How to report a file false positive to an antivirus vendor

Identify the exact sample

Record the SHA-256 hash, filename, product version, download source, and exact detection label. The hash matters: a rebuilt executable or an updated installer is a different sample, even when it has the same filename.

If the issue appears only on VirusTotal, link that report. If the installed antivirus also blocks it, capture its product version and detection details. Describe both observations without assuming they are identical engines.

Explain the expected behavior

Describe the software’s legitimate purpose, who publishes it, and the behavior that might resemble a threat, such as installation, updating, or administrative operations. Link your official product documentation where relevant.

A digital signature or a low detection count alone does not establish that a program is safe. Provide enough context for the reviewer to investigate the exact detection.

Follow the vendor’s sample instructions

Use the appropriate file-submission form or published mailbox. Read its supported file types, size limit, and archive rules. Do not apply one vendor’s password or compression requirements to all vendors.

For example, Avast’s current false-positive guidance requests an unencrypted ZIP or RAR for a detected file; other vendors may request a different format. Do not upload confidential customer data or samples you are not authorized to share.

Retest the same file after a correction

Keep the original SHA-256 and case number. After the vendor confirms a correction, check that exact sample against updated detections. If a later build is flagged, report its new hash and reference the earlier case rather than assuming the exception covers it.