File - List of Engines

Identifying files according to antivirus detections

The main search box also allows you to specify a full or partial malware family name ( Backdoor.Win32.PcClient!IK, Sality, Mydoom.R), or any other text you want to find inside the antivirus reports. However, this kind of search will look at all indexed fields for the file, it will not only focus on the antivirus results. In order to focus exclusively on the antivirus results (no matter which particular engine produced the output), you should use the engines prefix. For example:engines:"Trojan.Isbar"or engines:"zbot".

If you are looking for files detected by some specific antivirus vendor you can make use of vendor prefixes. These prefixes should preceed your keyword in order to restrict the scope of the search to a particular antivirus solution, for example: symantec:infostealer, mcafee:rahack, f-secure:virut.

By using vendor prefixes you can also search for all files detected by a given vendor, independently of the malware name. To do this you must write the vendor prefix followed by the special keyword infected, e.g. ESET-NOD32:infected. In this case the word infected does not necessarily have to be present in the antivirus signature, it is just indicating that the file must be detected. Similarly, you can list all files not detected by some antivirus by using the keyword clean. For example:ESET-NOD32:clean.

 

This is the full list of allowed vendor prefixes:

acronis	ad_aware	aegislab	ahnlab
ahnlab_v3	alibaba	alibabacloud	alyac
antivir	antivir7	antiy_avl	apex
arcabit	avast	avast_mobile	avg
avira	avware	babable	baidu
bitdefender	bitdefenderfalx	bitdefendertheta	bkav
bkav_pro	cat_quickheal	clamav	cmc
commtouch	comodo	crowdstrike	ctx
cybereason	cylance	cynet	cyren
deepinstinct	drweb	egambit	elastic
emsisoft	endgame	escan	eset_nod32
f_prot	f_secure	fireeye	fortinet
gdata	google	gridinsoft	huorong
ikarus	invincea	jiangmin	k7antivirus
k7gw	kaspersky	kingsoft	lionic
malwarebytes	max	maxsecure	mcafee
mcafee_gw_edition	microsoft	microworld_escan	nano_antivirus
nod32	nprotect	paloalto	panda
prevx1	qihoo_360	rising	sangfor
sentinelone	sophos	sunbelt	superantispyware
symantec	symantecmobileinsight	tachyon	tencent
thehacker	totaldefense	trapmine	trendmicro
trendmicro_housecall	trustlook	varist	vba32
vipre	virit	virobot	webroot
whitearmor	yandex	zillya	zonealarm
zoner

The list is subject to changes as new antivirus solutions are integrated in VirusTotal and existing ones change names so do not forget to visit it every once in a while.

Back to Top