{"slug": "virustotal", "name": "VirusTotal", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 11, "warners": 3, "score": 1.341, "rising": 0.35, "first": "2025-11-14", "latest": "2026-08-24", "why": "I always upload a copy to https://www.virustotal.com to help combat the false positives.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 5, "compare": 0, "warn": 3}, "spark": [0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I always upload a copy to https://www.virustotal.com to help combat the false positives.", "kind": "", "icon": true, "domain": "virustotal.com", "github_repo": null, "official_url": "https://www.virustotal.com", "pricing": "", "aliases": ["VirusTotal"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 790789090, "item_id": 49424318, "url": "https://news.ycombinator.com/item?id=49424318", "by": "essial", "date": "2026-08-24", "version": null, "stance": "recommend", "quote": "The best I can do is run it against VirusTotal, which I've now done.", "excerpt": "Didn't even know MoonBasic was a thing, that's funny! And yeah I understand on the 'run random binary' thing. The best I can do is run it against VirusTotal, which I've now done. That's fine though, there's nothing new under the sun (pun not intended!). I'll continue to iterate and improve and try to make it the best in its domain. I'm using it myself for my own games as well (the original reason for creating it). Fo", "context": "", "use_case": "malware scanning", "switched_from": "", "story": "Show HN: LunarBasic, a BASIC that compiles 2D games to native executables"}, {"id": 763526656, "item_id": 47720416, "url": "https://news.ycombinator.com/item?id=47720416", "by": "Foobar8568", "date": "2026-04-10", "version": null, "stance": "recommend", "quote": "Beside Virus Total, I am unsure", "excerpt": "Beside Virus Total, I am unsure https://www.virustotal.com/", "context": "", "use_case": "checking software for malware", "switched_from": "", "story": "CPUid Compromised"}, {"id": 753032032, "item_id": 47064502, "url": "https://news.ycombinator.com/item?id=47064502", "by": "yndoendo", "date": "2026-02-18", "version": null, "stance": "recommend", "quote": "I always upload a copy to https://www.virustotal.com to help combat the false positives.", "excerpt": "I always upload a copy to https://www.virustotal.com to help combat the false positives. It was really bad a couple years ago because anything wrapped in Inno Setup kept being flagged. Now maybe one or two flag vendors do; Bkav Pro and CrowdStrike Falcon are the dominate culprits always.", "context": "", "use_case": "scanning files for false positives", "switched_from": "", "story": "Windows: Prefer the Native API over Win32"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 775673970, "item_id": 48479623, "url": "https://news.ycombinator.com/item?id=48479623", "by": "JohnTHaller", "date": "2026-06-10", "version": null, "stance": "warn", "quote": "I'll get caught in loops trying to scan files after only scanning a few where I'll get like 5 absurdly vague captchas in a row.", "excerpt": "I use Firefox for everything on Windows, macOS, and Android. I do have to keep Chrome around on desktop due to VirusTotal + reCaptcha setup to be purposely onerous for non-Chrome users. I'll get caught in loops trying to scan files after only scanning a few where I'll get like 5 absurdly vague captchas in a row. You must solve all of them in a row or it starts over from the beginning. It does this even if I'm logged ", "context": "", "use_case": "scanning software releases", "switched_from": "", "story": "Google Chrome is killing all uBlock Origin bypasses, Edge, Opera to follow"}, {"id": 756260596, "item_id": 47266287, "url": "https://news.ycombinator.com/item?id=47266287", "by": "yashchhabria", "date": "2026-03-05", "version": null, "stance": "warn", "quote": "bypass every scanner in their pipeline (VirusTotal, JFrog, ClamAV, picklescan, ModelScan)", "excerpt": "Co-Author here. I worked on model scanning at Databricks before joining Promptfoo to build ModelAudit. The short version: ML model files execute code at load time. Pickle's `__reduce__` runs arbitrary Python on deserialization, and ~45% of popular HuggingFace models still use pickle (CCS 2025). Every major framework has had a deserialization CVE in the last year - PyTorch (CVSS 9.3), Keras (CVSS 9.8), ONNX (CVSS 8.8)", "context": "", "use_case": "", "switched_from": "", "story": "Found a CVSS 10.0 bypass in Hugging Face's model scanner. We open-sourced ours"}]}], "who": [], "tags": [], "use_cases": ["malware scanning", "checking url for malware", "scanning software releases", "checking software for malware", "scanning files for false positives", "malware / url scanning"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49419746", "title": "Show HN: LunarBasic, a BASIC that compiles 2D games to native executables", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49084404", "title": "Ask HN: Crooked Timber showed showed me a virus captcha, What now?