How to Report False Positives to Antivirus Vendors
If your Windows binary is flagged by an antivirus engine, the fix is to submit it directly to the vendor for re-evaluation. False positives happen with signed and unsigned binaries alike. Below are submission contacts for 100+ AV engines, with direct links to forms, email addresses, and tips for each one.
Before you submit
- Confirm your file is clean. Scan locally with the engine in question (or with a multi-engine scanner) before reporting.
- Always include the evidence: a multi-engine scan report URL and the exact detection name (for example "Win32:Malware-gen" or "Trojan.GenericKD.12345") in your submission.
- For email submissions, send from a domain with SPF, DKIM, and DMARC configured. Vendors silently drop poorly-authenticated mail.
- Most vendors respond within 1 to 5 business days. Some never respond. Resubmit weekly until the detection is removed.
- 32-bit binaries produce significantly more false positives than 64-bit. If you ship both, prioritise signing the 64-bit build first.
- Code signing alone does not stop heuristic flags. Reputation builds slowly as your signed binaries are downloaded over time.
| Vendor | How to submit | Notes |
|---|---|---|
| 0-9 | ||
| 360 | open.soft.360.cn/report.php sampleup.sd.360.cn kefu@360.cn | Chinese consumer AV. English submissions are accepted but response times can be longer. |
| A | ||
| Acronis | virustotal-falsepositive@acronis.com | Cyber Protect product. The dedicated VT FP address is monitored separately from general support. |
| Ad-Aware (Lavasoft) | adaware.com/report-false-positives malware.labs@adaware.com | - |
| ADMINUSLabs | samples@adminus.net | - |
| Agnitum | trojans@agnitum.com | - |
| AhnLab-V3 | v3sos@ahnlab.com e-support@ahnlab.com samples@ahnlab.com | v3sos@ahnlab.com is the recommended address. |
| alphaMountain.ai | alphamountain.freshdesk.com support@alphamountain.freshdesk.com | - |
| AliCloud | antivirus@alibabacloud.com | - |
| Alibaba | virustotal@list.alibaba-inc.com | - |
| ALYac (ESTsecurity) | esrc@estsecurity.com | - |
| Antiy-AVL | support@antiy.cn avlsdk_support@antiy.cn | - |
| Arcabit | vt.fp@arcabit.pl | - |
| Arctic Wolf | virustotal@arcticwolf.com | Formerly Cylance. |
| Avast | avast.com/report-false-positive DL-Virus@gendigital.com | Owned by Gen Digital. The DL-Virus@gendigital.com address also covers Avira, AVG, and Norton. |
| Avira | avira.com/en/analysis/submit novirus@avira.com | Owned by Gen Digital. Skyhigh SWG also accepts the Avira submission process for its routes. |
| AVG | avg.com/false-positive-file-form | Shares the Avast engine and submission backend under Gen Digital. |
| B | ||
| Babable | obu@babable.com | - |
| Baidu | bav@baidu.com gaoyingchun@baidu.com | - |
| BitDefender | bitdefender.com FP form virus_submission@bitdefender.com oemsamples@bitdefender.com | A free standalone scanner is available on bitdefender.com to reproduce the detection locally before submitting. |
| Bkav Pro | fpreport@bkav.com bkav@bkav.com | - |
| ByteHero | bytehero@163.com | - |
| C | ||
| Certego | certego.net/contact fp@certego.net | - |
| Chong Lua Dao | chongluadao.vn/en/report/reportmistake | - |
| ClamAV | clamav.net/reports/fp | Open source. Now maintained by Cisco/Talos. Fix lands once the corresponding signature is updated upstream. |
| Clean-MX | abuse@clean-mx.de | - |
| CMC | support@cmccybersecurity.com PSIRT@cmccybersecurity.com | - |
| CRDF Labs | threatcenter.crdf.fr/false_positive.html | - |
| CrowdStrike Falcon | VTscanner@crowdstrike.com | Enterprise EDR engine. Expect one to two weeks for processing, sometimes longer for low-prevalence files. |
| CTX (SaintSecurity) | root@malwares.com | - |
| CyanSecurity | virustotal@cyansecurity.com | - |
| Cybereason | vt-feedback@cybereason.com | EDR vendor. The vt-feedback@ address is specifically for VirusTotal-surfaced false positives. |
