Find out if any AV detects the file and interpret the results
The first thing you should do when checking to see if a file is dangerous is to find out if any antiviruses (AV’s) detect it as dangerous. The best way to do this is to upload the file to a site where it will be scanned by multiple AV’s. One of the best sites for this is Virustotal. This site will scan your file with up to 42 different scanners and show the results separately for each one. This entire process should take less than a minute. Also, you can upload files that are up to 20 MB in size. If a significant number of scanners show a warning then the file is likely to be dangerous. The downside is that malware is being created so quickly that in order to try to keep up with it the antivirus companies are forced to use heuristic detections and generic signatures to catch them.
Using heuristics and generic signatures really is a necessary evil. Sadly, the problem with these methods is that they may incorrectly identify a legitimate file as malicious. This is known as a false positive. If one or two AV’s detect a file with heuristics and the other AV’s do not, then it is likely a false positive. If your AV is the one that detects it then you should report it as a false positive to your AV. Most AV vendors have a procedure for doing this which will be explained either on their website or in the user guide (help) which comes with the program. In case you don’t want to search for this, a comprehensive list of where to report false positives and suspicious files is given at Links to report malware to all major AV's.
In some cases it’s even possible for more than one AV to incorrectly detect a file as dangerous. There are a few ways that this can happen. One of the most common is that the file may perform an action that is routinely seen in malicious files, but in this case is being used for a legitimate purpose. This would likely cause it to be detected with heuristics. Another possibility is with generic signatures, which search for pieces of code that are very similar to those found in known malware. The problem is that sometimes small pieces of legitimate code can resemble that found in malware. Thus in this way a legitimate file can be marked as malware. Yet another reason is that AV companies tend to share detection signatures between them. Thus if one AV vendor finds a file to be dangerous another may quickly follow.
Examine the behavior of the file and interpret the results
In addition to seeing if any AV’s currently detect the file it’s also a good idea to check if the behavior of the file seems malicious. There are many websites that will analyze the behavior of a file and give you their opinion about whether it might be malicious or not. Two of the easiest to use and understand are Comodo Instant Malware Analysis (CIMA) by Comodo and ThreatExpert by PC Tools.
CIMA will display the results immediately after its analysis. This could take anywhere from one to five minutes and depends greatly on how long it takes the file itself to run. Also, there is no limit to the size of the file that can be uploaded, but currently it can only analyze executable files. The results of the analysis are given near the end of its report and will give you its opinion of the file. If it says that the “Auto Analysis Verdict” is “undetected” then it did not find any suspicious activity in the behavior of the file. The verdict can also be Suspicious, Suspicious+, and Suspicious++. These indicate that it found suspicious behavior in the file with Suspicious++ being the most suspicious. It also lists the reasons it found it to be suspicious directly below the verdict.
ThreatExpert will send you the results via email. This should usually take less than ten minutes. The maximum size that you can upload here is 5MB. If it finds the behavior of the file to be malicious it will have a box called “Summary of the findings” near the top of the report. Inside of here it will list the behaviors that were found to be suspicious and how severe it thinks they are.
The response time for both of these services may vary greatly depending on the complexity of the file and the server load. You can also scroll through the detailed information about the behavior of the file to learn even more about the behavior of the file. Advanced users should also check out Anubis. This provides much more information about the behavior of the file, but may be difficult to understand for some users. It generally takes a few minutes to analyze, but may take much longer depending on the server load. Anubis also provides a verdict of whether the file is suspicious or not, but I find it to be less reliable than that of CIMA or ThreatExpert.
Submit the file to an AV and find out for sure if it's malicious
One almost certain way to check if a file is malicious is to submit it to an AV vendor for analysis. The drawback is that this takes time and doesn’t instantly provide the information necessary to make a quick decision. Some vendors will send an email with the results of the analysis. A few of the most notable are Avira AntiVir (http://analysis.avira.com/samples/index.php), Kaspersky (newvirus[at]kaspersky.com), and McAfee (Virus_Research[at]avertlabs.com). With these vendors you will usually receive the email within a few hours.
Conclusion
It’s generally a good idea to rely on multiple methods in order to determine whether a file is malicious or not. Also, if a file is found to be suspicious by any of these methods it’s a good idea to report it to your own AV as suspicious. This way, if the file is dangerous you will be protected from that particular malware in the future. A signature for the malware will be added to their database and you will receive this as part of your normal updates.
There is currently no method for knowing with 100% certainty whether a file is malicious or not, but by following the methods discussed on this page you should have enough information to make a very informed decision.
