VirusTotal will track false positive

The authoritative web resource VirusTotal , which is the most common online service for checking files and URL links by various AV scanners, has introduced an additional notification mechanism for so-called. false positive. This concept means a clean (non-infected) file that is detected (erroneously) as a malicious program by one or more anti-virus scanners. False positives themselves are quite common and detection from a clean file can be removed by the vendor within a few hours, however, this approach misleads the user.



One of the mechanisms that VirusTotal has long introduced to protect against false-positive is voting for file status. The user of the service or a member of the community can vote for the file with the “Harmful” or “Harmless” status. This verification mechanism allows you to assess the accuracy of the verdicts of AV-scanners, in addition, it helps to identify potentially malicious files before they are detected by vendors. In the case of the presence of a very large number of voices “Harmless”, we can say that the file is clean, and if the file is detected by the antivirus, then we are dealing with false positive.
')
The new VirusTotal feature introduces an additional check for false positives, and also shows a special notification to the user. Such a notification is shown below in the screenshot that was taken from the VirusTotal blog mentioned above. This is a standard Windows application "calculator", which the service itself considered clean, regardless of the verdict of AV-scanners .



The added function of detecting clean files is based on the so-called. collections of clean files or their metadata. As follows from the blog quote on VirusTotal, which is given below, Microsoft was the first to start cooperating with VirusTotal and provide information about its trusted files, which led to the recognition of 6 thousand clean files.

Microsoft, one company, one Microsoft, one of the most recent ones: It’s a good idea to make a positive difference.