Dr.Web false positive?
Here’s where to start.
Dr.Web false-positive review channels for files and sandbox and websites / URLs. Find contact scope, review guidance, source links, and any limits to the available process.
Appeal contacts
Choose a channel for the type of detection you want reviewed. Contact availability and acceptance are controlled by the vendor.
How to request a review
File review
Doctor Web's laboratory submission form has a False positive category for files.
- Use the file section of the laboratory submission form.
- Attach the sample and select False positive as the request category.
- Enter your email, describe the mistaken detection, complete the displayed verification and send.
- Keep the request ID from the confirmation email; replies to that email can continue the same request.
- The web form accepts attachments up to 50 MB and offers a download-link option for larger files.
- Doctor Web asks for one file per request unless the files are related, and does not promise a regulated response time.
Sandbox review
General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.
- Record the report URL, sandbox name, and specific observed behavior.
- Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.
- Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample.
Website / URL review
General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.
- Record the exact affected URL or domain and detection label.
- Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.
- Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample.
Scope & contact notes
- VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result.
Names you may see in a report
Aliases help locate the responsible vendor. Related products can use different submission channels; check the scope shown above.
Sources for this entry
- VirusTotal contributor roster ↗
- VirusTotal network engine prefixes ↗
- VirusTotal file engine prefixes ↗
- VirusTotal official false-positive contact list ↗
- Send a suspicious file/link for analysis ↗
“Guidance checked” means a public vendor source supports the route or instructions. We have not sent a test appeal or verified mailbox delivery. Read our methodology.