E-mails for submitting samples to AV companies

Trojan Remover:
submit[*at*]simplysup.com

The Cleaner:
trojans[*at*]moosoft.com

TrojanHunter:
submit[*at*]misec.net

PS:
As for TrojanHunter:
The one included already might do it also, but see:
http://www.misec.net/forum/board/FAQ/1139308293

 

Email list updated
Added:
- The Cleaner.
- Trojan Remover.
Changed:
- Trojan Hunter.

 

BOClean changed into bocleansubmissions_{at}_comodo.com

 

Email list updated
Changed:
- Comodo BOClean.

If anybody has other addresses or finds some mistakes, please let me know

 

More:

Antivirus:
Fire anti-virus kit: service -a-t- fireav.com
MKS-Vir: wirus -a-t- mks.com.pl
Quickhel: viruslab -a-t- quickheal.com
Sybari: submit_virus -a-t- research.sybari.com
Twister: virus -a-t- filseclab.com
Vexira: virus -a-t- centralcommand.com
Rising: support -a-t- rising-eu.de
Websense Security Labs: submit -a-t- websensesecuritylabs.com
WebWasher: support -a-t- securecomputing.com
ZoneLabs: malware -a-t- zonelabs.com

Antitrojan:
A-squared: submit -a-t- emsisoft.com
BOClean: submissions -a-t- nsclean.com; bocleansubmissions -a-t- comodo.com
Tauscan Anti-Trojan: trojans -a-t- agnitum.com
Trojan Hunter: submit -a-t- misec.net; submit -a-t- trojanhunter.com
Trojan Remover: submit -a-t- simplysup.com

Antispyware:
Ad-aware: research -a-t- lavasoft.com
The Cleaner: trojans -a-t- moosoft.com
Counterspy: spywarereport -a-t- sunbelt-software.com
Spybot: detections -a-t- spybot.info
Spysweeper: submissions -a-t- webroot.com
Spyware Terminator: support -a-t- crawler.com
SuperAntispyware: samples -a-t- superantispyware.com
Windows Defender (Microsoft): windefend -a-t- submit.microsoft.com
McAfee: spyware_research -a-t- avertlabs.com


Additional Info:
eSafe - Submit Possible Malicious Code Samples to Aladdin's CSRT
http://www.esafe.com/home/csrt/vsubmit.asp

eTrust AV - Submit a Virus Sample
http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=33514

 

External Link:
Where to send Suspicious files - http://www.segura.ca/files.html
A list of antivirus vendors' e-address - http://forum.windowspower.de/verdaechtige-Dateien-analysieren-lassen-w9512-.html

Thanks for reading.

 

A question. For those of us who don't know one end of a virus from a trojan should we use Castlecops MIRT instead?

 

What are you trying to say?

 

For sending virus samples to MicroWorld (www.mwti.net) please write an email to support [at] mwti.net.

 

For MicroPoint Proactive Defense Software;

virus(at)micropoint.com.cn

More information about MPDS,you can refer to the following posts:
https://www.wilderssecurity.com/showthread.php?t=164621 OR
http://www.micropoint.cn

 

For AVLab of antidote company (that builded by team previously worked at UNA):
newvirus@avlab-ua.com

 

I found this site for submit samples to Symantec:
https://submit.symantec.com/websubmit/retail.cgi

 

Very good site about samples submission:
http://assiste.com.free.fr/p/antivi...yer_un_echantillon_par_email_a_l_analyse.html

 

Submit Malware Sample to Sunbelt Sandbox:
http://research.sunbelt-software.com/Submit.aspx

 

[April 2008]

Comodo BOClean:

Recently the submission address has been changed to:

malwaresubmit[ at ]comodo.com

See also:

http://forums.comodo.com/comodo_boc...n_submission_address_april_2008-t22343.0.html

http://forums.comodo.com/comodo_boclean_antimalware/fp_flashdisinfector-t22106.0.html

reply # 7 on 22 April 2008:

 

