Malicious code patterns of an antivirus may be updated using public DNS (domain name system) servers. An update to the malicious code patterns may be generated and divided into several portions for inclusion in DNS records. The DNS records may be published for caching in public DNS servers. An update client in a client computer may send out DNS queries to receive contents of the DNS records, which include the portions of the update. The update client may combine the portions to update the malicious code patterns in the client computer.