1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: receive, at a server, data corresponding to a file determined by a malware protection program to be malicious; compare malware definitions used by the malware protection program with malware definitions used by one or more other malware protection programs known to incorrectly identify files as malicious; perform signature analysis on the file to determine whether the file was incorrectly determined to be malicious; and forward to the malware protection program data indicating a false positive detection based on the signature analysis and comparison of the malware definitions used by the malware protection program with malware definitions used by the other malware protection programs.