Malware Scanning
Definition
Malware scanning on a file host means passing each upload through one or more detection engines and acting on the verdict. An engine compares the file, and the hash of the file, against databases of known bad content, and applies rules about file structure — an executable inside an archive, a macro in a document, a mismatch between the declared type and the actual bytes. Scanning happens at upload time and often again later, because a file that was clean this morning can be flagged this afternoon when a new signature lands. It is detection of the known, not judgement of the unknown: a scanner recognises things that have been seen and catalogued, which is why no host describes a scan as a guarantee that a file is safe.
Why It Matters
A host that serves a malicious file does damage in three directions at once — to the person who downloads it, to the uploader whose address is now attached to it, and to every other site on the same domain, because browser and mail blocklists tend to work at the hostname level. One bad file under a shared domain can turn a red interstitial warning onto unrelated pages for days. From the uploader's side the thing to understand is the false positive: a self-extracting installer, a packed binary, a macro-enabled spreadsheet, a large minified script can all trip a rule without being malicious at all. Knowing that the flag is a heuristic, and that there is a review route behind it, saves a lot of frustration.
How It Works
The usual pipeline is: accept the upload, compute a checksum, look that hash up against known-bad and known-good sets, then run the bytes through a scanning engine such as an open-source or commercial signature scanner. Archives are unpacked to a bounded depth and their members checked individually. A clean verdict publishes the file; a flag either quarantines it — stored but not served — or holds it for human review, with the uploader notified and given a way to respond. Rescanning against refreshed signatures catches files that were undetectable when first uploaded. Hosts publish what they will not accept in an acceptable use policy, and enforcement follows from that document rather than from the scanner alone.
Real-World Example
A developer uploads a 60 MB ZIP of a desktop tool to 99helpers to share with testers, and the link comes back marked as held for review rather than live. The archive contains a signed executable that a scanning engine reports as suspicious on structure alone. The developer replies to the notice with the vendor signature details and the file is released; had they instead published the installer as a link to the vendor's own download page, the review would not have been triggered in the first place.
Common Mistakes
- ✕Reading a scan as a clean bill of health — scanners catch what is already catalogued, so a brand-new sample can pass
- ✕Renaming a file or changing its extension to get past a hold, which is treated as evasion and usually escalates the case rather than closing it
- ✕Assuming a flag is permanent — most hosts run a review process, and a legitimate file is normally restored once identified
- ✕Publishing an executable or a macro-enabled document when a plain PDF or a link to the vendor would do, and then being surprised by the delay
Related Terms
Automated Content Scanning
The broader set of automatic checks a host runs over what people publish, beyond looking for malware. It sorts uploads into serve, hold for review, and refuse.
Acceptable Use Policy
The document setting out what a host allows people to publish and what it will act on. It is the rulebook that every suspension, takedown and review decision refers back to.
Abuse Report
A complaint sent to a host about something published on it — malware, impersonation, spam, copyright, harassment. It opens a review, and the quality of the report largely decides how fast that review moves.
Checksum
A checksum is a short fixed-length value calculated from a file's bytes, used to confirm that the copy you received is identical to the copy that was sent. Same bytes in, same value out — and one changed bit produces a completely different value.
Upload Limit
An upload limit is the ceiling on a single upload operation — how much you may send in one request, and sometimes how many files or how often. It constrains the act of sending, not the size of any one stored file and not the total you are allowed to keep.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →