At first glance, VirusTotal may appear to be a shining example of a great service. However, there is an unsettling truth lurking beneath the surface. This company, while presenting an appealing facade, seems to be a "devil in disguise."According to their about page, this is is what they say: "Our goal is to make the internet a safer place through collaboration between members of the antivirus industry, researchers and end users of all kinds."Unfortunately, my experience has revealed a different story. While the service is useful for doing a quick check if a file is malicious, there is a huge problem with false positives and the way they are handled. When you read their contributors page, VirusTotal claims to be "an information aggregator" and that they do not responsible for any false positives, since they are generated by other antivirus companies. They say that false positives should be addressed directly with the developers of that product.It is easier said than done. A lot of those companies do not provide a way to submit false positives or they choose to overlook and neglect any communication related to these issues. VirusTotal does not seem to care about the companies they collaborate with. Contacting VirusTotal about it is like talking to a wall, they simply ignore you unless you are willing to pay them a ton of money for their questionable services. The larger number of antivirus companies, the safer you are? Even though a lot of them are not interested in improving their product? I doubt it.If you are still not convinced that VirusTotal is careless, let us take a look at their contributors page which lists the antivirus products used and the links to the websites of the companies that own them. One of the products listed there is called "Google". The provided link to reach this company is google.com. Yes, it just points to Google search engine! Go ahead and try to figure out who you should contact when the antivirus doesn't even have a searchable name, because it is just called "Google". The craziest part about this is that VirusTotal was acquired by Google in September 2012. If there is anyone who should know how to contact the developers of this mysterious "Google" antivirus, it is VirusTotal!The claim that one of the goals of VirusTotal is to collaborate with the end users is completely ridiculous. In fact, their practices raise concerns about their true intentions and ethical standards. False positives are harmful to the reputation of open source products and companies with small development teams. A lot of users get scared after seeing only 1-2 false positives, thinking that the file is malicious, and refuse to install the application. Preventing this is almost impossible due to the disinterest of VirusTotal and the contributing antivirus companies.VirusTotal should have a better way to handle this by starting to communicate with the end users, vetting the companies they collaborate with, providing the means to report false positives and receive a transparent response within a reasonable timeframe. At no point you should have to go through the list of 70+ companies and try to figure out how to submit a file, in which format to submit it, how long to wait and whether the company is ever going to respond.Until then, proceeding with caution would be wise when dealing with VirusTotal, as using this service means that you are giving power to a company to harm other products without repercussions while presenting themselves as benevolent.
