Welcome to RCF - WHF

rb2d2 · Sep 25, 2004

How To Handle Suspicious False Positive Detection?

Steps to work with suspicious False Positive (FP):

- Update your AVG Free Edition and scan the file once more (right-click on the file, choose "Scan with AVG") to make sure the FP wasn't fixed yet.
- If AVG still detects the malware and you suspect a file to be a false positive, test the file at Jotti Virusscan or alternatively at VirusTotal to check for detection ratio between several AntiVirus vendors. If the result points to possible false positive, archive (zip, arc, tar etc) the file using a password and email a copy to with a brief description as well as the password you used to archive it with. Depending on the load of Virus analysis, you will receive a response to your query soon.

Note: To test the file you may have to restore the file from the Virus Vault and you may need to temporarily disable the Resident Shield in order to allow the upload for the test. If the Resident Shield is not disabled and you try to upload it for the test or when emailing, it will be blocked and you will be shown that 0 bytes were uploaded.

To disable AVG temporarily, have a look at FAQ 1311.

For further options, see FAQ 2437.

How to create archive password-protected - see FAQ 1341.

There are also other types of False Positives, than just files:

Website false positives

To report a false positive for a website detection... just send an email to and include a link to the website in question along with the information of what was being detected.

Registry false positive

If its a registry key that is a false positive, please export the registry key
- Start > Run > regedit
- find the key
- right click > Export
Add it into password protected archive and send to for further analysis. Please also include what the password you used when you created the archive.

binky

fishead · Feb 09, 2005

Well I suspect avg told me it was a real threat so I would get the paid version. I did enough, I sent them the report and they replied. Next I checked around and found new toshibas are getting false positives all over the place, especially with movie factory - coral. I checked their forum to see what they are telling people in there, and they are telling them what I posted above, get paid version or go through a lot of trouble to correct this false detection.

I did run another scan and it didn't find anything in that file.

I can't say I blame them for wanting money, thats what its all about, no one works for free for long. The internet is getting trickier and trickier, its too bad it has to be that way but whos going to pay when they don't have too? No one.