Antivirus signature distribution with distributed ledger

This document generally describes techniques for using a distributed ledger to implement a framework for the validation and distribution of virus signatures, which may be used by antivirus engines on computing devices to detect and remove malware. Some implementations can include accessing, by a computing system, data that identifies a plurality of virus signatures. A signature score associated with a first virus signature can be identified that is determined based on a number of signature authorities that have submitted or endorsed the first virus signature. The computing system may determine whether the first virus signature is valid based on whether the signature score satisfies a threshold score. In response to determining that the first virus signature is valid, the first virus signature can be used by the computing system to perform virus scans of one or more files maintained by the computing system.