I really think that the signature database ( containing malware signatures and blacklisted dns and domains ) that all antiviruses have are on the device the software has been installed to, but this not a big deal as most of them have the SAME threats but with different identifications and names and removal methods ( depends on how they did that in their labs ) { they literally cheat from each others }
BUT THE BIG DEAL is around the AUTO-PROTECT and Sandboxing technologies and of course INTRUSION DETECTION and REAL TIME and END POINT and FIREWALL Features and ANTI-EXPLOITING functions. Those mentioned are all private codes that really took them a lot of good work. These are already implemented algorithms and thresholds and testing functions made when programming the software itself they tend to update those once in a while. The earlier mentioned ones ( which are databases of signatures and websites ) are on the other hand updated on a daily basis as new threats are identified every day.
So basically, you can find the database on your computer with some digging ... I even think you can get that list ( fresh ) somewhere on the internet or darknet ... can't remember its name .. but am sure it is there somewhere.
It's useless anyway unless you need to make sure your codes aren't identified as malicious OR you are thinking about building your own AV.
