A hall of fame for antivirus engines that flagged perfectly harmless software.
With each false positive, an independent developer loses users’ trust and has to start explaining.
47 monitored files · Published on the 1st of each month
| Rank | Engine | Detection-days | Observed cases | Ongoing / cleared / excluded | Unconfirmed |
|---|
The first monthly report will be published on November 1, 2026.
Engines still flagging benign files as of 2026-10-15. Each was reported to the vendor as soon as it was found; the period includes the time it has remained since. Updated four times a day; files appear only as anonymous IDs.
Ongoing: 1 · Engines: 1
| Engine | File | Detection name | False-positive period |
|---|---|---|---|
| Elastic | F-a9d3b9ee | malicious (moderate confidence) | Since 2026-10-14 · day 2 |
Before rankings: consistent criteria and verifiable evidence.
47 files from software the developer has published are monitored through VirusTotal. This is a record of false positives and detection burden on this sample, from the developer’s perspective; it does not represent any engine’s overall performance. Policy-based detections (PUA, Riskware, etc.) that flag a program as potentially unwanted rather than malicious are not counted.
Score = total detection duration across files divided by 24 hours. One file flagged for a day earns one point. Ongoing cases count up to the cutoff. Monthly scores count only duration falling within that month.
Duration runs from the first observed detection to the first observation confirming a clean result. Each false positive is reported to the vendor as soon as it is found, so the duration includes the time it stayed after being reported. Actual onset and clearance times may differ. An engine not responding is not treated as clearance; cases with unconfirmed clearance keep accumulating in the provisional score. An unconfirmed clearance is confirmed at the first later scan in which at least as many engines respond and the detection is absent. Files excluded from monitoring (replaced by a new version or no longer distributed) stop counting at their last scan.
The wording on this page expresses an opinion about an evaluation structure centered on detection counts. It does not assert the intent of any specific vendor. All figures are based on observation records. Request a correction ↗
Users stop downloading. Software gets deleted. The developer is suspected of writing malware. The cost of a false positive falls more on whoever made the software than on the antivirus that got it wrong.
This page does not evaluate the overall detection performance of any antivirus. It publicly documents misjudgments of legitimate software and the responses that follow, to reduce the harm to independent developers.
When an antivirus wrongly flags Windows system files or legitimate programs and quarantines, deletes or blocks them, the damage is real: PCs that will not boot or keep rebooting, banking and public services knocked offline, even leaked documents. Every case below happened and made the news. A false positive is not just the developer’s problem; it is a risk to every user’s PC and work.