Upon detection of a suspicious file, a
client computer sends feedback data to an anti-
malware service over
the Internet. Files that are not suspicious or that are known clean are not reported; files that are known
malware are acted upon immediately without needing to report them to the anti-
malware service. Upon detection, no alert or warning is provided to the user of the
client computer. The anti-malware service correlates data from other detection engines on the
client computer or from other client computers and determines whether the file is malware or not. A new
virus pattern is generated if the file is malware and includes the
virus signature of the file; the new
virus pattern is distributed back to the client computers. If not malware, no action need be taken, or, the virus signature of the file is removed from existing pattern files.