Agnitum: http://www.agnitum.com/support/submit_files.php
Ahnlab: v3sos(at)ahnlab.com, e-support(at)ahnlab.com
http://global.ahnlab.com/global/virusreport_main.ESD
ANSAV: http://www.ansav.com (check right sidebar)
Antiy: submit(at)virusview.net
Arcabit: wirus(at)arcabit.pl
http://www.arcabit.pl/sprawdz_pliki
Avast: virus(at)avast.com
AVG: virus(at)grisoft.cz
Avira: virus(at)avira.com, heuristik2(at)avira.com (gen/heur fp)
http://analysis.avira.com/samples/
BitDefender: virus_submission(at)bitdefender.com
http://www.bitdefender.com/site/KnowledgeBase/getSupport/ (note)
BKAV: bkav(at)bkav.com.vn
BullGuard: support(at)bullguard.com
Bytehero: virus(at)bytehero.com
ByteHero: support(at)bytehero.com
CA: virus(at)ca.com
http://home3.ca.com/Support/VirusSampleForm.aspx?
ClamAV: http://cgi.clamav.net/sendvirus.cgi
CMC: support.is(at)cmclab.net, contact(at)cmcinfosec.com
Command: virus(at)authentium.com
Comodo: malwaresubmit(at)avlab.comodo.com, falsepositive(at)avlab.comodo.com
http://internetsecurity.comodo.com/submit.php
CyberDefender: support(at)cyberdefender.com
Dr.Web: vms(at)drweb.com
https://vms.drweb.com/sendvirus/?lng=en
eAcceleration: http://research.eacceleration.com/submit_sample/
eEye: malware(at)eeye.com
EmsiSoft: submit(at)emsisoft.com, fp(at)emsisoft.com (fp)
http://www.emsisoft.com/en/support/submit/
eSafe: esafe.virus(at)eAladdin.com, virus(at)esafe.com
ESET: samples(at)eset.com
eXtendia/Guardian: TechSupport(at)BoomerangSoftware.com
Filseclab: virus(at)filseclab.com
FireAV: service(at)fireav.com
Fortinet: submitvirus(at)fortinet.com
F-Prot: viruslab(at)f-prot.com
http://www.f-prot.com/virusinfo/submission_form.html
http://www.f-prot.com/virusinfo/false_positive_form.html (fp)
F-Secure: vsamples(at)f-secure.com
https://analysis.f-secure.com/
Gdata: http://www.gdatasoftware.com/support.html
Hacksoft: virus(at)hacksoft.com.pe
Hauri: hauri98(at)hauri.co.kr
http://www.hauri.net/support/virus_report.html
http://www.hauri.net/support/false_report.html (fp)
Ikarus: samples(at)ikarus.at, false-positive(at)ikarus.at (fp)
http://www.ikarus-software.at/cgi-b...step1&emp=IKARUS virus.utilities&submit=more
Immunet: submit(at)samples.immunet.com, support(at)immunet.com (fp)
Iolo: support-crm(at)iolo.com
http://www.iolo.com/customercare/technicalsupport.aspx
Jiangmin: virus(at)jiangmin.com, open-file(at)jiangmin.com (fp)
K7 Computing: k7viruslab(at)k7computing.com
Kaspersky: newvirus(at)kaspersky.com
Kingsoft: support(at)kingsoftresearch.com
http://www.kingsoftsupport.com/kingsoft/upload.php
Lavasoft: research(at)lavasoft.com
http://upload.lavasoft.com/upload/submit_file.php
Mcafee: virus_research(at)avertlabs.com, spyware_research(at)avertlabs.com (note)
datasubmission(at)mcafee.com (fp) (note)
Micropoint: virus(at)micropoint.com.cn, support(at)micropoint.cn
http://service.micropoint.com.cn/mail.php (tick 2nd option - To report suspicious files)
