Does Antivirus upload malware samples from infected computers?

Question

According to Kaspersky, its antivirus software "automatically uploaded [malware samples] to Kaspersky’s specialists for further analysis." Is this common practice for antivirus software? How do they make sure they're not uploading personal files infected with malware?

I understand that antivirus software initially checks some hash of samples found on an infected computer and checks a database for a match first. I'm asking about the case where they don't find a match and have a potentially "new" malware.

Answer 1

• Kaspersky does not upload personal files by default
• Kaspersky will upload possible viruses for analysis only if YOU specify that

Since it is unclear what version you refer to, I'll give you a general example:

• Options for this are very well controllable. Even on older versions (like KAV 2013), if you open the application settings window, in the left part of the window, you can select the Advanced Settings section. In the Operating mode section, you can click the Settings button and the Operating mode window opens. There, you can select the Enable dump writing check box to enable the application to write application dump files. You can then select the Send dump and trace files to Kaspersky Lab check box or choose to clear the Send dump and trace files to Kaspersky Lab check box.

If the file is not actually found to be infected but you still consider it suspect, you can upload it manually for analysis using VirusDesk ( https://virusdesk.kaspersky.com ).

• In the current versions of Kaspersky Security Center, you also have the clear option (Under Advanced --> Application management): I agree (or not) to participate in Kaspersky Security Network.

As for propaganda like "Russian hackers exploited vulnerabilities in the antivirus program to breach an NSA contractor’s computer in 2015 and steal classified files" it's totally irrelevant. Some big corporations wanted some revenge because Kaspersky was the only anti-virus that disclosed what some big manufacturers were doing to potentially or directly (i.e. seagate) spy anyone using their components. That's why all the fuss in the US against Kaspersky.

I've been using various anti-virus solutions since the MS-DOS era and I can say hands down that currently Kaspersky is one of the best AV solutions up there, even no.1 at this moment.

Note that What I considered the best AV varied a lot every few years, because some AV companies improved a lot while others made bad choices. My view on this was always impartial.

Answer 2

Q : I'm asking about the case where they don't find a match and have a potentially "new" malware.

There is similar controversial that some research claims on carbon black(CB) , which is due to manual setting, by default, even experiment heuristic detection will stay inside the user quarantined folder. However, some AV might practice to send sha256 hash of the detected file to keep it as statistic ( This raise another issue. I.e. in Europe, to compliance with GDPR, the IP address and all possible fingerprinting info of the user must be strip.) . In addition, there is also logistic issue to analyze user files, e.g. storage, resources to analyze the file.

For enterprise, most prominent AV vendor "enterprise/business" solution always keep the file inside the organization, which may also lock the user client AV from changes (like change the setting to submit the infected file).

In short Prominent AV will not collect detected file. Submission of sample is always an opt-in/voluntary.