There’s are countless anti-malware tools out there today that claim to be capable of defending you from every form of virus and Trojan. But it’s easy to wonder if these tools actually work. Websites offering file malware scanners have become increasingly popular in recent years, but the accuracy of their results depends on a few important factors.
Do File Malware Scanners Really Work?
In most cases, file malware scanners do work. Websites like VirusTotal and Avcheck protect users fromsuspicious and malicious filesevery year through their comprehensive flagging services. If the website recognizes the file, it compares the file’s unique hash signature to a database of known file hashes and returns the information it has available.
If the website doesn’t recognize the file, it downloads it and runs it through dozens of virus scanners—effectively gaining more insight into the trustworthiness of a file than you would be able to gain with the antivirus application installed on your PC. Overall, this input is useful—but it’s better for identifying known threats, and the risk of false positives or negatives is always worth considering.
Issues to Look Out for When Using Malware Scanners
It’s advisable to use a file malware scanner when you’re nervous about whether a file is safe. Understanding the pitfalls of malware scanners will help you discern when it’s better to trust your own judgment, however.
1. Malware Scanners Won’t Scan Encrypted Files
The most significant flaw of file malware scanners is that they do not decrypt files. If an encrypted file or container is uploaded to a file malware scanner, the underlying contents won’t be examined. While it’s likely that you would decrypt files before uploading them to these scanners, the same can’t be said for hackers who wish to mislead you.
As documented on theChris Partridge website, some hackers will present file check results for encrypted files to prove that the file they’re providing is safe. It’s vital for you to assess whether a file is truly safe—beyond what the vendor wishes to tell you—before you use it. Examine what they scanned. Did they scan the same file you downloaded, and more importantly, did they decrypt the file?
2. Malware Scanners Rely on Identifying Known Malware
The exact techniques used to examine files vary depending on the file scanner you use, but generally speaking, most rely on existing antivirus scanners and hash signature matching to identify whether a file is malware. While that virtually guarantees that they’re capable of protecting you from known viruses, they may not be helpful when it comes to cutting-edge malware.
In other words, it’s important for you tocheck whether you might be at risk of file-based malwarebefore you decide whether a file might be safe to download.
Instead of using a file malware scanner, consider verifying the checksum associated with the file. Doing so will determine that the file you downloaded is the same as the original.
If the file came from a suspicious Discord message that was probably a phishing scheme, you shouldn’t take any bets. But if you acquired the file from trustworthy sources, it’s probably not the next WannaCry.
3. Malware Scanners May Flag False Positives
The final flaw of file malware scanners—and antivirus applications, for that matter—is that they’re also prone toflagging false positives. Some file malware scanners, such as VirusTotal, mitigate this by cultivating a community of experts who often comment on specific file records if they believe that they were falsely flagged as malware.
If you have a particularly rare file, however, you might not be able to rely on the community for insight, as the knowledge base may be poor.
You should verify the checksum of the file from if you’re concerned it was falsely flagged, as well as consider whether there’s a more reliable place to download it from. If it’s an application, consider whether it exhibits any behavior (like keystroke monitoring) that could have been mistaken for malware.
Scan Files and Secure Your System
Though file malware scanners are imperfect, they are one of the best tools you can use for determining whether a suspicious file is trustworthy. But these tools are best used in knowledgeable hands. By understanding the shortcomings of file malware scanners, you can empower yourself to make safe judgments on each and every file you download.
