Antivirus False Positives: Why Security Software Flags Legitimate Programs — and What to Do

In May 2022, Microsoft Defender flagged the Chromium browser engine — the foundation of Google Chrome, Microsoft Edge, and dozens of other browsers — as malware, quarantining it on millions of Windows computers. In 2017, Malwarebytes flagged a legitimate Windows system file as a trojan, causing boot failures on affected machines. False positives — detections of legitimate software as malicious — are an unavoidable side effect of aggressive threat detection, and they can range from mildly annoying to genuinely damaging.

Why false positives happen: heuristic and behavioral detection methods look for suspicious patterns rather than specific signatures. Legitimate software sometimes uses techniques that resemble malware behavior — packers and obfuscators (used to reduce file size or protect intellectual property) look similar to malware that uses the same techniques to evade detection; software that modifies system files (installers, system utilities) triggers the same behavioral alerts as malware that does the same; and new or obscure software that hasn't been whitelisted by the vendor's reputation system gets flagged simply because it's unknown.

The false positive trade-off: security vendors face a fundamental tension. More aggressive detection catches more real malware — but also generates more false positives. Less aggressive detection produces fewer false positives — but misses more real threats. Different vendors make different choices along this spectrum. AV-Comparatives tracks false positive rates alongside detection rates in their testing, and the results show meaningful variation: some products that score highly on detection have significantly higher false positive rates than others. A product that catches 99.5% of malware but generates 50 false positives per month may be worse in practice than one that catches 99% with 5 false positives.

What to do when your antivirus flags something: don't immediately assume the detection is correct — or incorrect. First, check the detection name and search for it online. If it's a well-known legitimate program being flagged, it's likely a false positive. Submit the file to VirusTotal (virustotal.com), which scans it with 70+ antivirus engines simultaneously — if only one or two engines flag it while the rest don't, it's almost certainly a false positive. If you're confident it's a false positive, add an exclusion in your security software for that specific file or folder. Report the false positive to your security vendor — most have a submission portal, and vendor responses to false positive reports are generally fast.

When to take a detection seriously: if VirusTotal shows multiple engines flagging a file, take it seriously even if you think it's legitimate. If a file you downloaded from an unofficial source is flagged, be more cautious than if it came from a major software vendor's official website. If your security software flags a file that was already on your system and hasn't changed, investigate — something may have modified it. And if you're ever uncertain, err on the side of caution: quarantine rather than delete (quarantine is reversible), and seek a second opinion from Malwarebytes Free or an online scanner before restoring.

Products with the best false positive records: AV-Comparatives' false positive tests consistently show that ESET, Kaspersky, and Bitdefender have among the lowest false positive rates while maintaining high detection rates. Windows Defender has improved significantly but still generates more false positives than the best third-party products. Malwarebytes has historically had a higher false positive rate than some competitors, though it has improved. When evaluating security products, check both detection scores and false positive scores in independent tests — a product that's accurate in both dimensions is more valuable than one that excels only at detection.