As the question suggests, do antivirus softwares running on a local machine upload files they find malicious to their own servers for further research and is there a privacy concern here?


It depends on the AV product. Some AV products only upload new binary hashes, others the complete binary. For some, this is a configurable option. Looking at the AV products threat intelligence feed or similar offering might reveal their strategy in this area.


It is DNS query based. The AV software queries for the hash as a DNS query where the hash is the subdomain for the AV domain. E.g.


Based on the response, the AV decides whether is malware or not.

  • 1
    Which ones do this? It would be nice if you added some specificity to the claim (or a citation) – schroeder Sep 12 '18 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.