scan.now
Premium Scan a site

Known malware signature match

The file matched a known malware signature, in our own signature set or in the local antivirus daemon when one is configured. Treat it as hostile.

Do this: Delete it, and scan the machine it came from. The content matches a known malware family, so this is not a heuristic guess.
PassNo known malware signature matched this file.
CriticalThis file matches a known malware signature.

The fix, in one snippet

Example to adapt Do not open it 
Delete the file and run a full scan on whatever machine produced or received it.

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

Scan.now computes the file's SHA-256 in memory and compares it with the list of known-malicious hashes we hold, built from public feeds such as abuse.ch MalwareBazaar and from earlier verdicts. Where a signature engine is available to the server, the bytes are streamed to it for a full scan against its malware databases, with archive unpacking limited to safe depths. We report the signature name (for example Win.Trojan.Agent-…) when one is returned. We do not publish which engines sit behind that layer: telling the people who write malware exactly what they need to evade would make the layer worth less to you. The file is never written to disk or kept after the scan.

Limits: signatures identify samples that analysts have already classified. New, repacked or polymorphic malware will not match, so a pass here is not a clean bill of health; the structural checks on this site exist for that reason. When ClamAV is not configured, the page says so and the match comes from the hash list only.

Why it matters

A match means the bytes are identical to, or share a signature with, a sample that has been analysed and named. That is a specific threat, not a heuristic: an information stealer that reads saved browser passwords, cookies and wallet files in seconds; a remote access trojan; a ransomware loader. The common delivery is an "invoice" attachment, a cracked-software installer or a fake update. If you have already run the file, assume the attacker has whatever was on the machine at that moment, including live sessions for sites you were logged into.

How to fix it

Do not open it. Delete it, and tell the sender if they are a real contact, because their account or machine may be compromised. If it has already been executed: disconnect from the network, run a full scan with the installed antivirus (Microsoft Defender Offline on Windows reboots into a clean environment), then from a different, clean device change the passwords that were saved in the browser and any you typed recently, sign out of all sessions on major accounts and enable two-factor authentication. For a remote access trojan or ransomware, reinstall the operating system rather than trusting a cleanup. Work machines go to IT immediately.

If you believe the match is a false positive, look up the hash with the hash reputation check and on MalwareBazaar or VirusTotal before deciding. Guides: how antivirus scanning works, malware types explained and what to do after a compromise.

Where this fits

Known malware signature match is check 1 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

What fixing this still leaves open

Known malware signature match closes one route in. Immediately below it: Script contains download-and-execute commands, where the script contains commands that download and execute code or tamper with system defences, such as PowerShell IEX with a web request, certutil -urlcache or mshta with a remote URL; Archive contains an executable, where the archive holds an executable, installer, script or shortcut, the standard way to get a program past an email filter that blocks bare attachments; Decompression bomb, where the archive declares an uncompressed size vastly larger than its compressed size, so extracting it could fill your disk or freeze whatever tries to scan it.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Known malware signature match (critical severity)
Scanner check id: known-malware-signature
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. ClamAV documentation
  2. abuse.ch MalwareBazaar
  3. CISA: Malware, Phishing, and Ransomware
  4. Microsoft Defender Offline

Related guides

8 min read · Updated Sep 02, 2026 How Antivirus and Malware Scanning Actually Works

A scanner decides whether a file is malicious by matching known signatures, analysing structure, emulating behaviour and consulting...

Read the guide 8 min read · Updated Sep 18, 2026 Malware Types Explained: Viruses, Worms, Trojans, Ransomware, Spyware and Infostealers

The words are used interchangeably but they describe different behaviour. This guide defines each type by how it spreads and what it...

Read the guide 8 min read · Updated Sep 14, 2026 Your Data Was in a Breach: What to Do in the First Hour, Day and Week

Breach notifications are routine now, and the response is not obvious. This guide gives a prioritised checklist: Which passwords to...

Read the guide