[KB141] Submit a virus, website, or potential false positive sample to the ESET Research Lab

Issue

Solution

Submit samples using your ESET application

If you prefer not to send an email, use the sample submission form in your ESET application.

1. Open the main program window of your ESET Windows application.

2. Click Tools → Submit sample for analysis.

   

3. There are four actions you can take:

   ---

   Submit a suspicious file

   
   

   4. In the window Select sample for analysis, fill in these fields and click Next.

      • Select Suspicious file in the Reason for submitting the sample drop down menu.
      • Click the button with three dots and navigate to the file you wish to submit.
      • Optionally, fill in your email address in the Contact e-mail field. Keep in mind you will not receive a response unless further information is required.
      
      

      

   5. In the window Add file description, fill in these fields and click Send.

      • The observed signs and symptoms you have seen on your computer that you believe are a result of this file. Describe how the infection manifested: common signs include (but are not limited to) excessive CPU usage, excessive network usage, firewall reporting unexpected network traffic, unexpected browser setting changes, ads being displayed, files copied automatically via network shares/removable drives, documents getting encrypted, programs asking for a ransom, and applications being hard to close.
      • The origin of the file: where did you download it from, what website, or other means.
      • Any additional notes and explanations you can offer to help ESET Research Lab analyze the file.
      
      

      

   ---

   Submit a false positive file

   
   

   Whitelisting

   ESET provides a whitelisting service for software vendors, through which you can submit your software to minimize the chances of false positives, for example, when it is being downloaded.

   This service is intended as a preventive measure for trusted and undetected applications to minimize the risk of future false positives. The whitelisting service is not a channel for removing existing detections, disputes or solving other unrelated problems.

   If you want to register your software for whitelisting, follow the instructions in How do I whitelist my software with ESET?

   4. In the window Select sample for analysis, fill in these fields and click Next.

      • Select False positive file in the Reason for submitting the sample drop down menu.
      • Click the button with three dots and navigate to the file you wish to submit.
      • Optionally, fill in your email address in the Contact e-mail field. Keep in mind you will not receive a response unless further information is required.
      
      

      

   5. In the window Add file description, fill in these fields and click Send.

      • The file name and version (if available).
      • The origin of the file: where did you download it from, what website, or other means.
      • The purpose of the file: what does it do and why you believe it is a false positive.
      • Any additional notes and explanations you can offer to help ESET Research Lab analyze the file.
      
      

      

   ---

   Submit a suspicious site

   
   

   4. In the window Select sample for analysis, fill in these fields and click Next.

      • Select Suspicious site in the Reason for submitting the sample drop down menu.
      • Input the website URL.
      • Optionally, fill in your email address in the Contact e-mail field. Keep in mind you will not receive a response unless further information is required.
      
      

      

   5. In the window Add site description, fill in these fields and click Send.

      • In the drop-down menu select the behavior you have seen on the site.
      • Any additional notes and explanations you can offer to help ESET Research Lab analyze the site.
      
      

      

   ---

   Submit a false positive site

   
   

   4. In the window Select sample for analysis, fill in these fields and click Next.

      • Select False positive site in the Reason for submitting the sample drop down menu.
      • Input the website URL.
      • Optionally, fill in your email address in the Contact e-mail field. Keep in mind you will not receive a response unless further information is required.
      
      

      

   5. In the window Add site description fill in why you believe this is a false positive and any notes and explanations you can offer to help ESET Research Lab analyze the site.

      

   ---

Back to top

Submit a suspicious file / potential false positive file or application for analysis via email

You are a software vendor, and ESET detects your app as a Potentially unwanted application (PUA)

Some "Threat found" or "Threat removed" detections are classified as PUA. If you think that an app was incorrectly detected as PUA, follow the steps below:

1. Take screenshots of the threat detection notification you receive from your ESET application.

2. Compress your application files into a .zip or .rar archive and password-protect it with the password "infected".

3. Create and send an email with the following information:

   1. In the Subject line: Indicate that the attached file contains a false positive (for example, use the subject "PUA - False positive").

   2. In the body of the email: Make a note of the password you set in step 2 and attach the .zip or .rar archive as well as any screenshots. Include any background information where the sample is available and, if applicable, the ESET Technical Support case number.

   3. Send the email to: samples@eset.com.

Back to top

Submit a suspicious website / potential false-positive website / potential website miscategorization

Follow the appropriate instructions below, depending on the type of issue you want to submit:

Back to top