You can only scan for known malware. Plenty of ways to write new apps to do bad things that scanners won't detect.