How to Read VirusTotal Reports

VirusTotal aggregates results from 60+ antivirus engines. When you see a report that says "0/67 detections", it is tempting to conclude that the file is safe. That conclusion is wrong. This page explains what VirusTotal reports actually mean and how to interpret them.

What "0/67" actually means

The number "0/67" means that 67 antivirus engines scanned the file and 0 of them flagged it as malicious. This is a snapshot at a point in time. It does not mean:

• The file is safe forever
• The file cannot harm you
• The file was reviewed by a human
• The file has been tested in a real environment

It means only that no engine recognized the file as a threat on that day. Antivirus engines rely on signatures, heuristics, and behavioral analysis. Newly written malware can pass all three. Some engines also have blind spots for specific file types, including Java archives.

What "3/67" means

Three engines flagged the file. This is more ambiguous than "0/67" — sometimes it means the file is actually malicious, and sometimes it means three engines produced false positives. To decide, look at which engines flagged it:

• Major engines (Microsoft, Kaspersky, Bitdefender, ESET, Avast, Sophos): if any of these flag a file, treat it as suspicious.
• Obscure engines (unknown names, engines with high false-positive rates): a detection from these alone is often not meaningful.

VirusTotal's web interface shows the full list of engines that flagged a file. Review them individually rather than relying on the summary count.

Why Java archives produce false positives

Minecraft clients are distributed as .jar or .zip files. Both formats contain executable code. Antivirus engines often flag mods and clients because:

• The file contains obfuscated code, which resembles packing techniques used by malware.
• The file modifies another application's process (mixin injection), a pattern some engines associate with unwanted software.
• The file's purpose — modifying a game client — is similar to legitimate but blocklisted tools, causing heuristic flags.

Because of this, a small detection count on a Java mod is often a false positive. The appropriate response is not to declare the file safe, but to inspect the source code if it is open source, or to check community reports if it is not.

What a report does not cover

• Runtime behavior after sandbox escape. A file can pass VirusTotal but behave maliciously on your machine under specific conditions.
• Variant files with the same name. Developers sometimes replace files without changing the filename. The hash — not the name — determines what VirusTotal scanned.
• Updates published after the scan. A file scanned in January tells you nothing about the version released in March.
• Digital signatures or absence thereof. VirusTotal reports signature status but a missing signature is not a virus indicator, and a valid signature is not a safety indicator.

How we use VirusTotal reports

On client pages, we link to the VirusTotal report and record the detection count at the time of writing. We do not claim the file is safe based on this. We provide the report as raw data for you to interpret. Our verification methodology explains what we check in addition to VirusTotal.

Better practices

• Verify the SHA-256 hash matches the documented hash. See hash verification.
• Prefer files from official sources. A report is only meaningful if it corresponds to the correct file.
• Read the source code if it is public. For open-source clients, source availability is a stronger safety signal than a VirusTotal report.
• Check community discussion. Search for the client on forums and Discord servers to see reports from other users.
• Run unfamiliar files in an isolated environment if possible — a virtual machine or a secondary user account.