[Lit Whycake]

Hello, I have a question, some people on the internet, when there is an installer on the web and it has malware or files are running in the background, they warn other people about this anomaly but... how do they know or in what section exactly do they detect if they are running? external or malicious files within the installer, do you have any method? thanks good night

[DramaKing]

The method is antivirus.

[Astrologer]

Run an antivirus scan of your PC if you downloaded a program that may contain a virus. You can also scan a file to see if it may contain a virus such as using file scanning tools like virustotal.com

[Bastille]

You can upload the file on different platforms to execute them safely and get a report to see how they behave :

Virustotal
Hybrid-analysis
Any.run (free version limited)
Intezer (not free)

But for the non free ones you can see the reports if someone already uploaded the same file simply by pasting the hash

[Hackers]

Hello, I have a question, some people on the internet, when there is an installer on the web and it has malware or files are running in the background, they warn other people about this anomaly but... how do they know or in what section exactly do they detect if they are running? external or malicious files within the installer, do you have any method? thanks good night

AV will scan the static code for any known "bytes". For example let's say a common malware starts with "IAMMALWARE" in its text section. This is something that can be searched for & detected. This is why malicious malware creators will obfuscate, encrypt, and change their code so that it's not repeatedly detectable.

They use a thing called a 'minifilter' & other tools to detect new processes, new files, networking requests, etc. This is then analyzed and they can compare to known malware patterns to flag new malware.

There are also just blanket rules - for example Windows Defender will always warn no matter what if there is no signature on the software, if it's .exe, and is downloaded from the net. This doesn't mean it's malware - this is an example of something that always warns even when there's nothing to warn about.