diff --git a/modules/security/malware-scanner.sh b/modules/security/malware-scanner.sh
index b1ccc6c..cdef99f 100755
--- a/modules/security/malware-scanner.sh
+++ b/modules/security/malware-scanner.sh
@@ -349,13 +349,15 @@ install_maldet_only() {
         if [ -n "$local_archive" ]; then
             echo ""
             echo "Using pre-downloaded archive..."
-            if cp "$local_archive" /tmp/maldetect-offline.tar.gz 2>/dev/null; then
-                temp_file="/tmp/maldetect-offline.tar.gz"
+            temp_file="/tmp/maldetect-offline.tar.gz"
+            if cp "$local_archive" "$temp_file" 2>/dev/null && [ -f "$temp_file" ] && [ -s "$temp_file" ]; then
                 download_success=true
                 best_source="offline-archive"
                 echo -e "${GREEN}✓ Archive ready for extraction${NC}"
             else
-                echo -e "${RED}✗ Failed to copy archive${NC}"
+                echo -e "${RED}✗ Failed to copy or validate archive${NC}"
+                download_success=false
+                temp_file=""
             fi
         else
             echo -e "${RED}✗ No local archive found${NC}"
@@ -380,8 +382,12 @@ install_maldet_only() {
         fi
     fi
 
-    # At this point, download_success should be true with temp_file set
-    if [ "$download_success" = true ] && [ -f "$temp_file" ] && [ -s "$temp_file" ]; then
+    # Extract and install if we have a valid archive
+    if [ "$download_success" = true ]; then
+        if [ ! -f "$temp_file" ] || [ ! -s "$temp_file" ]; then
+            echo -e "${RED}✗ Archive file missing or empty: $temp_file${NC}"
+            return 1
+        fi
         echo "Installing from $best_source..."
         echo ""