topic Re: How to report false positive on Virustotal.com? in VirusTotal

How to report false positive on Virustotal.com?

SoulSurfer — Tue, 21 May 2024 21:49:59 GMT

Hello,

File Hash: c31341b8ed142e4fe4d8ead6ef773b99394fb8efd5bfae6af763c592bf460017
Link to Virustotal report for the file: https://www.virustotal.com/gui/file/c31341b8ed142e4fe4d8ead6ef773b99394fb8efd5bfae6af763c592bf460017/detection
Current VirustTotal Verdict: Generic.ml
Description: Barcode Recognition SDK, library for developers

We are software development company, one of our .exe files has been detected as malware on Virustotal.com by Palo Alto Networks antivirus.

What is the correct way to report false positive? I've tried to submit false positive by e-mail provided on virustotal.com false positive report vendors list (https://docs.virustotal.com/docs/false-positive-contacts), but it is not possible to send .exe or password protected archive because of e-mail declined by Palo Alto mail server, so I've just sent a Virustotal hash, but didn't get any notification back that request has been received.

Re: How to report false positive on Virustotal.com?

Claw4609 — Thu, 16 May 2024 13:07:43 GMT

Hello,

Do you have an active Palo Alto support account? If so you can open a tac case and follow these KBs.

How to Submit a Vulnerability Signature False Positive - Knowledge Base - Palo Alto Networks

How to submit Anti-Virus False Positive - Knowledge Base - Palo Alto Networks

Re: How to report false positive on Virustotal.com?

SoulSurfer — Thu, 16 May 2024 13:09:05 GMT

I am not Palo Alto Networks customer, so am not able to create support account.

Re: How to report false positive on Virustotal.com?

Claw4609 — Thu, 16 May 2024 13:15:16 GMT

You could try contacting their support through here, granted they may not be able to assist without a contract. Otherwise you may just have to wait for confirmation on your email to them or their are PAN employees that monitor this and could see this and assist

Re: How to report false positive on Virustotal.com?

SoulSurfer — Thu, 16 May 2024 13:32:09 GMT

On virustotal.com false positive report vendor contact list (https://docs.virustotal.com/docs/false-positive-contacts) there is e-mail address (vt-pan-false-positive@paloaltonetworks.com) where you can send false positive report, but when you try to send .exe or password protected archive, e-mail will be automatically declined. So I've sent just explanation with virustotal.com hash many days ago, but nobody replied back, even with some automatic notification with "Thank you, your request has been received".

In Contact Us if I press on create a case on support portal, I open a page with "An unexpected error has occurred. Please contact support." and it leads to phone numbers list in different countries, but my country not in the list.

Is it the only option to contact IT company support is grab the phone and call to abroad? 😄

Re: How to report false positive on Virustotal.com?

DaBone — Mon, 20 May 2024 20:59:54 GMT

Hello,

Please follow the pin post at the top of this forum for how to provide the information we need for VT file reviews. This post can be found here:

Pinned Post

Re: How to report false positive on Virustotal.com?

SoulSurfer — Tue, 21 May 2024 07:30:52 GMT

Hello, what is missing in my first post?

Re: How to report false positive on Virustotal.com?

DaBone — Tue, 21 May 2024 17:38:18 GMT

We would like to know the actual description of this file. What does it do, what is the purpose for this file? A more description description will give us a better idea of what this file's purpose is so that we can understand why it maybe doing what it's doing.

Re: How to report false positive on Virustotal.com?

SoulSurfer — Tue, 21 May 2024 21:53:52 GMT

First post amended, this is library for developers, file is digitally signed, are there any option to report in more private manner and provide file or download link on our company website?

Re: How to report false positive on Virustotal.com?

DaBone — Tue, 21 May 2024 22:51:38 GMT

That should be all that is needed. Thank you for the detailed description. This file has been submitted for review.

Re: How to report false positive on Virustotal.com?

SoulSurfer — Wed, 22 May 2024 07:39:49 GMT

Is it possible to report by email vt-pan-false-positive@paloaltonetworks.com provided on https://docs.virustotal.com/docs/false-positive-contacts website? Is this e-mail monitored by someone? I did sent a request on 14 May 2024 but never get answer back, even automatic notification that request has been received.

Re: How to report false positive on Virustotal.com?

DaBone — Wed, 22 May 2024 22:46:02 GMT

I'm not aware of anyone monitoring the PAN email. This is the forum for requesting verdict changes for non-Palo Alto Networks customers.

As for your file, the verdict has been updated; this is no longer deemed malware.