I have found it best to treat Anti-virus products like mal-ware themselves. They only get to live inside a VM for the sole purpose of antivirus scanning. This

I have found it best to treat Anti-virus products like mal-ware themselves. They only get to live inside a VM for the sole purpose of antivirus scanning. This VM has access to several different antivirus products, and I use a battery of them (after updating signatures) to scan any file that I am leery of trusting. I delete the VM afterwards. This is not impractical for my situation, because I do not have a large throughput of dubious files, perhaps a couple every 6 months or so.