First, what is ESET?
ESET is a security company. Its detection engine scans files and web traffic, and it runs in the ESET home products and in the ESET business products. The ESET lab analyzes the files and websites that people send in.
ESET can block a website and can detect a file as malware or as an unwanted application. When the verdict is wrong, the product blocks your page or removes your file until the ESET lab corrects it.
Who can't reach you right now
Where it's used, and who shares it
These engines are independent from ESET. If they flag you too, each one needs its own request:
Kaspersky →
Bitdefender →
Avast / AVG →
Microsoft Defender →How to tell if you're flagged
ESET Link Checker (eset.com/us/home/link-checker). Enter your URL to see how ESET rates it. We found no public lookup for files.
VirusTotal. Scan the URL or file. A URL shows up in the ESET row, and a file shows up in the ESET-NOD32 row. The same scan shows whether other engines flag you too.- A clean test machine. Install a trial in a virtual machine, update it and open your site or run your file.
- User reports. Ask affected users for a screenshot of the ESET notification. It shows the detection name, and ESET asks for that screenshot in the report.
Potentially unwanted applicationGrayware. ESET does not treat it as malware.Potentially unsafe applicationA legitimate tool that other people can misuse.Suspicious applicationA program compressed with a packer or protector.Asking ESET to fix it
Collect the details
Take a screenshot of the ESET detection or block notification. For a website, copy the complete blocked URL. For a file, note the file name and version, where the file came from, and what it does. Write down why you think the verdict is wrong.
Check that it is a mistake
Scan your server and your scripts for injected code, and rebuild files from clean source. Fix anything you find before you write to ESET.
Report a website by email
ESET takes website reports by email, as KB141 describes at support.eset.com/en/kb141. There is no web form for false positives. Send the email to samples[at]eset[.]com with the subject "Domain whitelist" followed by the blocked domain. Put the complete blocked URL in the body and say why it is a false positive. ESET recommends that you attach a screenshot of the block notification. Send the email as plain text, with no footer and no links other than the ones you report. You need no account. KB141 does not ask for a company email address, so a personal one is fine. A phishing flag on a website has no file to send. Say what the site is, who owns it and what each form on the page collects.
To: samples[at]eset[.]com Subject: Domain whitelist example[.]com Attach: eset-block-notification.png Body: The complete blocked URL is hxxps://example[.]com/page. ESET blocks it as phishing. hxxps://example[.]com is the website of our company, Example Ltd. We own the domain and run the site ourselves. The only form is the customer login, and it sends data to our own server. The site has no downloads. Please review the verdict.
Report a file by email
Compress the file into a .zip or .rar archive with the password "infected". Send it to samples[at]eset[.]com with the subject "False positive" and state the password in the body. Also give where the file came from, the file name and version, what it does and why you think it is a false positive, and attach the screenshot of the detection. For a detection of a potentially unwanted application, use the subject "PUA - False positive".
To: samples[at]eset[.]com
Subject: False positive
Attach: sample.zip (password: infected)
eset-detection.png
Body:
The password of the archive is: infected
The file is example-app-setup.exe, version 2.1, the
installer of our product Example App. ESET detects it as
a threat. We built it from our own source. The official
download page is hxxps://example[.]com/download. The
installer copies the program files and creates a start
menu entry, and it does nothing else. Please review the
detection.
Wait, and follow up after three days if it is urgent
ESET sends no reply unless it needs more information. If an urgent issue is still unresolved after three days, send a follow-up email. Quote the original subject line, the date and time you sent it, and the From address.
Check the result
Enter your URL in the ESET Link Checker again, and scan it on VirusTotal. Look at the ESET row for a URL and the ESET-NOD32 row for a file. Ask affected users to update their ESET product and try again.
Other ways to report
ESET explains its own rules for false positives on these pages: