How LC9 Defence finds malware

1. Known threats

LC9 keeps a set of malware definitions on your computer: the exact fingerprints (SHA-256 hashes) of known malicious files, and short byte patterns that identify malware families. Every definitions update is digitally signed by LC9, and the app checks that signature before using it, so a tampered update is rejected.

2. Warning signs

New malware often isn't in anyone's definitions yet, so LC9 also looks inside files for tell-tale signs. It reads files; it never runs them. It looks for things like:

• programs whose real code is hidden by packing or encryption;
• programs built to inject code into other running programs, or replace their code;
• programs that record keystrokes or decrypt saved browser passwords;
• commands that delete Windows backups and restore points, a classic step before ransomware strikes;
• scripts that secretly download and run code, or try to switch off antivirus protection;
• files disguised with fake extensions, such as invoice.pdf.exe.

One sign on its own is never enough: lots of legitimate software does some of these things. LC9 reports a file only when several signs add up, and doesn't flag software signed by a trusted publisher on suspicion alone.

What happens when LC9 finds something

Known threats are ticked for quarantine. Suspicious files are shown for you to review, with the reasons, and aren't ticked. Quarantined files are encrypted so they can't run, and you can restore them if you're sure they're safe.

What LC9 Free doesn't do

LC9 Free scans when you ask it to. It doesn't watch files as they arrive: that's real-time protection, which is coming in LC9 Premium. Deep rootkit and memory scanning aren't included yet.