Microsoft: avsubmit(at)submit.microsoft.com, windefend(at)submit.microsoft.com, mfcs(at)submit.microsoft.com
https://www.microsoft.com/security/portal/submit.aspx
Microworld: support(at)mwti.net
MKS-Vir: pomoc(at)mks.com.pl
http://www.mks.com.pl/pomoc/wyslij_zarazony_plik (1.5 mb limit)
Moonsecure: http://www.moonsecure.com/vsubmit.php (note)
MyFreeAntivirus: http://smartpctools.com/support.html
Net Protector: service(at)indiaantivirus.com
http://indiaantivirus.com/virussample.html
Netgate: research(at)spy-emergency.com
http://www.spy-emergency.com/content/view/43/58/
Nictasoft: http://www.nictasoft.com/new-virus/
Norman: analysis(at)norman.no
http://www.norman.com/security_center/security_tools/submit_file/en-us
http://www.norman.com/support/fp/en (fp)
nProtect: http://global.nprotect.com/support/contactus.php
Nuwavesoft: support(at)nuwavesoft.com
Panda: virus(at)pandasecurity.com, falsepositives(at)pandasecurity.com (fp) (note)
ParetoLogic: SWAT(at)Paretologic.com
http://www.paretologic.com/community/submissions/ (check left sidebar)
PCMAV: redaksi(at)pcmedia.co.id
PCSecurityShield: customersupport(at)pcsecurityshield.com
PC Tools: http://www.pctools.com/mrc/submit/
Prevx: virus(at)prevxresearch.com, report(at)prevxresearch.com (note)
Proland: virsample(at)pspl.com
http://www.pspl.com/support/samplesubmit.htm
QuickHeal: viruslab(at)quickheal.com
http://www.quickheal.co.in/submit_sample.asp
http://www.quickheal.co.in/submit_fp.asp (fp)
Returnil: support-tech(at)returnil.com (note)
Rising: master(at)rising.com.cn
http://mailcenter.rising.com.cn/FileCheck/
http://support.rising-global.com/index.php?_m=tickets&_a=submit&step=1&departmentid=1
Sophos: samples(at)sophos.com
http://www.sophos.com/support/samples
Srnmicro: vlab(at)srnmicro.com
Sunbelt: malware-cruncher(at)sunbelt-software.com, spywarereport(at)sunbelt-software.com
http://www.sunbeltsecurity.com/Submit.aspx?type=submitThreat&cs=CBC13D0C3CD1A677D45D4A0825C756EA
http://www.sunbeltsecurity.com/Submit.aspx?type=falsePositive&cs=5104D20A8309C784EE7BCD8BFF85EB45 (fp)
Sybari: submit_virus(at)research.sybari.com (note)
Symantec: avsubmit(at)symantec.com
https://submit.symantec.com/websubmit/retail.cgi
https://submit.symantec.com/dispute/false_positive (fp)
TrendMicro: virus_doctor(at)trendmicro.com
http://subwiz.trendmicro.com/SubWiz/Default.asp
Trustport: support(at)trustport.com
VBA32: newvirus(at)anti-virus.by
Vexira: virus_submission(at)centralcommand.com
Vir.it: assistenza(at)viritpro.com
VirusBuster: virus(at)virusbuster.hu
https://support.virusbuster.hu/index.php?_m=tickets&_a=submit (tick Virus Lab)
Virus Chaser: inquiry(at)viruschaser.com.hk
http://www.viruschaser.hk/e_contact.php (select Virus Support)
Webroot: submissions(at)webroot.com
http://www.webroot.com/En_US/about-vendorcomplaint.html (fp)
Websense: submit(at)websensesecuritylabs.com
http://securitylabs.websense.com/content/reportMalicious.aspx (select Malicious Application)
Zonelabs: malware(at)zonelabs.com

