Antivirus Defence

Antivirus Defence analyses files that you explicitly choose. The enhanced Hybrid Pro scanner limits each selected file to 80 MB, calculates SHA-256, checks executable/script type and magic signatures, detects the EICAR antivirus test pattern, and applies the implemented local risk rules before any optional remote step.

Local selected-file scan

The local scan stays in the browser/PWA. It can identify PE/MZ and ELF executable signatures, suspicious or disguised extensions and the implemented file-content indicators. A clean result means no configured indicator was found; it is not a guarantee that the file is malware-free.

Explicit Online Deep Scan

If Online Deep Scan is enabled in Protection Settings and you deliberately activate it while connected, the selected sample is uploaded to /api/hybrid-security.php. The server repeats bounded heuristics and includes a ClamAV signature result only when a compatible clamscan executable is actually available. The endpoint is designed around the temporary PHP upload and does not intentionally persist the submitted sample.

Vault workflow

Scanner results can be copied into the local PWA File, Malware or Virus Vault. PWA quarantine is a controlled application copy/record in IndexedDB; it does not silently delete the original operating-system file.