Suspicious Files and Miscellaneous Uploads

Please upload any malware samples which are not yet detected by our products along with suspicious and other miscellaneous files using the upload form below.

 

	Fields marked with * are required
Your title:	Choose one... Mr. Ms.
Your name:
E-mail address:*
Language:*	Choose one... English German Français
File type:*	Suspicious File (Suspected Malware) Suspected False Positive (Not Malware)
URL: (max 1000 chars) Note: in case we detect a legitimate program by mistake please provide the URL where we can download the file. Questions can ONLY be answered by our support department.
Response type:*	HTML Text HTML & Text
Your file:*
	(Max. 8 MB)
Please wait - upload and analysis in progress

False positives:

If you think our scanner has detected a clean file by mistake please select "False positive suspicion" from the drop down menu above. Note that suspicious files and false positives need to be uploaded separately. Please make sure you verified that the latest version will still detect the file and it is not a solved false alarm at this point in time.

Spam Emails:

Please do not submit spam emails to our analysis system. Spam is advertisement which does not contain any malicious content.

Several files at once:

In case you want to upload several suspicious files at the same time we suggest to use a common archiving software such as WinZIP, WinRAR, PKZip or Arj.

Submit via email:

Alternatively you can send suspicious files via email to . Please make sure that you compress the files using a packer such as WinZIP, WinRAR, PKZip or Arj.
Since some email gateways are equipped with antivirus software, you should also give the file(s) a password to prevent them from being unpacked inadvertently. Please make sure that you're using the password "infected".
Please note that false positives have to be uploaded via web interface and marked as such.

Result:

If the suspicious file contains a new malware which is unknown to us at this point in time we will update our signature database. After that we'll be able to detect and - if technically possible - remove it.