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48471970", "title": "Google Chrome is killing all uBlock Origin bypasses, Edge, Opera to follow", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47717847", "title": "CPUid Compromised", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47392298", "title": "item 47392298", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47266286", "title": "Found a CVSS 10.0 bypass in Hugging Face's model scanner. We open-sourced ours", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {"neutral": 2}, "2026-01": {}, "2026-02": {"warn": 1, "recommend": 1}, "2026-03": {"warn": 1, "neutral": 1}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {"warn": 1}, "2026-07": {"neutral": 1}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "quotes": [{"id": 790789090, "item_id": 49424318, "url": "https://news.ycombinator.com/item?id=49424318", "by": "essial", "date": "2026-08-24", "version": null, "stance": "recommend", "quote": "The best I can do is run it against VirusTotal, which I've now done.", "excerpt": "Didn't even know MoonBasic was a thing, that's funny! And yeah I understand on the 'run random binary' thing. The best I can do is run it against VirusTotal, which I've now done. That's fine though, there's nothing new under the sun (pun not intended!). I'll continue to iterate and improve and try to make it the best in its domain. I'm using it myself for my own games as well (the original reason for creating it). Fo", "context": "", "use_case": "malware scanning", "switched_from": "", "story": "Show HN: LunarBasic, a BASIC that compiles 2D games to native executables"}, {"id": 785360176, "item_id": 49085011, "url": "https://news.ycombinator.com/item?id=49085011", "by": "goodmythical", "date": "2026-07-28", "version": null, "stance": "neutral", "quote": "VT says no bueno", "excerpt": "VT says no bueno: https://www.virustotal.com/gui/url/4812564b97c63e1607e9182d0a26fdb6d2da17efea5f2a81592a1caa175d3538", "context": "", "use_case": "Checking URL for malware", "switched_from": "", "story": "Ask HN: Crooked Timber showed showed me a virus captcha, What now?"}, {"id": 775673970, "item_id": 48479623, "url": "https://news.ycombinator.com/item?id=48479623", "by": "JohnTHaller", "date": "2026-06-10", "version": null, "stance": "warn", "quote": "I'll get caught in loops trying to scan files after only scanning a few where I'll get like 5 absurdly vague captchas in a row.", "excerpt": "I use Firefox for everything on Windows, macOS, and Android. I do have to keep Chrome around on desktop due to VirusTotal + reCaptcha setup to be purposely onerous for non-Chrome users. I'll get caught in loops trying to scan files after only scanning a few where I'll get like 5 absurdly vague captchas in a row. You must solve all of them in a row or it starts over from the beginning. It does this even if I'm logged ", "context": "", "use_case": "scanning software releases", "switched_from": "", "story": "Google Chrome is killing all uBlock Origin bypasses, Edge, Opera to follow"}, {"id": 763526656, "item_id": 47720416, "url": "https://news.ycombinator.com/item?id=47720416", "by": "Foobar8568", "date": "2026-04-10", "version": null, "stance": "recommend", "quote": "Beside Virus Total, I am unsure", "excerpt": "Beside Virus Total, I am unsure https://www.virustotal.com/", "context": "", "use_case": "checking software for malware", "switched_from": "", "story": "CPUid Compromised"}, {"id": 758276784, "item_id": 47392299, "url": "https://news.ycombinator.com/item?id=47392299", "by": "tipodeincognito", "date": "2026-03-15", "version": null, "stance": "neutral", "quote": "Found under same SHA on VirusTotal too.", "excerpt": "Follow-up to Part 1, first shared March 13th ~2am, UTC+1. Part 1 (original analysis): https://codeberg.org/tip-o-deincognito/glassworm-writeup/src/branch/main/README.md IoCs on ThreatFox (18 indicators): search \"js.glassworm\". Samples on MalwareBazaar: tag \"glassworm\". Found under same SHA on VirusTotal too. Last confirmed live infection post-credential extraction on 