First, what is Kaspersky?
Kaspersky’s anti-malware engine scans files, web traffic and email. It runs inside the company’s home products, its business endpoint and mail-server products, and in third-party devices and services that license the engine.
Verdicts come from two places: signature databases that update several times a day, and the cloud reputation service, Kaspersky Security Network (KSN). The Web Anti-Virus component checks every URL a user opens, so a bad verdict on your domain blocks the page before it loads.
Who can’t reach you right now
Where it’s used, and who shares it
If a lot of your visitors come from these countries, a Kaspersky flag will hurt you more than most.
Other companies license it, so these products usually pick up the same verdict, and the same fix:
ZoneAlarm (Check Point)Uses Kaspersky engine
Juniper SRX firewallsKaspersky engine option
Clearswift email gatewayKaspersky engine option
VirusTotalShows Kaspersky’s verdictThese engines are independent from Kaspersky. If they flag you too, each one needs its own request:
ESET →
Bitdefender →
Dr.Web →
Microsoft Defender →How to tell if you’re flagged
Kaspersky Threat Intelligence Portal (opentip.kaspersky.com). Look up your domain, URL or SHA-256 hash to see Kaspersky’s own verdict.- VirusTotal. Scan the URL or file and find the Kaspersky row. Use it to see whether other engines flag you too.
- A clean test machine. Install a trial in a virtual machine, update the databases and open your site or run your file.
- User reports. Ask affected users for a screenshot of the block page. It shows the detection name you’ll need.
HEUR:A heuristic guess. This is the most common cause of false positives on new or packed files.UDS:A cloud verdict from KSN, often because your file or domain is new and has few users.PDM:Triggered by what the program does while it runs.not-a-virus:Marked as adware or riskware, not malware. Explain clearly what your software does.Asking Kaspersky to fix it
Gather what they’ll need
Write down the exact URL or file, its SHA-256 hash, the detection name, the product and database version, and grab a screenshot of the block page.
Double-check it’s really a mistake
Scan your server, plugins and third-party scripts for injected code. For files, rebuild from clean source and check your dependencies. Fix anything you find first.
Send your request
Look your URL or file up on the Kaspersky Threat Intelligence Portal and ask for a reanalysis. For files, you can also email the sample in a password-protected archive.
To: [email protected] Subject: False alarm – example.com Attach: sample.zip (password: infected) Body: URL/hash, detection name, what the product does, and a link to your official download page.
Wait for a reply
You’ll get an automatic ticket number. Keep it, and reply in the same thread instead of opening a new request.
Make sure it’s fixed
Check the portal and VirusTotal again. Ask affected users to update their databases, since cached cloud verdicts can take a few hours to clear.