1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: identify, using an antimalware client executed on a host device, a file in memory of the host device; determine, at the antimalware client, attributes of the file relating to reputation of the file; send a query from the host device to an antimalware support system relating to the file, wherein the query is to include local reputation data describing the attributes of the file and the query further comprises a request for the antimalware support system to perform a reputation analysis of the file in response to the query; receive, in response to the query, particular reputation data from the antimalware support system, wherein the particular reputation data is generated by the antimalware support system during the reputation analysis based at least in part on the local reputation data; receive a remediation script from the antimalware support system based on the query; run the remediation script on the antimalware client to remove the file from the memory of the host device; and use the antimalware client to dispose of the remediation script following the removal of the file.