Malware Defence

Malware Defence performs bounded analysis of files you explicitly choose. The enhanced Hybrid Pro scanner limits each file to 80 MB, calculates SHA-256, examines executable/script types and magic signatures, and evaluates implemented malware-risk indicators in supported content.

Implemented local indicators

Current local/server heuristics include disguised double extensions, PE/MZ and ELF signatures, the EICAR test pattern, encoded PHP or JavaScript execution, compressed-code execution, request-controlled shell execution, encoded PowerShell patterns, selected living-off-the-land command indicators and high-entropy/packed-content signals.

Online-assisted analysis

Choosing a file does not automatically upload it. If you deliberately request Online Deep Scan while connected and the setting is enabled, the sample is transmitted to the Omega server endpoint for bounded analysis. ClamAV is used only when actually present on the host; otherwise the response identifies the available server heuristic engine.

Classification and vaults

The Hybrid runtime combines local and available server risk signals into Clean, Review or Malware classifications and updates local counters. You may then place a controlled copy/record into the local threat vault. No result is an absolute guarantee.