You have located suspicious files in your environment and would like to submit them to Symantec Security Response for review.
How do I submit suspicious files to Symantec?
You can submit up to 9 files in a compressed file at once via Symantec's Suspected Infected File Form. Files must be in either a WinRAR or WinZIP format.
Essential and Business Critical customers should contact support for access to our priority queues.
What information is needed to submit through the web submission site?
You will need to provide your name, company name, email address and Support ID number.
Note: In the past, you may have used your Contact ID number to submit files to Security Response. The use of the Contact ID number for submissions has been discontinued in favor of the Support ID number in order to simplify submissions. Please use your Support ID number going forward.
Where can I find my Support ID number?
Your Support ID number is written on your Symantec support certificate. Your Support ID number is a twelve digit number in the following format: XXXX-XXXX-XXXX.
If you have difficulty locating your Support ID, please open a case for additional assistance.
How many files can I submit?
You may upload multiple files at once by using WinZip or WinRar. A zipped file cannot be password-protected. The maximum size for one submission is 100 MB.
Do not submit more than 9 files in any zip file, regardless of size. It is important to note that some file types, like .jar and .cab, may be containers that include files exceeding the maximum file count.
Can I provide information or ask questions at this site?
The web submission form includes a field to detail symptoms you believe are associated with this file. Security Response engineers do not provide answers to questions posed in this form. If you need further information, please contact Technical Support.
I received a mail prompting me to download a file from a suspicious URL. How best to proceed?
Do not download the file! Provide the suspicious URL to Security Response via the submission form. Security Response will attempt to download the file and process it like a standard submission.
For Emails which prompt for credentials rather than download a file, use the Report Suspected Phishing Sites form.
What happens next?
- You will receive an automated email reply that contains the tracking number for this submission. Please retain this number. The sender's address will be firstname.lastname@example.org.
Note: If you have a Technical Account Manager (TAM) or Remote Product Specialist (RPS), they will receive a copy of all automated email messages sent to you.
- Your submission will be immediately scanned by our automated system using current certified and current rapid release definitions. If this file has been previously submitted, you will receive an automated closing email. The email will include the known determination and, if malicious or a security risk, instructions on how to retrieve definitions that will detect the file.
- The Security Response engineer who reviews the file will make a determination on the status of the file. If clean, they will close the submission process and an automated email message will be sent identifying the file as clean.
- If it is determined the file is malicious or a security risk, the engineer will create a signature that will trigger a detection on this file. They will then pass the submission on to a Quality Assurance (QA) engineer.
- Once the QA engineer has verified that the signature correctly identifies the file, that engineer will close the submission process and an automated email message will be sent. This message will indicate the determination on the file and include instructions on how to download definitions that contain the detection.
What if I want to submit a file that I believe is being falsely detected?
Please submit files you believe are being falsely detected via Symantec's Suspected Erroneous Detection (False Positive) Form. A reference number will be sent via email upon submission. Symantec engineers will maintain contact via email as the reported false positive is investigated. The article Best Practice when Symantec Endpoint Protection is Detecting a File that is Believed to be Safe contains additional details. Suspected IPS False Positives are also reported through that same site: see Best Practice for Responding to Suspected IPS False Positives in Symantec Endpoint Protection.
Is this a secure submission site?
Yes. This site uses HTTPS. It also takes advantage of Secure Sockets Layer (SSL) and 128-bit encryption, providing a secure method of transporting the files to Symantec.
Please see the Connect article Symantec Insider Tip: Successful Submissions for additional recommendations on using the web submission forms.