There's a link to Kaspersky's forum post from 2012 floating on the net: http://www.anti-malware.ru/forum/index.php?showtopic=24588&page=3#entry164300 http://www

There's a link to Kaspersky's forum post from 2012 floating on the net: http://www.anti-malware.ru/forum/index.php?showtopic=24588&page=3#entry164300 http://www.anti-malware.ru/forum/index.php?showtopic=24588&p... (Web Archive shows this topic — initially about Avast breaking Windows by blocking tcpip.sys but turned into flame about “shitty free antiviruses”, their lack of analytics team, and pirated software quite soon — existed in 2012.) He explains it had been done a couple of years back to demonstrate the problem to Computer Bild journalists. A number of executable files with “funny” code that could not do any actual harm were made and 50% of them were added to Kaspersky's detection list under distinctive names. Then they all were shared on VirusTotal (and thus with other vendors). Surprisingly enough, only those “viruses” that triggered Kaspersky Antivirus on VirusTotal started spreading through others' databases, often with the same name. Still, there was no article written on that for some reason. These results were later presented to analytics and investors visiting Kaspersky's conference (Security Analyst Summit 2012). So what's left is to ask Computer Bild if they participated in something like that test and/or someone who was on that conference.