Follow:

Microsoft Volume Licensing Blogtwitter

Sample submission help

If you have a file that you suspect could be malware or potentially unwanted software, you can submit it to us for analysis. This page has answers to some common questions about submitting a sample.

You can get more help on the following pages:

Expand all

How do I send a malware file to Microsoft?

You can send us files that you think may be malware or potentially unwanted software using the following form:

We receive a large number of samples from many sources. Our analysis is prioritized by the number of file detections and the type of submission.

You can help us complete a quick analysis by providing detailed information about the product you were using and what you were doing when you found the file.

If you sign in before you submit a sample you will be able to track your submissions.

Can I send a sample by email?

No. We only accept submissions through our sample submission form.

Can I submit a sample without signing in?

Yes.

Your sample will be submitted anonymously and it won’t show up in your submission history. You will get a link to a webpage where you can view your submission status.

If you are having trouble signing in you may want to reset your account password.

How do I report a false positive or dispute a detection?

Before you submit a report it’s a good idea to read about how Microsoft identifies potentially unwanted software:

If you are the vendor of a product that you believe has been incorrectly classified you can contact us for a re-evaluation of the software.

For the fastest response, please submit your request in English.

If you believe Microsoft security software has mistaken your program for another program you can submit a False Positive Report form:

For the fastest response, please submit your request in English.

How do I track or view past sample submissions?

You can track the samples you submit through the Submission history page. Your submission will only appear on this page if you were signed in when you submitted it.

If you’re not signed in when you submit a sample you will be redirected to a tracking page. Bookmark this page if you want to come back and check on the status of your submission.

What does the submission status mean?

We give submitted files one of four statuses:

  • Received – we have received your submission

  • Under active investigation – we are actively looking in to the file

  • Preliminary results available – the initial analysis is complete and we have some results

  • Analysis Completed – full analysis is complete. If malware was found, we have created a definition update for it

If you are signed in you can see the status of any files you submit to us on the Submission history page.

What does submission priority mean?

You can give a file a priority when you send it to us. This tells us the impact the file is having on your computer:

  • Low - if a file has only a minor impact on your system, such as pop-up ads, or email attachments that you were sent but didn’t open

  • Medium – if a file has a moderate impact on your computer system, for example, if it makes some programs unusable or gives you fake security warnings.

  • High – this priority is only available if you have software assurance. It is for malware files that pose a significant risk, for example by causing your network or computer to crash, compromising your personal information or data, or spreading rapidly

How can I contact Microsoft for help?

For product support visit the Microsoft Help and Support Portal.

If you think your computer has a malware infection you can get help at the links below: