How to check an archived file for malware?

[shmu26]

If virustotal.com won't check an archive for malware, and archives are exploitable,
what's the best way to handle an archived download, such as a .RAR file?

 

[hjlbx]

You have a couple of options:

1. Extract it and scan it - either on local system with AV or in Cuckoo Sandbox (online malware analysis - like COMODO Valkyrie) or Virus Total

2. Extract it and run it inside a sandbox - like Sandboxie or COMODO or VM

3. Extract it and run while in Shadow Defender's Shadow Mode

4. Add the archiver to anti-exploit protection - like HMP.A

5. Don't download any unknown\untrusted files

 

[shmu26]

You have a couple of options:

1. Extract it and scan it - either on local system with AV or in Cuckoo Sandbox (online malware analysis - like COMODO Valkyrie) or Virus Total

2. Extract it and run it inside a sandbox - like Sandboxie or COMODO

3. Extract it and run while in Shadow Defender's Shadow Mode

4. Add the archiver to anti-exploit protection - like HMP.A

5. Don't download any unknown\untrusted files

thanks. I also added in, to Avast Free, their software updater tool, so I will be prompted when WinRar has an update.

 

[jamescv7]

Our AV's already engage to scan on read and access from archived files, virtualization is your next step when the results are inconsistent. (As mentioned already)

 

[simbelmayne]

You have a couple of options:

1. Extract it and scan it - either on local system with AV or in Cuckoo Sandbox (online malware analysis - like COMODO Valkyrie) or Virus Total

2. Extract it and run it inside a sandbox - like Sandboxie or COMODO

3. Extract it and run while in Shadow Defender's Shadow Mode

4. Add the archiver to anti-exploit protection - like HMP.A

5. Don't download any unknown\untrusted files

Thanks a lot, I got similar problems. Now will try these methods.

 

[LabZero]

In addition to the suggestions by @hjlbx and @jamescv7 many AVs such as Avast, for example, allow you to scan compressed files but only if they are not password protected. In this case, no way to scan the archive.