Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For programs (obvious case being freewares) that are distributed as blobs or as executable is there a way to determine if the program is doing or will do something malicious?

share|improve this question
See – Mehrdad Feb 27 '12 at 0:59
up vote 3 down vote accepted

No, there is no way to know with 100% certainty that any binary you acquired can be trusted.

Tools like virus scanners rule out known threats, but they are not helpful for unknown threats.

Reviews on sites, and on the Internet can certainly help you rule out obvious and common malware.

Cryptographic signatures provide some of the strongest protection since they virtually guarantee that the binary you received was from a particular person or publisher. With a signature, you can decide if you trust the person/publisher.

If you do not trust a given binary, it is usually a good idea to try it on a spare computer or virtual machine first.

If you are extremely paranoid, the open source world provides a lot of confidence because you can get the source, which can review, and re-compile on your own.

share|improve this answer
> Tools like virus scanners rule out known threats, but they are not helpful for unknown threats. That’s what heuristics are for. – Synetech Feb 27 '12 at 1:01
I agree that they exist, and that they help, but they are certainly not perfect. They look for common types of attacks. If I was targeting a specific individual I would probably add a malicious payload that doesn't do something like common malware. – Zoredache Feb 27 '12 at 1:06
@Synetech -- A heuristic is for a known threat. It's just a generic form of a known threat. – Daniel R Hicks Feb 27 '12 at 1:18
@DanH that’s generally enough. For example, erasing the hard-drive is a red-flag regardless of what command is used to do it. – Synetech Feb 27 '12 at 2:04
Well, in theory the system protects against that, with storage protect and authorization requirements for "dangerous" system calls. If it's possible to circumvent those then it's an easy matter to write code that doesn't LOOK like it's doing something bad. – Daniel R Hicks Feb 27 '12 at 12:41

The quickest and easiest way is to subject it to a barrage of different malware scanners. There are websites that let you submit a file and scan it with numerous scanners, the most popular ostensibly being VirusTotal.

What’s particularly great about VirusTotal is that you don’t have to wait for it to be scanned if it has already been scanned before; you can get instantaneous results. Of course if the last scan was a while ago, you can opt to have it rescanned with the latest definitions. Another great thing about VirusTotal is that you don’t have to upload the file at all. You can search for the file’s hash (MD5 or SHA1), or even use the VirusTotal Uploader program which automates the whole process.

share|improve this answer

The ideal approach would be to run the suspect code in a "sandbox" or specially restricted virtual machine, but I don't know of any Windows-based tools that do this well enough to trust.

share|improve this answer

Sure - this is what virus checkers like McAfee do.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.