| Cynet | soc@cynet.com | - |
| CyRadar | m.me/CyRadarInc virustotal@cyradar.com | Also accepts reports via Facebook Messenger. |
| Cyren | cyren.com FP page support@cyren.com | - |
| D | ||
| Deep Instinct | vt-fps-requests@deepinstinct.com | Pure deep-learning prevention engine. Lone Deep Instinct hits often indicate unusual file structure rather than malicious intent. |
| DNS8 | dns8@layer8.pt | - |
| Dr.Web | vms.drweb.com/sendvirus vms@drweb.com | - |
| E | ||
| eGambit (TEHTRIS) | tehtris.com FP page | - |
| Elastic | discuss.elastic.co FP thread | - |
| Emsisoft | emsisoft.com/contact fp@emsisoft.com submit@emsisoft.com | Use fp@emsisoft.com for false positives specifically. |
| Endgame | info@endgame.com | - |
| eScan (Microworld) | support.mwti.net ticket samples@escanav.com | - |
| ESET-NOD32 | samples@eset.com | ESET also accepts re-evaluation requests via their regional support portal. |
| F | ||
| F-Prot | viruslab@f-prot.com | - |
| F-Secure / WithSecure | f-secure.com submit a sample spyware-samples@f-secure.com vsamples@f-secure.com | F-Secure is the consumer brand; WithSecure is the enterprise spin-off (2022 demerger). Both share the same submission backend. |
| Filseclab | fp@filseclab.com | - |
| Forcepoint (Websense) | support.forcepoint.com article suggest@forcepoint.com | URL and file submission forms are linked from inside the KB article. |
| Fortinet | fortiguard.com classification dispute submitvirus@fortinet.com | The FortiGuard dispute form is the preferred path. Email is a fallback. |
| G | ||
| GData | gdata.de submit form | GData licenses the BitDefender engine. Some detections also need a fix on the BitDefender side. |
| safebrowsing.google.com report google-at-virustotal@google.com | For files hosted on Google Drive, use the Request a Review feature inside Drive. | |
| Gridinsoft | gridinsoft.com/incorrect-detection virus@gridinsoft.com antimalware@gridinsoft.com | - |
| H | ||
| Hacksoft | virus@hacksoft.com.pe | - |
| Hauri | viruslab@hauri.co.kr | - |
| Huorong | seclab@huorong.cn | - |
| I | ||
| Ikarus | fp@ikarus.at samples@ikarus.at false-positive@ikarus.at | Austrian AV lab. fp@ikarus.at is the dedicated false-positive route; the other addresses go to the same team. |
| Invincea | info@invincea.com | - |
| J | ||
| Jiangmin | support@jiangmin.com shaojia@jiangmin.com | - |
| K | ||
| K7 (K7GW) | support.k7computing.com ticket reportfp@labs.k7computing.com k7viruslab@labs.k7computing.com | Indian AV vendor. The ticket portal tends to give faster turnaround than email. |
| Kaspersky | opentip.kaspersky.com newvirus@kaspersky.com | OpenTIP also lets you upload a file directly for re-evaluation. |
| Kingsoft (Cheetah) | ti@mingting.cn | - |
| L | ||
| Lionic (AegisLab) | lionic.com FP report support@lionic.com support@aegislab.com | - |
| M | ||
| Malwarebytes | forums.malwarebytes.com FP support.malwarebytes.com request | On the support request form, set the issue type to "False-positive". |
| Malwares.com (Saint Security) | kog@stsc.com | - |
| MaxSecure | tech@maxpcsecure.com | - |
| McAfee | mcafee.com KB article virus_research@mcafee.com | Consumer (McAfee) and gateway (McAfee-GW-Edition) detections route to separate teams. |
| McAfee-GW-Edition | datasubmission@mcafee.com | - |
| Microsoft Windows Defender | microsoft.com/wdsi/filesubmission | Use the "Software developer - false positive" option. A Microsoft account is required and lets you track submission status. Enterprise customers with a Software Assurance ID get priority handling. |
| N | ||
| NANO-Antivirus | nanoav.ru report page false@nanoav.ru | - |
| Netcraft | report.netcraft.com/report/mistake | - |
| Norton | submit.norton.com | Owned by Gen Digital. submit.norton.com is the current portal. |
| nProtect (Inca) | virus_info@inca.co.kr | - |
| P | ||
| Palo Alto Networks | live.paloaltonetworks.com VT vt-pan-false-positive@paloaltonetworks.com | - |
