Submitting malicious files to Microsoft for analysis


Applies to: Forefront Protection 2010 for SharePoint

If you suspect a file to contain malware or potentially unwanted software, you can submit it to Microsoft for analysis. You can use one of the following methods to submit malware files to Microsoft for analysis:

Submitting files through the Microsoft Malware Protection Center Portal

The following Web site enables users to submit files that are suspected of containing malware or potentially unwanted software to Microsoft for analysis:

You can access this portal directly from the Forefront Protection 2010 for SharePoint Administrator Console. In the Server Security Views - Dashboard pane, in the Actions section, click Submit Malware Sample.

After you have accessed the Microsoft Malware Protection Center portal, on the Submit a sample page, follow the instructions for the portal submission process.


When prompted, enter your Microsoft Software Assurance ID. This ensures that your malware submission is given a higher priority assignment in our submission queue as compared to those anonymously submitted. For more information on software assurance, visit the following Microsoft Web site: Software assurance information

Preparing files for submission

If your submission is larger than 10 megabytes or you want to submit multiple files for analysis, compress the file or files into a single .zip or .rar archive (must be less than 10 megabytes in size) and password protect the file with the password "infected" (without quotation marks).

When you submit the file, make sure that you include the following data:

  • Your name and email address

    Microsoft sends all responses to the email address that you use to submit the files. When you submit the archive file, Microsoft processes the file and then sends a determination of the files that it contains, based on the current Microsoft malware definitions. If it is necessary, adjust your incoming mail filters to ensure that you receive this message.

    If you want to add additional email contacts to receive updates about the status of the submission, also include these contacts and add the following note in the comments field: "Please Reply All".

  • Support case number (optional)

    A support case number is not required to submit files for analysis. However, if a support case is already open for this submission, you can include the case number.

  • Product that you are using

    Select Microsoft Forefront Server Security. (In the comments section, you may want to list a more specific product name, for example Microsoft Forefront Protection 2010 for SharePoint.)

  • False positives

    If the submission includes files that you believe were incorrectly determined to contain malware, select the I believe this file should not be detected as malware check box. Otherwise, the files are assumed to contain malware.

  • File to submit

    Click the Choose File button to browse to the file you want to submit for analysis.

  • Description of the malicious activity

    In the comments field, describe what the files did to make you suspect that it contained malware. Also include the operating system on which the suspected malware was found (for example, Windows Server 2008 R2), as well as any additional information that may be helpful in analyzing the files.

About the response message

After you submit the malware files, we send you a response to confirm the receipt of the submission. We then follow up with the results of our analysis and with responses from our partners. If you want more frequent updates through sample review, such as for high-priority submissions, it is recommended that you open a support case.

Submitting files through Microsoft Customer Support Services

Microsoft Customer Support Services can submit files on your behalf. If you have an urgent malware situation that FPSP does not address, or if it is after regular business hours, it is recommended that you contact Customer Support Services for help. To do this, use the support information that was provided to you when you purchased FPSP, or visit the following Microsoft Web site: