1. A method for managing antivirus records, the method comprising: providing a data store of antivirus records; providing an antivirus application to be executed on each of a plurality of user computers, each antivirus application configured to access the data store and at least one antivirus record, wherein the antivirus application is further configured to detect a malicious software file for antivirus records having a test status and detect and contain a malicious software file for antivirus records having a working status; and executing instructions by a remote server, the remote server including computing hardware of at least one processor, a memory operably coupled to the at least one processor and configured to store instructions invoked by the at least one processor, an operating system implemented on the computing hardware, and input/output facilities, cause the remote server to implement: a processing tool configured to: collect at least one antivirus record parameter for a particular antivirus record from the plurality of user computers, the antivirus record having a working status after occurrence of the detection event of the antivirus record on one of the plurality of user computers, wherein each detection event is associated with the antivirus record, collect statistical data of the detection events of the antivirus record from the plurality of user computers, and determine whether a total number of user computers on which the detection event of the antivirus record occurred over a predetermined period of time exceeds a detection threshold, wherein the detection threshold is based on the at least one antivirus record parameter, and a classification tool configured to: determine, when the total number of user computers on which the detection event of the antivirus record occurred exceeds the detection threshold, whether the antivirus record contains a false activation by at least one classification algorithm comprising a support vector machine operating on antivirus records in attribute space using the at least one antivirus record parameter and statistical data of the detection event, wherein the support vector machine generates a linear separation of antivirus records with a hyperplane based on a training set of antivirus records, wherein a first class grouping of the attribute space define false activation antivirus records and a second class grouping of the attribute space discrete from the first class grouping define malicious antivirus records, and change the status of the antivirus record from working status to test status, wherein the processing tool is further configured to receive the changed status of the antivirus record from the classification tool and distribute the changed status to the data store.