What is Virus Scanning?
Virus scanning checks uploaded files against signatures, heuristics, or other detection rules for malicious and unwanted content. It is one upload-security layer, not a substitute for format validation or sandboxing.
How Virus Scanning works
An upload scanner extracts or reads file content and applies current signature, reputation, and behavior-oriented rules before the asset is trusted. What happens to a flagged file depends on configuration: some services quarantine it for review, while others exclude it from further processing or stop the job with an error. This gate belongs early in ingestion, alongside MIME verification, parser hardening, authorization, and isolation, because each control addresses a different class of risk.
Key facts
- Nested archives and highly compressed inputs need recursion, expanded-size, and processing limits; otherwise a scan can consume excessive CPU, memory, disk, or time before reaching a verdict.
- Signature detection is strongest for known samples, while heuristic rules can flag modified threats but may increase false positives; engine and definition updates affect both outcomes.
- A clean verdict says only that the configured scanner found no match at that time. It does not validate the declared format or make a vulnerable media parser safe to run.
When Virus Scanning matters
Files should be scanned before distribution to users, internal systems, or permanent storage. A clean result does not prove safety because signatures can be outdated and some threats evade detection.