2026-03-14T05:02:01Z", "context": "", "use_case": "", "switched_from": "", "story": null}, {"id": 756260596, "item_id": 47266287, "url": "https://news.ycombinator.com/item?id=47266287", "by": "yashchhabria", "date": "2026-03-05", "version": null, "stance": "warn", "quote": "bypass every scanner in their pipeline (VirusTotal, JFrog, ClamAV, picklescan, ModelScan)", "excerpt": "Co-Author here. I worked on model scanning at Databricks before joining Promptfoo to build ModelAudit. The short version: ML model files execute code at load time. Pickle's `__reduce__` runs arbitrary Python on deserialization, and ~45% of popular HuggingFace models still use pickle (CCS 2025). Every major framework has had a deserialization CVE in the last year - PyTorch (CVSS 9.3), Keras (CVSS 9.8), ONNX (CVSS 8.8)", "context": "", "use_case": "", "switched_from": "", "story": "Found a CVSS 10.0 bypass in Hugging Face's model scanner. We open-sourced ours"}, {"id": 753032032, "item_id": 47064502, "url": "https://news.ycombinator.com/item?id=47064502", "by": "yndoendo", "date": "2026-02-18", "version": null, "stance": "recommend", "quote": "I always upload a copy to https://www.virustotal.com to help combat the false positives.", "excerpt": "I always upload a copy to https://www.virustotal.com to help combat the false positives. It was really bad a couple years ago because anything wrapped in Inno Setup kept being flagged. Now maybe one or two flag vendors do; Bkav Pro and CrowdStrike Falcon are the dominate culprits always.", "context": "", "use_case": "scanning files for false positives", "switched_from": "", "story": "Windows: Prefer the Native API over Win32"}, {"id": 751455600, "item_id": 46965975, "url": "https://news.ycombinator.com/item?id=46965975", "by": "dpoloncsak", "date": "2026-02-10", "version": null, "stance": "warn", "quote": "", "excerpt": "Adding on here... VirusTotal is flagging the trello skill as suspucious because it Does NOT include an API key? Am i expected to share my keys if I want to upload a skill? https://clawhub.ai/steipete/trello \"Requiring TRELLO_API_KEY and TRELLO_TOKEN is appropriate for Trello access, but the registry records no required env vars while SKILL.md documents them. This omission is problematic: the skill will need highly pr", "context": "", "use_case": "", "switched_from": "", "story": "ClawHub"}, {"id": 742383920, "item_id": 46398995, "url": "https://news.ycombinator.com/item?id=46398995", "by": "_a9", "date": "2025-12-26", "version": null, "stance": "neutral", "quote": "The URL scanner doesnt directly scan the file.", "excerpt": "The URL scanner doesnt directly scan the file. It checks the URL against other web firewalls and returns stuff like the headers, chain, the sha256 hash of the body (which links to the actual file analysis https://www.virustotal.com/gui/url/9525d0fe32cebf7933bf84dcfad93811e799c7e8460e374f230a232893a1ba9a/details) You can see and compare the different vendors of each. File analysis goes to all the antivirus' and does t", "context": "", "use_case": "Malware / URL scanning", "switched_from": "", "story": "Why does VirusTotal give different results depending on how I upload the file?"}, {"id": 739147281, "item_id": 46196705, "url": "https://news.ycombinator.com/item?id=46196705", "by": "patricklorio", "date": "2025-12-08", "version": null, "stance": "neutral", "quote": "", "excerpt": "Want to chat on discord? Maybe we could combine efforts to try and stop people abusing our services :). We have a few vendors sending us automated reports, maybe I could open it up for multiple projects. feel free to give me a ping on https://discord.gg/AXAbujx @patrick.", "context": "", "use_case": "", "switched_from": "", "story": "Tunnl.gg"}, {"id": 734950448, "item_id": 45934403, "url": "https://news.ycombinator.com/item?id=45934403", "by": "FreakLegion", "date": "2025-11-14", "version": null, "stance": "neutral", "quote": "public submissions are available to VirusTotal's paying users", "excerpt": "They are now, although to be clear there was (is?) nothing nefarious going on, just people not understanding that public submissions are available to VirusTotal's paying users. These days VT has private scanning, too, but the issue was always one-offs from random finance or investor relations teams. It's come up here and there in security, too, e.g. in https://www.directdefense.com/harvesting-cb-response-data-leaks-f", "context": "", "use_case": "", "switched_from": "", "story": "Disrupting the first reported AI-orchestrated cyber espionage campaign"}]}