[yabun]

A lot of new malware is self-modifying. In situations where this is the case checksums lose most if not all of their value. Heuristics in such situations are really the only viable option.

[kazinator]

No, I mean to know what is clean.

[yabun]

OK, but that's a very large data set that to track - does AV software actually do that?