Antivirus flags a file you're confident is safe

Symptoms

• Antivirus quarantines or deletes a file you trust
• Warning names a generic-sounding threat type
• File is from a known developer or your own work project
• Other antivirus scanners don't flag the same file

Likely causes

• CommonHeuristic detection mistakenly flags unusual but harmless code patternsAntivirus heuristics look for suspicious behavior patterns, which occasionally match legitimate but unusual software.
• CommonNewly released or rarely used software not yet whitelistedFiles that haven't built up reputation data with the antivirus vendor are more likely to trigger false alarms.
• PossibleFile genuinely contains a threat despite appearing safeSometimes trusted-looking files are compromised, so the flag can occasionally be correct.

What to do

1. Confirm the file's exact source and that it hasn't been modified from the original trusted version.
2. Check the file with a second, independent scanner or an online multi-engine scanning service to compare results.
3. Search online for the specific detection name paired with the software name to see if others report it as a known false positive.
4. If confident it's safe, restore the file from quarantine in your antivirus settings.
5. Add the specific file or folder to your antivirus's exclusion list if you'll need to use it repeatedly.
6. Report the false positive to your antivirus vendor, which helps them correct their detection database.
7. If any doubt remains about the file's safety, err on the side of caution and don't restore it.

When to call a pro

For business-critical software repeatedly flagged, contact the software vendor, who often has a direct process for getting antivirus vendors to whitelist their product.

Safety