Google acquires online virus scanning service Virustotal

Martin Brinkmann
Sep 7, 2012
Updated • Sep 7, 2012
Antivirus, Google, Security

My go to service for scanning individual files online for malicious code is VirusTotal. It scans files that you upload to it with 42 different antivirus engines that include the majority of popular engines of the industry. Scanning usually does not take long, with results more often than not displayed near instantly after the file has been uploaded to the service. The file hash is generated and checked against the service's database first before it is uploaded to check if someone else has uploaded the file to the service. This can save valuable time as there is no need to upload the file again if it has already been scanned previously. Virustotal can scan web pages in addition to files to provide people with safety information.

A new blog post on the official Virustotal blog confirms that the service has been acquired by Google. The Virustotal crew will continue to operate the site independently for the time being while maintaining its relationships with antivirus companies and other industry experts.

An update from VirusTotal

 Our goal is simple: to help keep you safe on the web. And we’ve worked hard to ensure that the services we offer continually improve. But as a small, resource-constrained company, that can sometimes be challenging. So we’re delighted that Google, a long-time partner, has acquired VirusTotal. This is great news for you, and bad news for malware generators, because:
  • The quality and power of our malware research tools will keep improving, most likely faster; and
  • Google’s infrastructure will ensure that our tools are always ready, right when you need them.

VirusTotal will continue to operate independently, maintaining our partnerships with other antivirus companies and security experts. This is an exciting step forward. Google has a long track record working to keep people safe online and we look forward to fighting the good fight together with them.

More importantly, the company can now make use of Google's infrastructure to provide a more reliable faster service for Internet users that use it. This likely means less downtimes, faster uploads and scans.

Google has not released an official statement yet, which means that we do not know anything about the companies intentions when it comes to the service. It is all possible: from shutting it down like Google did with Meebo to integrating it into Google products such as Gmail, Google Chrome, Chrome OS or Google Search, or using the information provided by the service to enhance Google products.

For now at least, Virustotal continues to operate normally. Lets hope that it stays that way.


Tutorials & Tips

Previous Post: «
Next Post: «


  1. addy said on October 16, 2012 at 11:18 pm

    nice post boss.

  2. kalmly said on September 8, 2012 at 3:11 pm

    Bad news. I’ve depended on VT for as long as I can remember. No more.

    Will Google be buying gHacks soon? :)

  3. Maou said on September 8, 2012 at 2:03 pm

    The evil empire strikes again, R.I.P VirusTotal.

  4. Transcontinental said on September 8, 2012 at 9:17 am

    Of course, if cookies are on for Google will have there another Net net at its disposal; whatever, they will know more again about the user. I have to admit I am getting fed up with these giant companies buying everything they can, breaking diversity, living and letting die. I am getting closer and closer to the idea of totally boycotting Google as I already do with Facebook. Not only cookies as I already forbid them to this fat ass but all related services blacklisted. The world is the oyster of no one, neither is the Web.

    1. Martin Brinkmann said on September 8, 2012 at 9:51 am

      I’m pretty sure it is not about advertising on the Virustotal site, as it is irrelevant to Google. What the company is after is data and technology, and that’s what the service provides it with. Google could for instance take the findings and use them in Google Search directly, to block or at least warn users that a file they are about to download, or a website they are about to visit, is harmful.

      1. Transcontinental said on September 8, 2012 at 10:08 am

        That’s the whole point : making the relationship a winner-winner scheme. Another point is, one wins more than the other. Far more. And I repeat : diversity is linked to civilization, within pluralism, arts, thoughts, philosophy, ideas, concepts, essays … history shows that monopoles relate to decline.
        Guss that brings us far if not off the topic.

  5. Beach Bouy said on September 8, 2012 at 7:13 am

    Not to be out done, Microsoft will acquire one or two of the remaining alternative sites.

  6. Dan said on September 8, 2012 at 12:57 am

    I love VT especially since it’s fast, trustworthy, and has a decent file uploading app. But if the Evil Empire(tm) fiddles too much with VT, I’d have to move on to something else like Jotti. :(

  7. Gonzo said on September 7, 2012 at 11:56 pm

    Upside – Google Play (Android) may benefit from this.

    Downside – Adverts, tracking and data mining. Worst case it’s shut down but given the number of adequate alternatives, I’m not concerned. I have a bad feeling the VT uploader app will disappear or be replaced by some evil Google alternative.

    Solution to downside, use Tor Browser to upload to VT (if you aren’t already). Or use one of the many available alternatives like:


    I haven’t installed an AV product since these services first appeared, so please feel free to list more alternatives! :-)

    1. Promycelial said on September 8, 2012 at 7:07 pm

      The alternatives you list are in bed with Google to some degree.

      Jotti = googlesyndication
      Metascan = google-analytics, (facebook, linkedin, twitter too)
      Virscan = googlesyndication, google-analytics

      Not the same as actually being owned by Google, but still…sad.

  8. Chris said on September 7, 2012 at 11:12 pm

    I bet the people at Jotti’s Malware Scan are orgasmic right now. :)

  9. EuroSkept1C said on September 7, 2012 at 10:51 pm

    If you’re not paying for it, you’re the product being sold.

  10. sgr said on September 7, 2012 at 10:51 pm

    Hi Martin,
    as usual an exellent tip!
    I have rushed myself to play with it instantly I had scanned the “Host Mechanic” by Vishal Gupta from askvg and the output was at least strange. I don’t know what to think now :(

    Best Regards.

    1. Martin Brinkmann said on September 7, 2012 at 11:18 pm

      You did get a few hits? Those are usually false positives, especially if you have downloaded the file from a reputable site and the scanners that identified it as malware are not the most used or popular ones.

      1. sgr said on September 7, 2012 at 11:49 pm

        Well,I did and among others there was TrendMicro-HouseCall output like this : TROJ_GEN.R47H1KG downloaded from askvg directly I mean there was redirection to Vishal’s DeviantArt profile I guess.

      2. Martin Brinkmann said on September 8, 2012 at 9:27 am

        Well Gen likely means Generic which usually is a good indicator for a false positive on virustotal if other scanners did not detect malicious code.

  11. Wayfarer said on September 7, 2012 at 10:47 pm

    Another great service down the tubes then – inevitably. VirusTotal was about service. Google is about money and data-mining.

  12. Raton said on September 7, 2012 at 9:22 pm

    Beeing a loyal user for years this is a sad least i hope they are rich now,thank you guys.

  13. rick said on September 7, 2012 at 8:49 pm

    NOOOOOO. One of the most truly useful services sucked up by Google.

    Undoubtedly they will find either the AV companies will pull out because VT is now Google, or Google will figure out there isn’t much profit in running a free service like VT.

    Anyone else thinking that it’s a good time to setup VT2? :)

    1. ocj2645029 said on April 7, 2015 at 10:43 am

      I just happened upon this page when a program uploaded to VirusTotal shut down everytime I uploaded via chrome. That Google aquired VT happened years ago and I just found out. Is this true? I wish this did not happen. I am not entirely sure how VT works but being that google is in bed with the NSA, could it possibly mean that they will allow viruses spawned from the NSA to go unflagged? I don’t like the idea of a big conglomerate like Google messing with antivirus. Norton allowed the feds infect computers with Magic Lantern. Are there any VT alternatives?

    2. Bob said on September 7, 2012 at 9:08 pm

      None of Google’s services are free. They will use it to collect data about you for their ad services and convert it to cash that way.

    3. Martin Brinkmann said on September 7, 2012 at 9:04 pm

      I hope that the service won’t be shut down or modified in a way that is reducing its value to Internet users. Only time will tell.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.