Is testing for all executables without considering any files in the system is enough for deducing whether the system is infected with malware?

Question

I came to know that the malicious activities will be carried out only by a software(program) whereas the malicious files(data to the softwares installed in the system) can't perform the malicious activities directly by themselves but they can responsible for bringing those malicious softwares to the system( say like steganography).Hence those softwares also must be installed ( automatically or manually) before performing their activity.

If this is true scanning for malware in softwares before they get installed( triggered manually or automatically) is enough to say that the system is 100% secure(considering that our detector is ideally 100%accurate)?

Answer 1

There are many, many things that are not "executables" in the usual sense but could still carry / deliver malware. Here are just a few:

• Any kind of script, ranging from a batch file (.bat) on Windows to an NPM module.
• Any shortcut (.lnk) or desktop (.desktop) file.
• File formats with built-in programmability that can interact with the OS, such as MS Office documents that support macros (.doc / .docm / .xlsm / etc.).
• Any library file (.dll / .so), which contains executable code but is not itself executable as a program (no main method).
• Literally any file, regardless of extension, that contains an executable and has the execute permission (if invoked directly, such as from a shell).
• Any archive file (.zip / .tar / etc.) that contains one of the above.

That's without even considering exploits, such as URIs that compromise a handler program, PDFs or HTML with JS that can break out of the sandbox, file-sharing programs with path traversal bugs that could be used to deliver malicious files to places you don't expect them, listening sockets (servers) that can't handle malicious packets, or so on. Then there's risks such as a malicious (or compromised) OS, malicious firmware, malicious hardware, and so on.

Again, this list is just the stuff off the top of my head and is NOT comprehensive. There is literally no way to say that a machine is 100% secure, and even if you had a magical virus scanner with 100% accuracy, and could scan literally every file on the disk (not just the executables), it still wouldn't be enough.