Greatis: support(at)greatis.com
Hazard Shield: andy(at)orbitech.org
Iobit Security 360: is360submit(at)iobit.com
http://db.iobit.com/deal/sdsubmit/index.php
Malwarebytes: http://uploads.malwarebytes.org
Nemesis: support(at)usec.at
NoVirusThanks (?): robert(at)novirusthanks.org
PC DoorGuard (?): astonsupport(at)astonsoft.com
Remove Fake Antivirus (?): olzenkhaw(at)hotmail.com
Spybot: detections(at)spybot.info
http://www.safer-networking.org/en/contact/detections.html
Spyware Terminator: contact(at)spywareterminator.com
http://www.spywareterminator.com/support/support-ticket.aspx
Superantispyware: samples(at)superantispyware.com
http://www.fileresearchcenter.com/submitfile.html
http://www.fileresearchcenter.com/vendordispute.html (fp)
The Cleaner: trojans(at)moosoft.com
http://www.moosoft.com/TheCleaner/WebSubmit
TheStubware: support(at)thestubware.com
Trojan Hunter: submit(at)trojanhunter.com
Trojan Remover: submit(at)simplysup.com
ZeroSpyware: support(at)zerospyware.com
http://www.spyware-net.com/ReportSpyware

AVLab-UA: newvirus(at)avlab-ua.com
http://www.avlab-ua.com/component/option,com_performs/formid,2/lang,ru/
http://www.avlab-ua.com/component/option,com_performs/formid,3/lang,ru/ (fp)
UNA: newvirus(at)unasoft.com.ua
UploadMalware: http://www.uploadmalware.com

Most security vendors suggest that you put your sample(s) inside a password-protected archive* (preferably zip) to prevent being filtered/corrupted. In the e-mail/web form body include the archive password, symptom(s) of the infection(s) and if possible the site url(s) where you got the suspect file(s). In some cases if you can't locate the file(s), just e-mail the malware url(s) to your vendor and ask for removal assistance.

If you suspect your security vendor has produced a false positive (fp), put the detected file(s) inside a password-protected archive* (preferably zip). To get hold of the file(s), temporarily disable the real-time shield of your security software, restore the file(s) from quarantine and put the file(s) in your software's exclusion list. Refer to the help file of your security software to do those. In the e-mail/web form body include the archive password, site url(s) where you got the file(s) and reason(s) why the file(s) is/are safe.

*How to password protect zip files in windows XP/windows vista? If you're using an older Windows Operating System you need a 3rd party archiver (like 7-zip that is free). Refer to the archiver's help file.

If you spot any mistakes, wrong contacts/links or would like to add other vendor contacts please post them. Thanks.

PS: Don't forget to change (at) to @. Some forms/links are not in English so use online translators like Google's or Yahoo's to translate them into English or your language.

 

Hello all

To submit suspicious files to ParetoLogic, please use the following link:

http://zhengupload.paretologic.com/

To view a full list of submission options for Paretologic please visit:

http://www.paretologic.com/community/submissions/

Thank you and Kindest Regards
Laura
Paretologic Liaison

 

Thanks Laura. No submission e-mail or can we use helpdesk(at)paretologic.com? Paretologic Antivirus uses Kaspersky engine right? What version? Does the AV also contain sigs of Paretologic Antispyware?

By the way, anyone know what happened to CP Secure? http://www.cpsecure.com redirects to http://www.lunarpages.com. I don't think they're out of business since CP Secure on Virscan still updates.

TIA

 

Hello TIA

Thank you so much for your questions.

If anyone wishes to make a submission by email, it can go to SWAT (at) Paretologic.com .

As ParetoLogic Anti Virus PLUS was developed under license with a major third party AV company, for commercial and contractual reasons; I am unable to confirm the name of the partner.

Paretologic AntiVirus PLUS integrates AV with our own anti-spyware technology and is supported by a dedicated in-house security analysis team led by Jerome Segura.

To keep up with Jerome and his team and their study and analysis of malicious threats online, please visit his Malware Diaries Blog

http://blogs.paretologic.com/malwarediaries/index.php/

Kindest Regards
Laura
Paretologic Liaison

 

Thanks Laura. I updated the list. By the way, TIA=Thanks in advance.

No worries. I'm betting it uses engine 6.0 . Those who want to try, click the link below. The update: AS db is 24 mb and the AV db is 70 mb.

http://paretologic.safecart.com/plav/download (direct)

 

To answer myself, CP Secure was acquired by NETGEAR and completed the acquisition since Dec. '08. For more info:

http://kb.netgear.com/app/answers/detail/a_id/2650