The requirements for VB100 (virus) certification are:
*
100% detection of malware listed as 'In the Wild' by the WildList Organization.
The WildList to be used for each test will be the latest available at the time of the test deadline. This deadline will be communicated to potential participants, and publicised on the VB website approximately two weeks prior to the submission deadline for each test. All samples in the WildList collection are verified and replicated from originals provided by the WildList Organization.
'Detection' in this case is accepted if the product clearly marks a file as infected in its log or on-screen display, or denies access to it during on-access testing. If such logging or blocking is unavailable or deemed unusable for test purposes, deletion or attempted disinfection of samples will also be an accepted indicator of detection.
*
No false positives when scanning VB's collection of known-clean files.
The collection of known-clean files includes the test sets used for speed measurements, and is subject to regular and unannounced updating and enlargement. A false positive will be counted if a product is considered to have flagged a file clearly as infected in its log or on-screen display.
A false positive will not be recorded if a file is labelled as something other than malware, such as adware, or a legitimate item of software with potentially dangerous uses. All other alerts on clean files will be counted as false positives.
Flags will be adjudged to mark either a detection, in which case any files marked thus will be counted as detections in the infected set or as false positives in the clean sets, or mere suspicion, in which case no detection or false positive will be recorded. There will be no overlap between the two.
All tests will be performed both on demand and on access. Any failure to detect a sample from the WildList set, in either mode, or a false positive alert in either mode, will result in a product failing to qualify for the VB100 award.