| Panda | falsepositives@pandasecurity.com virussamples@pandasecurity.com | Now part of WatchGuard. falsepositives@ is the dedicated FP route. |
| Phishing Database | github.com/mitchellkrogza/Phishing.Database | See the "Please remove my domain from this list" section of the README. |
| Q | ||
| Qihoo-360 | 360totalsecurity.com FP support@360safe.com | - |
| QuickHeal | techsupport.quickheal.com FP viruslab@quickheal.com | Pune-based Indian AV. Use the dedicated FP form rather than the generic support email. |
| R | ||
| Rising | fp@rising.com.cn | - |
| RocketCyber | support@rocketcyber.com | - |
| S | ||
| Sangfor Engine Zero | Contact via Sangfor support portal. | Sangfor documents the submission process via a PDF guide rather than a public form. |
| Scrutiny | training@cyberstanc.com | - |
| Seclookup | info@seclookup.com | - |
| SecureAge APEX | secureage.com FP report | - |
| SentinelOne (Static ML) | report@sentinelone.com | Static ML is the only SentinelOne engine on VirusTotal. Lone ML hits without other engine confirmation are usually false positives. |
| Skyhigh (SWG) | success.skyhighsecurity.com docs virus_research_gateway@avertlabs.com | Skyhigh also accepts the Avira submission process. |
| SOCRadar | vt@socradar.io contact@socradar.io | - |
| Sophos | support.sophos.com/filesubmission samples@sophos.com | Sophos Home is free and runs the same engine locally, useful for reproducing the detection before submitting. |
| Spamhaus | spamhaus.org DBL removal | - |
| Symantec (Broadcom) | symsubmit.symantec.com false.positives@broadcom.com | Owned by Broadcom. symsubmit is preferred. Endpoint Protection customers should also open a Broadcom support case. |
| Systweak | support.systweak.com ticket | - |
| T | ||
| Tachyon | isarc@inca.co.kr | Send a password-protected zip and include the exact detection name. |
| Tencent | TAVfp@tencent.com | Chinese AV. English submissions accepted; include the VT report URL in the email body for fastest handling. |
| TheHacker | virus@hacksoft.com.pe falsopositivo@hacksoft.com.pe | - |
| Trapmine | fp@trapmine.com | Acquired by SonicWall in October 2023. The legacy fp@trapmine.com address may no longer be actively monitored. |
| Trellix (FireEye) | datasubmission@trellix.com malware_research_gateway@trellixsecurity.com | Result of the 2022 McAfee Enterprise + FireEye merger. Use "Possible False" as the email subject and attach the sample. |
| TrendMicro | trendmicro.com re-evaluation virus_doctor@trendmicro.com | Re-evaluations typically complete within three to five business days. |
| Trustlook | bd@trustlook.com | - |
| Trustwave | support.trustwave.com review ADavidi@trustwave.com | - |
| V | ||
| Varist | SampleFP@avsubmit.com support@varist.com | - |
| VBA32 | feedback@anti-virus.by support-en@anti-virus.by | - |
| VIPRE | helpdesk.vipre.com request | - |
| VirIT | tgsoft.it/italy/file_sospetti.asp | - |
| VirusDie | partners@virusdie.com | - |
| W | ||
| Webroot | webroot.com vendor dispute snup.webrootcloudav.com upload | BrightCloud-backed engine. Use the vendor dispute form for SecureAnywhere detections. |
| Webroot SMD | brightcloud.com file change request | - |
| X | ||
| Xcitium (Comodo) | comodo.com submit malwaresubmit@avlab.comodo.com security@xcitium.com | The free Valkyrie sandbox at valkyrie.comodo.com shows why the engine flagged the file. |
| XVirus | xvirus.net/submit samples@xvirus.net | - |
| Y | ||
| Yandex | yandex-antivir@support.yandex.ru | Russian AV. English submissions are accepted. |
| Yomi | yomi-false-positives@yoroi.company | - |
| Z | ||
| Zillya | zillya.com/support virus@zillya.com help@zillya.com | - |
| ZoneAlarm by Check Point | zonealarm_VT_reports@checkpoint.com | Owned by Check Point. ZoneAlarm-specific FPs route to this address. |
| Zoner | false@zonerantivirus.com | - |
Spot a stale or incorrect entry? Let us know via the contact form and we will update the page.