hi,

We are working with the Virustotal team already to resolve this. It has been whitelisted for a while already, but for some reason, it won't reflect in VT, so they are looking into this as well.