Features and specifications
How Shield3D v2.7 scans, rates and cleans files, and what it runs on.
Scan engines
Maya-specific analysis combined with general antivirus engines, merged into one result.
| Engine | What it does | What you need |
|---|---|---|
| Shield3D | Parses .ma / .mb structure. Detects script-node malware and unknown variants | Nothing (built in) |
| YARA | Bundled rules, plus your own rules (Pro and above) | Nothing (built in) |
| ClamAV | Definitions for common viruses, trojans and more (free, open source) | ClamAV (free), installed separately |
| Microsoft Defender | The antivirus engine built into Windows | Nothing (built into Windows) |
| VirusTotal lookup | Looks up file hashes only and returns VirusTotal's verdicts (optional) | Your own Premium API key |
What it checks
Known malware
- SecureSystem family
- Vaccine / Phage family (vaccine.py, leukocyte)
- PuTianTongQing family (MayaMelUIConfigurationFile)
- uifiguration family
- Remote-control backdoor (contacts stictionholdings)
Unknown variants (by technique)
- Non-standard script nodes that run automatically
- Malicious code injected into standard script nodes
- Command execution inside expressions
- Code or data hidden in node attributes
- Executable commands at the top level of a scene
- Embedded executables
Deobfuscation and more
- Decodes base64, zlib, XOR, string concatenation and more, then rescans the contents
- Extracts and shows URLs and IP addresses
- userSetup, .py, .mel and executables included in a delivery
- Zip contents (nested archives and Japanese file names supported)
- SHA-256 of every file
What the verdicts mean
| Verdict | Meaning | What to do |
|---|---|---|
| Infected | Known malware, or detected by an antivirus engine | Do not open in Maya. Use the clean copy or ask for a new delivery |
| Dangerous | Suspicious code that runs automatically when opened, hidden code, embedded executables and similar | Same as above |
| Review | Not necessarily malware, but not normally found in a delivery | Check the contents |
| Unreadable | Could not be read (password-protected, damaged, etc.) | Extract or give the password and scan again |
| Clean | Nothing was found | — |
How cleaning works
Clean copies go to a separate folder; originals are never changed. Every clean copy is rescanned, and nothing is written if a problem remains.
Removes only the malicious nodes and the lines that reference them. Nothing else changes, byte for byte.
Overwrites malicious code with blanks of the same length and disables auto-run (neutralizing). The file structure is unchanged, so it still opens in Maya.
Removes only the lines the malware added.
Rebuilt with the cleaned files inside.
Cannot be repaired, so they are left out of the clean copy.
More features
PC check and clean-up
Scans this computer's Maya environment (user folders, environment variables, install folders) and removes known malware, moving originals to quarantine. Available on every plan.
Inspection reports (PDF)
A report of when and how files were scanned, what was found and what was done, addressed to your client.
Definition updates
Update to the latest definitions from the menu. New malware can be covered without reinstalling.
Pipeline integration
Run from the command line and use exit codes (0 clean / 1 review / 2 infected or dangerous) in your ingest scripts.
Japanese and English
The app, results and reports are available in Japanese and English, following your OS language.
System requirements
| OS | Windows 10 / 11 (64-bit) macOS 11 or later |
|---|---|
| CPU | Windows: x64 Mac: Apple Silicon / Intel (separate installers) |
| Maya | Not required (files are analysed without launching Maya) |
| Files | .ma, .mb, zip, .py, .mel, userSetup and more |
| Internet | Used for activation and definition updates. Scanning itself works offline (offline activation available) |
| Optional add-ons | ClamAV (free), VirusTotal Premium API key, mayapy (to fully delete .mb nodes) |
| Languages | Japanese, English |
Limitations
- No scanner can guarantee that a file is free of every threat. Keep your originals even when you use clean copies.
- Executables (.exe etc.) and general viruses cannot be repaired. They are left out of clean copies.
- VirusTotal's engines cannot all run locally. Lookups use file hashes, so new files VirusTotal has never seen show as “not found”.
- VirusTotal's free API key may not be used commercially. For business use, set your own Premium key.
- The first few times you open a clean copy (especially .mb), we recommend turning off Maya's “Execute script nodes”.
- While code signing is being completed, your OS may show a confirmation screen during installation. The manuals explain how to proceed.
Check the setup steps in the manuals before you buy.